Fortinet Vendor Risk Assessment — Full Report

Recommended Actions

Steps to address findings for Fortinet

1. 1

   PRIORITY 1 — Request SOC 2 Type II report and bridge letter: Contact Fortinet's security team via trust.fortinet.com and request their current SOC 2 Type II report along with a bridge letter covering the period since the last audit. Many vendors will provide this under NDA. Document the receipt date and audit period in your vendor risk register.

   SOC 2 Overview (AICPA)NIST Supply Chain Risk (SP 800-161)
2. 2

   PRIORITY 2 — Verify ISO 27001 certification status: Request the current ISO/IEC 27001 certificate directly from Fortinet, including the certificate number, issuing certification body, scope, and expiry date. Cross-check the certificate number independently at https://www.iafcertsearch.org to confirm it is active and not expired.

   ISO 27001 Standard
3. 3

   PRIORITY 3 — Assess product vulnerability exposure: Review your organization's deployment of Fortinet products (FortiGate, FortiWeb, FortiSIEM) against Fortinet's PSIRT advisories at https://www.fortinet.com/corporate/about-us/security-and-compliance/psirt.html. Confirm that all deployed Fortinet appliances and software are running current patched versions, specifically addressing the zero-days and KEV-listed vulnerabilities identified in community discussion (2FA bypass in FortiGate, multiple FortiWeb RCE vulnerabilities). Establish a process to review Fortinet PSIRT advisories on a weekly cadence.

4. 4

   PRIORITY 4 — Obtain AI data usage commitment in writing: Contact Fortinet's data privacy team and request a written statement clarifying whether customer data processed by Fortinet AI features is used for model training, which third-party AI providers are involved, and what the applicable retention periods are. Reference https://fortinet.com/trust in your inquiry. If training on customer data cannot be ruled out, evaluate whether this conflicts with your data processing agreements or regulatory obligations.

   DPA Template (GDPR Art. 28)
5. 5

   PRIORITY 5 — Manually review subprocessor list: Navigate to https://fortinet.com/docs/subprocessors and manually document all listed subprocessors, their processing roles, and their countries of operation. If the page is access-restricted or non-parseable, request a current subprocessor list from your Fortinet account representative. Screen identified subprocessors against your organization's OFAC and sanctions screening requirements.

   GDPR Subprocessor Rules
6. 6

   PRIORITY 6 — Verify CSA STAR and HITRUST status: Confirm CSA STAR certification or self-assessment directly at https://cloudsecurityalliance.org/star/registry (search 'Fortinet'). Verify the HITRUST directory entry at https://directory.hitrustalliance.net/search?q=Fortinet to determine whether the 90%-confidence match represents a confirmed Fortinet certification. Document findings in your compliance file.

7. 7

   PRIORITY 7 — Review marketing site security headers: Note that fortinet.com's marketing website received a D+ HTTP security grade (40/100) with missing Strict-Transport-Security, Content-Security-Policy, and X-Frame-Options headers. While this applies to the public marketing site rather than the authenticated application endpoint (auth.fortinet.com), raise this with your Fortinet account team and request a security header assessment for the application domain your organization uses. Verify independently at https://observatory.mozilla.org/analyze/auth.fortinet.com.

   Check Security HeadersCSP Reference (MDN)

• Certificate Transparency log data (Certificate Transparency service) was partially unavailable during this assessment; subdomain enumeration was therefore limited to data from the direct TLS handshake. The reported certificate issuer (DigiCert Inc) is confirmed, but a full subdomain inventory could not be completed.
• External cyber risk scoring was not available for this assessment, meaning quantitative benchmarking of Fortinet's security posture against industry peers could not be performed.
• The vendor's subprocessor page at fortinet.com was found but could not be parsed by automated tooling, leaving the specific subprocessor list unreviewed in this assessment.
• ISO 27001 certification was not found in the IAF CertSearch registry; this may reflect a registry indexing gap, a certification issued under an unindexed body, or a genuine absence of current certification. Manual verification with the vendor is required to resolve this ambiguity.
• The HITRUST directory returned a possible match at 90% confidence for Fortinet but could not be confirmed as a unique entity match versus a name collision — manual verification with HITRUST Alliance is required.
• SSL/TLS analysis service deep cipher and protocol analysis data was not returned for fortinet.com in this assessment cycle; TLS configuration assessment is therefore based on data from the direct TLS handshake only (TLS 1.3, AES-256-GCM confirmed).