Fortinet Certifications: FCA, FCP and FCSS Security Paths

Most people searching for Fortinet certifications still look for FCA, FCP and FCSS, but on 15 July 2026 Fortinet moved its programme back to eight numbered NSE levels, and the old names now live on only as legacy credentials. This guide explains how the current Network Security Expert (NSE) programme is structured, how the legacy FCF, FCA, FCP, FCSS and FCX certifications were mapped across, what each level requires, what the exams cost and how renewal now works. It is written for firewall administrators, network and SOC engineers, and anyone planning a path through FortiGate, SASE, cloud or security operations credentials. All facts were checked on Fortinet's training pages and its Training Institute helpdesk on 8 November 2026. Fortinet updates exams, prices and track contents often, so confirm the detail on the linked pages before you book.

This is an independent guide from NHI Mgmt Group, based on Fortinet's public certification documentation as of November 2026. It is not sponsored or reviewed by Fortinet. Programme details change, so confirm requirements against Fortinet's current documentation.

Key takeaways

• The names changed on 15 July 2026. Fortinet replaced its five-level FCF to FCX structure with eight NSE levels and four tracks: Secure Networking, SASE, Cloud Security and Security Operations.
• Legacy credentials carried across automatically. Active FCA became NSE 3, FCP became NSE 4 (plus NSE 5 or 6 where historical exams map), FCSS became NSE 6 or 7, and FCX became NSE 8, keeping the original issue and expiry dates.
• NSE 4 FortiOS is the gateway. Every level from NSE 5 upwards, and both industry certifications, require NSE 4 FortiOS, earned with the FortiOS Administrator exam.
• Fees rose for advanced exams on 2 November 2026. Fortinet's helpdesk lists NSE 4 to 6 exams at US$200 and NSE 7 and industry exams at US$400, before tax.
• Everything lasts two years. NSE 4 to 7 renew by a recertification assessment or the proctored exam; NSE 8 renews with 200 activity points, and all prerequisites must stay active.

Who the certification is for

Fortinet certifications are product credentials. They prove that you can configure and operate Fortinet platforms, most often FortiGate firewalls running FortiOS, and they assume you already understand networking and security concepts. They fit best where your employer, customers or managed service clients run the Fortinet Security Fabric.

• Firewall and network security administrators: NSE 4 FortiOS covers the day-to-day work of configuring, operating and administering FortiGate devices. Pair it with the FortiGate Hardening Guide for the security settings that matter most in production.
• Network security engineers: the Secure Networking track (FortiSwitch, wireless LAN, SD-WAN, then the NSE 7 Secure Networking Architect exam) matches the role described in the Network Security Engineer Career Guide.
• SOC analysts and detection engineers: the Security Operations track includes analyst exams such as FortiSIEM, FortiSOAR, FortiNDR Cloud and FortiRecon.
• Cloud and SASE engineers: dedicated Cloud Security and SASE tracks cover Fortinet's cloud and secure access services. See the SASE and SSE Guide for the vendor-neutral architecture.
• Partner and MSSP staff: the MSSP Security and OT Security industry certifications sit outside the eight levels for people who design and run services on Fortinet platforms.
• Newcomers: NSE 1 to 3 are free online courses and tests that introduce cyber security concepts and Fortinet products before any proctored exam.

Exam format and domains

The eight levels as published

Source: Fortinet's certification page and its helpdesk article on the 15 July 2026 mapping. Fortinet notes that FCP and FCSS holders could receive more than one NSE level, depending on which historical exams they had passed, and that the legacy certificates remain in your history.

What the exams look like

• Delivery: NSE 4 to 7 exams are proctored at Pearson VUE test centres or online through OnVUE. NSE 8 elective practicals are on site or proctored online by ProctorU; the NSE 8 Core practical is on site only, at selected Fortinet offices and events.
• Question types: multiple choice and drag and drop. Fortinet's track pages state that answers must be fully correct to earn credit, with no partial credit.
• Timing rules: within a track, you pass the higher exam within two years of your most recent prerequisite exam. For NSE 8 the Core and elective practicals must both be passed within one year.
• Duration and question count: the NSE 4 page does not state them, so check the exam description in the Training Institute when you book.

Example exam options by track

The programme update page lists further exams being added, moved or retired around and after 15 July 2026, with some items scheduled for the third quarter of 2026. Check the track page for the exam you plan to sit, because a course you started before July may now map to a different level.

Prerequisites and experience

• NSE 1 to 3: no prerequisites. These are self-paced and free.
• NSE 4: no formal prerequisite certification. In practice you need working knowledge of routing, NAT, VPNs and firewall policy before attempting it.
• NSE 5 and 6: an active NSE 4 FortiOS certification.
• NSE 7: NSE 4 FortiOS and NSE 5 or NSE 6 in the same track.
• NSE 8: NSE 4, NSE 5 or 6 in any track, and NSE 7 in the same track as that NSE 5 or 6. Fortinet recommends industry experience and experience with a variety of complex networks.
• Industry certifications: MSSP Security and OT Security both require NSE 4, NSE 5 or 6 and NSE 7 in the same track before the proctored exam.

Our recommendation at NHI Mgmt Group: do not sit NSE 4 until you have administered a FortiGate, physical or virtual, for at least a few weeks. The exam rewards knowing where a setting lives and how features interact, which is hard to learn from slides alone.

Preparation plan

Fortinet's self-paced courses are free in the Fortinet Training Institute, and on-demand labs can be purchased. A practical plan for NSE 4, the level most candidates target first:

1. Confirm the current exam version. Open the NSE 4 page and the exam description, note the FortiOS version the exam is based on, and download the matching course.
2. Build a lab. Use a FortiGate VM or a spare appliance on the same FortiOS major version. Configure interfaces, zones, static and dynamic routing, firewall policies, NAT, SSL inspection, IPsec and SSL VPN, security profiles and logging.
3. Work through the course in order. Complete each module's lab before moving on, and keep notes on default behaviour you had to change.
4. Practise troubleshooting. Use the debug flow, packet sniffer and session table tools until you can explain why a packet was allowed or dropped. Questions often test this reasoning.
5. Harden as you go. Apply administrative access restrictions, trusted hosts, multi-factor authentication for admins and logging to an external collector. The FortiGate Hardening Guide lists the settings.
6. Book when lab tasks are routine. Choose a Pearson VUE centre or OnVUE, and check the identity and room rules for online proctoring in advance.
7. Plan the next level straight away. The two-year window between prerequisite and higher exams starts from your most recent exam.

For NSE 5 to 7, repeat the same pattern with the product in the track. For the Security Operations track, build log sources into a lab collector and practise investigations end to end. For NSE 8, Fortinet's own advice is production experience across complex networks: treat the practical exams as tests of design and fault finding under time pressure.

Cost, renewal and continuing education

Exam and assessment fees

Source: Fortinet Training Institute helpdesk, exam prices and recertification assessments after 15 July 2026. Fortinet states that Pearson VUE exam vouchers and recertification assessment vouchers are not interchangeable. Confirm the current price in the Training Institute before you buy, since fees can differ by region and change over time.

Renewal rules

• Validity: all Fortinet certifications expire two years after they are earned. For multi-step levels, the two years count from the most recent requirement.
• NSE 4 to 7 and industry certifications: renew by completing the recertification assessment, available while your proctored exam is less than two years old, or by passing the proctored exam again. Fortinet describes the assessment as a later version of the proctored exam.
• NSE 8: renew by accumulating 200 activity points, from passing exams, completing training, beta testing and submitting content. Passing any NSE 8 practical exam also renews active NSE 1 to 7 certifications. Holders whose NSE 8 expires before 31 July 2027 may instead take the NSE 8 Recertification Exam, available until 31 January 2027.
• NSE 3: complete the course and pass the online exam again. NSE 1 and 2: complete the course.
• Active prerequisites: renewal requires all prerequisite certifications to be active, and only active certifications are renewed. Let NSE 4 lapse and the levels above it are at risk.

See the Certification Renewal and CPE Requirements Guide for how to track renewal dates across several certifying bodies.

Where it fits on the career path

A Fortinet certification tells an employer that you can run their platform from day one. It is most valuable alongside broader knowledge of network design, identity and detection. Firewall administration is also identity work: admin accounts, API tokens for automation and the service accounts used for LDAP, RADIUS or SAML integrations all need ownership and rotation. See the Firewall user authentication and captive portals guide, and the Cybersecurity Certifications Guide for the wider certification landscape.

If you hold a legacy certification

1. Sign in to the Training Institute and check which NSE levels were added to your record on 15 July 2026.
2. Note that each new NSE certification carries the issue and expiry dates of the FCA, FCP, FCSS or FCX it came from.
3. Update your CV and profiles to the NSE name, keeping the legacy name in brackets for recruiters who still search for it.
4. Plan renewal against the earliest expiry date in your prerequisite chain.

Practitioner checklist

• Use the current NSE level names in plans and job descriptions, and map legacy FCA, FCP and FCSS references to them.
• Start with NSE 4 FortiOS: it is the prerequisite for every level from NSE 5 upwards.
• Pick one track (Secure Networking, SASE, Cloud Security or Security Operations) that matches your role and stay in it through NSE 7.
• Build a FortiGate lab on the same FortiOS version as the exam before booking.
• Budget at the published fees: US$200 for NSE 4 to 6, US$400 for NSE 7 and industry exams, before tax.
• Record every expiry date and keep prerequisites active; renewal fails if one lapses.
• Use the recertification assessment while your proctored exam is under two years old.
• Check the track page for added, moved or retired exams before you start a course.
• Apply what you learn: harden admin access and audit service accounts on the firewalls you run.

Standards and references

• Fortinet: NSE Certification Program
• Fortinet: Training Program Update
• Fortinet Training Institute: What will happen to my existing certifications on July 15, 2026
• Fortinet Training Institute: Exam prices and recertification assessments after July 15, 2026
• Fortinet Training Institute: NSE 4 FortiOS
• Fortinet Training Institute: NSE 7 Secure Networking
• Fortinet Training Institute: NSE 6 Security Operations
• Fortinet Training Institute: NSE 8

Related NHI Mgmt Group resources: Network Security Engineer Career Guide · FortiGate Hardening Guide · Cybersecurity Certifications Guide · Certification Renewal and CPE Requirements Guide