UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM SD

SPECIALIZED DISCLOSURE REPORT

FORTINET, INC.

(Exact Name of Registrant as Specified in its Charter)

John Whittle

(408) 235-7700

(Name and telephone number, including area code, of the person to contact in connection with this report.)

Not Applicable

(Former Name or Former Address, if Changed Since Last Report)

Check the appropriate box below to indicate the rule pursuant to which this form is being filed, and provide the period to which the information in this form applies:

Conflict Minerals Disclosure

A copy of the Conflict Minerals Report of Fortinet, Inc. (“Fortinet”) for the reporting period January 1, 2019 to December 31, 2019 is filed as Exhibit 1.01 to this specialized disclosure report on Form SD and is also available at Fortinet’s website at https://investor.fortinet.com/sec-filings.

Fortinet has filed, as an exhibit to this Form SD, a Conflict Minerals Report as required by Item 1.01 of this Form.

SIGNATURES

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the duly authorized undersigned.

Exhibit 1.01 to Form SD

Fortinet, Inc.

Conflict Minerals Report

For the Reporting Period January 1, 2019 to December 31, 2019

This Conflict Minerals Report (“CMR”) has been prepared by Fortinet, Inc. (herein referred to, alternatively, as “Fortinet,” “we” and “our”). This CMR for the reporting period January 1, 2019 to December 31, 2019 is presented to comply with the final conflict minerals implementing rules (“Final Rules”) promulgated by the Securities and Exchange Commission (“SEC”), as modified by SEC guidance issued on April 29, 2014 and the SEC order issued on May 2, 2014. The Final Rules were adopted by the SEC to implement reporting and disclosure requirements related to conflict minerals as directed by the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 as codified in Section 13(p) of the Securities Exchange Act of 1934. The Final Rules impose certain reporting obligations on SEC registrants whose manufactured products contain conflict minerals that are necessary to the functionality or production of their products. “Conflict minerals” are currently defined by the SEC as cassiterite, columbite-tantalite (coltan), gold, wolframite, or their derivatives, which the SEC has currently limited to tin, tantalum and tungsten.

To comply with the Final Rules, we conducted due diligence on the origin, source and chain of custody of the conflict minerals that were necessary to the functionality or production of the products that we manufactured or contracted to manufacture to attempt to ascertain whether these conflict minerals originated in the Democratic Republic of the Congo or an adjoining country (collectively, “Covered Countries”) and financed or benefited armed groups (as defined in Section 1, Item 1.01(d)(2) of Form SD) in any of these countries.

Pursuant to SEC guidance issued April 29, 2014 and the SEC order issued May 2, 2014, Fortinet is not required to describe any of its products as “DRC conflict free” (as defined in Section 1, Item 1.01(d)(4) of Form SD), “DRC conflict undeterminable” (as defined in Section 1, Item 1.01(d)(5) of Form SD) or “having not been found to be ‘DRC conflict free,’” and therefore makes no conclusion in this regard in the report presented herein. Furthermore, given that Fortinet has not voluntarily elected to describe any of its products as “DRC conflict free,” an independent private sector audit of the report presented herein has not been conducted.

Fortinet is a global leader in cybersecurity solutions provided to a wide variety of organizations, such as enterprises, communication service providers, government organizations and small businesses. Fortinet’s cybersecurity solutions are designed to provide broad visibility and segmentation of the digital attack surface through our integrated Fortinet Security Fabric platform, which features automated protection, detection and response.

Fortinet’s next generation firewall products plus its Security Fabric product portfolio have been developed to provide broad, integrated and automated security and operations across the entire network, including network core, endpoints, applications, data centers, access and private and public cloud, and are designed to enable traditionally disparate security solutions to work together as an integrated and collaborative whole. Fortinet’s products deliver integrated scalability, access control, awareness, security, traffic segmentation, centralized management and orchestration. Fortinet’s Security Fabric portfolio supports a variety of consumption models from physical and virtual appliances, to software, to Security-as-a-Service. Our FortiGate appliances and FortiOS operating system are at the core of the products we offer. In addition to our FortiCare support services, a broad set of security services, including firewall, virtual private network, anti-malware, anti-spam, application control, and intrusion prevention services, are offered along with our products. Through these security services, our FortiGuard Labs team provides updates using threat research and data collection and intelligence resources to deliver subscription-based security services to FortiGate appliances and across Security Fabric solutions.

Fortinet outsources the manufacture of its security hardware appliance products to a variety of contract manufacturers and original design manufacturers. Fortinet submits purchase orders to its contract manufacturers that describe the type and quantities of products to be manufactured, the delivery date and other delivery terms. Fortinet’s proprietary FortiASICs, which are incorporated in certain of Fortinet’s hardware appliance products, are fabricated by contract manufacturers. The components included in Fortinet’s products are sourced from various suppliers by Fortinet or more frequently by Fortinet’s contract manufacturers. Some of the components important to Fortinet’s business, including specific types of central processing units, network chips, and solid-state drives (silicon-based storage device), are available from a limited or sole source of supply. For purposes of this CMR, references to our “products” refer to our hardware appliance products, and references to our “suppliers” refer to our product suppliers.

Based upon a review of our products and our reasonable country of origin inquiry (“RCOI”), we have concluded that:

Fortinet designed its due diligence with respect to the source and chain of custody of the conflict minerals contained in its products based on the five-step framework set forth in the Third Edition of the Organisation for Economic Co-operation and Development’s Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas and the supplements thereto (the “OECD Guidance”).

Fortinet performed the following due diligence measures in accordance with the OECD Guidance and the Final Rules:

OECD Guidance Step #1: Establish Strong Company Management Systems

OECD Guidance Step #2: Identify and Assess Risk in the Supply Chain

OECD Guidance Step #3: Design and Implement a Strategy to Respond to Identified Risks

OECD Guidance Step #4: Carry Out Independent Third-Party Audit of Supply Chain Due Diligence at Identified Points in the Supply Chain

Given that we do not have a direct relationship with the smelters and refiners that process the conflict minerals that are present in our products, we rely on the RMI to conduct third-party audits of smelters and refiners.

OECD Guidance Step #5: Report on Supply Chain Due Diligence

As required by the Final Rules, we have filed a Form SD and this Conflict Minerals Report as an exhibit thereto for the 2019 reporting year. The Form SD and Conflict Minerals Report are also available on our website at https://investor.fortinet.com/sec-filings.

As a result of Fortinet’s reasonable country of origin inquiry, 32 suppliers, representing approximately 67% of our suppliers, provided completed CMRTs to Fortinet. Fortinet’s suppliers identified approximately 299 smelters and refiners from which they source conflict minerals that appear on the RMI’s Standard Smelter List, and of those smelters and refiners, 235 smelters and refiners, or approximately 79%, have successfully completed an assessment against the applicable RMI Responsible Minerals Assurance Process (“RMAP”) standard or an equivalent cross-recognized assessment. The remainder of the reported smelters and refiners have not, at this time, successfully completed an assessment against the applicable RMAP standard or an equivalent cross-recognized assessment (the “Non-Conformant Smelters and Refiners”). With respect to these smelters and refiners, although we were not able to determine the mines of origin of the conflict minerals sourced from such smelters and refiners, we were able to determine their country locations. Attached as Addendum A to this CMR is a list of such country locations, grouped according to the specific conflict mineral processed by such smelters and refiners.

The information contained in the preceding paragraph and in Addendum A is based on supplier responses received through May 15, 2020.

Fortinet intends to take the following steps to mitigate the risk that conflict minerals benefit armed groups:

FORWARD-LOOKING STATEMENTS

Statements relating to due diligence improvements and other statements herein are forward-looking in nature and are based on Fortinet’s management’s current expectations or beliefs. These forward-looking statements are not a guarantee of performance and are subject to a number of uncertainties and other factors that may be outside of Fortinet’s control and that could cause actual events to differ materially from those expressed or implied by the statements made herein, and Fortinet reserves the right to change its processes and policies related to conflict minerals.

DOCUMENTS INCORPORATED BY REFERENCE

Unless otherwise expressly stated herein, any documents, third-party materials or references to websites (including Fortinet’s) are not incorporated by reference in, or considered to be a part of this CMR, unless expressly incorporated by reference herein.

Addendum A

Non-Conformant Smelter and Refiner Country Locations by Conflict Mineral