NIST Lists Fortinet FortiClient Crypto Module as FIPS 140-3 Validated

The National Institute of Standards and Technology’s Cryptographic Module Validation Program (CMVP) lists Certificate #5493 for Fortinet’s FortiClient Crypto Module v1.0 as active. The certificate identifies the module as software validated to FIPS 140-3 Security Level 1 and gives August 16, 2031 as its stated sunset date. The source describes the module as providing cryptographic services for FortiClient, Fortinet’s endpoint security application. For government buyers, this is product-level compliance evidence relevant to evaluating cryptographic capabilities—not a general approval of every product or deployment associated with the vendor.

The distinction between a validated module and a complete product deployment is important in federal procurement. A certificate can help an agency or prime contractor assess whether cryptographic services in a proposed solution have been validated, but the buyer must confirm that the specific product, version, configuration, and operating conditions use the validated module within the certificate’s defined scope. The source also notes a caveat concerning externally loaded security parameters. Evaluation teams should therefore review the certificate details and applicable documentation rather than treating the validation as a blanket finding about all Fortinet VPN products, configurations, or implementations.

For solicitations that specify FIPS validation, the certificate may support market research, technical evaluations, compliance documentation, and discussions with vendors. It does not, on its own, establish that a proposed solution meets every requirement in an agency’s solicitation or satisfies other security, deployment, or authorization obligations. Contracting officers and technical evaluators should map the certificate’s scope and status to the exact requirement language, including any requirements for a particular validation level, product version, operational environment, or implementation. The provided information identifies no solicitation, award, contract value, or pricing.

The certificate’s active status and stated sunset date also make timing relevant. Buyers planning procurements or deployments that extend beyond August 16, 2031 should assess certificate status and applicability against the schedule and terms of the specific procurement, and verify current status during evaluation. Fortinet lists prodseccompliance@fortinet.com for product security and compliance inquiries, which procurement teams can use to seek clarification about the module’s scope, supported product versions, and the externally loaded security-parameter caveat. The source quote characterizes the module narrowly: “The FortiClient Crypto Module v1.0 is a software cryptographic module that provides cryptographic services for FortiClient, Fortinet's endpoint security application.”

• NIST CMVP Certificate #5493 lists FortiClient Crypto Module v1.0 as active.
• The module is validated to FIPS 140-3 Security Level 1.
• The certificate states a sunset date of August 16, 2031; verify status and applicability during procurement.
• The module provides cryptographic services for FortiClient, Fortinet’s endpoint security application.
• Treat the certificate as evidence about the validated module, not blanket validation of every Fortinet VPN product or deployment.
• Confirm the proposed product version, configuration, and operating conditions use the module within the certificate’s scope.
• Review the certificate’s caveat concerning externally loaded security parameters when assessing compliance.
• Map the certificate to the exact solicitation language and any additional agency security requirements; it does not establish compliance with all requirements by itself.
• Fortinet lists prodseccompliance@fortinet.com for product security and compliance questions.
• The source identifies no contract opportunity, award, or pricing.