Tekmirio: FortiGate Audit Evidence, by Ambio Edge Networks
Your FortiGate is in audit scope. Your auditor wants the change history, the approvals and a rule review, and your engineers shouldn’t lose a week rebuilding them from screenshots. Tekmirio turns the FortiGate configuration backups you already keep (from a backup tool such as Oxidized, or plain exported files) into an evidence pack: a signed bundle of files your auditor can check on their own laptop, with no account and no internet. It runs on your network. The collector, the small program that reads your firewall, only reads; it refuses a login that could change anything. In plain terms: when an auditor asks how your firewall changed, who approved each change and whether the rules were reviewed, the pack is the answer, and they can check nobody edited it.
FortiGate Audit Evidence Your Auditor Can Verify
Each pack is signed and carries an independent timestamp (RFC 3161, from a timestamp authority you choose), so a backdated pack fails the timestamp check. Your auditor checks it offline with the included verifier, no account needed, against a key fingerprint you send them directly.
Unexplained Changes, Flagged
A firewall change with no ticket or approval behind it is called out, not buried. Who made it comes from the firewall’s own log where that log still reaches; older or unlogged changes are flagged as unattributed, not guessed. Your auditor sees the gap and the reason for it.
One Evidence Set, Three Frameworks: PCI DSS, SOC 2, CMMC
Each check links to the PCI DSS v4.0.1 (card payments), NIST SP 800-171 Rev. 2 / CMMC Level 2 (defense contracts) and SOC 2 (customer trust reports) requirements it supports. You collect the evidence once; it is indexed for each of the three.
Each pack holds the firewall’s settings at the start of the period, every change since, a rule-review worksheet with sign-off, and an index that points each PCI DSS v4.0.1, SOC 2 and NIST SP 800-171 Rev. 2 / CMMC Level 2 requirement at the file that supports it. Tekmirio supplies the evidence. Your auditor decides whether it is enough. Want Jeff to run the audit prep instead? Network audit and documentation starts with network documentation at $1,250 per site, a Network Risk Assessment starts at $3,500 for a single small site, and HIPAA network engineering covers healthcare organizations. You keep the report either way. If you also want the firewall run day to day, Ambio is a Sacramento Fortinet MSP and serves Bay Area sites as a Fortinet MSP in San Francisco.
For your security review: how Tekmirio handles FortiGate configs
- Your data stays put
- Nothing sends your data to Ambio. Your full firewall configs and firewall logins stay on your network.
- Outbound, optional
- The only outbound requests are an RFC 3161 timestamp request (a hash only) to a timestamp authority you choose, and an update check. Updates are signed with a pinned release key and applied only when you approve them; until the update channel opens, you apply signed releases by hand. Both can be turned off for networks with no internet connection (airgapped); packs then carry no independent timestamp and you apply updates by hand.
- Read-only collector
- The collector only reads. If it is handed a firewall login that could also make changes, it refuses it. If someone forces that override, every pack it produces is stamped DEGRADED so your auditor can see the control was bypassed.
- What a pack carries
- Your firewall settings and the changes between versions, with passwords and keys blanked out. Known secret fields are removed by name, and every pack is scanned for anything that looks like a secret before it is signed; a pack that fails the scan is not signed. That is a strong filter, not a guarantee.
- If Ambio goes away
- Your packs keep verifying. Each one ships its public keys and the verifier, so nothing about checking it depends on us. That is the honest answer to the one-person-company question.
- Integrity
- Tekmirio keeps its own tamper-evident log (each entry is chained to the one before it, so a deleted or edited entry shows), and each customer’s data is encrypted with its own keys. Ambio does not have a SOC 2 report. That is why packs are built to verify without trusting us.
What a design partner gets
This is for you if a FortiGate sits inside a PCI DSS, SOC 2 or CMMC audit and you already keep configuration backups. As a design partner you run Tekmirio on your own network ahead of general release, Jeff sets it up with you and builds your first pack, and your auditor’s questions shape what gets built next. In return we ask for candid feedback on a short monthly call. Design partnership is paid; the price is agreed in writing before anything is installed.