Compliance frameworks do not name products, and any vendor claiming their box makes you compliant is telling you what you want to hear. What a framework does is impose obligations that translate into specific firewall behaviour. That translation is the useful part, and it is where most of the cost sits.

Below is what each framework tends to drive in a Fortinet deployment. It is guidance, not legal advice.

CMMC 2.0 — defence contractors

If you handle Controlled Unclassified Information under a DoD contract, CMMC applies. Level 2 aligns to NIST SP 800-171. In practice this drives an enclave design: CUI is segmented into a defined boundary with controlled flows in and out, authentication is MFA everywhere administrative access is possible, and audit logs are retained and reviewable.

CJIS — law enforcement

The FBI CJIS Security Policy applies to any network touching criminal justice information. It drives segmentation between CJI and non-CJI systems, MFA for administrative and remote access, and defined log retention. A firewall that can produce the segmentation evidence and the access logs is most of the technical answer.

FISMA — federal agencies and contractors

FISMA requires an agency-level security programme with continuous monitoring. Technically it usually lands on NIST SP 800-53 controls, which a firewall contributes to through boundary protection, audit generation and least-privilege policy.

StateRAMP — state and local cloud services

StateRAMP adapts FedRAMP for state and local government, giving a common verification standard for cloud services. For a firewall deployment it means the same control evidence, scoped to a state procurement audience.