State, Local Government & Education
Cooperative contracts, CJIS-bound networks, and school districts under E-Rate
State and local buyers have something federal buyers largely do not: cooperative purchasing. A contract competed once by one state or consortium can be used by thousands of other public entities without re-competing it, which turns a six-month procurement into a purchase order.
The two largest are NASPO ValuePoint, which aggregates demand across all fifty states, DC, the territories and their political subdivisions, and OMNIA Partners, which runs its own solicitations and covers K-12, higher education, government and non-profits. Membership in these is typically free to the buying entity.
The other thing that distinguishes this segment is budget rhythm. Public budgets are annual, often use-it-or-lose-it, and frequently capital rather than operating. That has a real effect on what to buy: a multi-year FortiCare and FortiGuard term bought inside a capital year is usually better value than annual renewals fought for out of a shrinking operating budget.
Law enforcement and CJIS
Any network touching criminal justice information falls under the FBI's CJIS Security Policy, which is prescriptive in ways general security frameworks are not, advanced authentication, session lock, audit content and retention, and encryption requirements are all specified rather than left to judgement.
In practice this drives three things in a firewall design: segmentation that provably separates CJI from everything else, logging that satisfies the audit-content requirements and is retained for the required period, and multi-factor authentication on administrative access. The retention requirement in particular tends to decide the FortiAnalyzer model long before throughput does.
K-12 and E-Rate
E-Rate Category Two funds internal connections, basic maintenance of internal connections, and managed internal broadband services. What counts as eligible has moved repeatedly in recent funding years, particularly around cybersecurity equipment, and the Eligible Services List for your specific funding year is the only authority worth relying on.
We will not tell you a firewall is E-Rate eligible as a general statement, because that has not consistently been true and the answer depends on the funding year and the configuration. What we will do is help you read the current ESL against a specific proposed configuration, and structure a quote so eligible and ineligible items are separated cleanly, which is what makes a Form 471 straightforward rather than a source of later recovery.
Higher education
Universities are among the hardest networks to secure and the least like a corporate estate: open by tradition, enormously diverse in device population, carrying research data with its own compliance obligations, and required to support a residential population that would be a substantial ISP in its own right.
The practical consequences for firewall selection are unusual. Session counts matter more than throughput. Segmentation between administrative, academic, research and residential networks is the whole design rather than a feature. And anything touching federally funded research may bring NIST SP 800-171 obligations that look a great deal like CMMC.
Buying through a cooperative contract
If your entity is eligible to use a cooperative contract, ask us which ones apply to the products you want and we will work with the contract holder. As with federal vehicles, we do not list cooperative contracts on this site that we do not hold, but a contract we do not hold is a routing question, not an obstacle.
Straight answers
Can we use a cooperative contract with you?
Tell us which cooperative your entity participates in and what you are buying, and we will tell you honestly whether we can transact on it directly or whether it routes through a contract holder we work alongside. Either way you get the same sizing and deployment work.
What does CJIS actually require of a firewall?
The Security Policy does not name products. In practice it drives segmentation that provably separates criminal justice information, audit logging with specified content retained for a specified period, advanced authentication on administrative access, and encryption in transit. The retention requirement usually decides your FortiAnalyzer sizing, and it is the piece most often under-specified.
Are firewalls eligible for E-Rate funding?
It depends on the funding year and the configuration, and it has changed more than once. We will not give you a blanket yes, check the Eligible Services List for your funding year, and we will help you map a specific configuration against it and structure the quote so eligible and ineligible items are separated.
Our budget is use-it-or-lose-it. Can you work to that?
Yes, and it usually argues for buying a longer FortiCare and FortiGuard term up front rather than annual renewals. Tell us the fiscal year end you are working to and what has to be invoiced by when, and we will build the quote around that constraint rather than around our own quarter.
Tell us the constraint you are working within
The vehicle, the threshold, the fiscal year end, the framework you are assessed against. We will build the quote around it rather than around our own quarter.