Employee Handbook

Canada Supplement

Fortinet Confidential

TABLE OF CONTENTS

EMPLOYMENT PRACTICES

100 Non-Discrimination Policy

101 Employment Equity Program

102 Accessible Customer Service Policy

POLICIES & PRACTICES

200 Canada Immigration Policy

201 Training Policy

202 Overtime Policy

203 General Office Policy

QUALITY MANAGEMENT

300 Quality Management: ISO Processes

EMPLOYMENT STATUS & RECORDS

400 Resignations & Terminations

401 Privacy Policy

PAY & BENEFIT PRACTICES

500 Pay

501 Benefits

EMPLOYEE SAFETY & SECURITY

600 Workplace Violence, Bullying & Harassment Program

601 Health and Safety

TIME AWAY FROM WORK

700 Paid Time Off (PTO)

701 Attendance

702 Types of Leaves

Page 2

100 Non-Discrimination Policy

Fortinet supports a work environment that promotes equal opportunities for all employees to fullyutilize their skills in their employment without discrimination based on the protected grounds under:Alberta and Nova Scotia Human Rights Act; British Columbia, Manitoba, and Ontario’s HumanRights Code; and Quebec’s Charter of Human Rights and Freedoms, RSQ c C-12.

Our operations in each province will be governed by the legislation of the appropriate respective

provincial jurisdiction.

Purpose

The purpose of the Non-Discrimination policy is to establish Fortinet’s commitment to eliminate and/orreduce conflicts and barriers that inhibit employees’ full participation in employment, by providingreasonable accommodation without causing undue hardship.

Definitions

“Protected grounds” are characteristics enumerated in Section 7 of the Alberta Human Rights Act,Section 13 of the B.C. Human Rights Code, Part II, Section 14 of the Manitoba Human Rights Code,Part I Section 5 of the Nova Scotia Human Rights Act, Part I, Section 5 of the Ontario Human RightsCode, and Section 16 of Quebec’s Charter of Human Rights and Freedoms respectively.

Alberta Human Rights Act: Discrimination re employment practices

“7 (1) No employer shall

(a) Refuse to employ or refuse to continue to employ any person, or

(b) Discriminate against any person with regard to employment or any term or condition of

employment,

because of the race, religious beliefs, colour, gender, physical disability, mental disability, age, ancestry,place of origin, marital status, source of income, family status or sexual orientation of that person or of any

other person.”

B.C. Human Rights Code: Discrimination in employment

“13 (1) A person must not

(a) Refuse to employ or refuse to continue to employ a person, or

(b) Discriminate against a person regarding employment or any term or condition of employment

because of the race, colour, ancestry, place of origin, political belief, religion, marital status, family status,physical or mental disability, sex, sexual orientation or age of that person or because that person has beenconvicted of a criminal or summary conviction offence that is unrelated to the employment or to the intended

employment of that person.”

Page 3

Manitoba Human Rights Code: Discrimination in Employment

14(1) No person shall discriminate with respect to any aspect of an employment or occupation, unlessthe discrimination is based upon bona fide and reasonable requirements or qualifications for the

employment or occupation.

"Any aspect", etc. defined

14(2) In subsection (1), "any aspect of an employment or occupation" includes

(a) the opportunity to participate, or continue to participate, in the employment or occupation;

(b) the customs, practices and conditions of the employment or occupation;

(c) training, advancement or promotion;

(d) seniority;

(e) any form of remuneration or other compensation received directly or indirectly in respect of theemployment or occupation, including salary, commissions, vacation pay, termination wages, bonuses,reasonable value for board, rent, housing and lodging, payments in kind, and employer contributions topension funds or plans, long-term disability plans and health insurance plans; and

(f) any other benefit, term or condition of the employment or occupation.

Nova Scotia Human Rights Act: Prohibition of discrimination

“5 (1) (d) No person shall in respect of employment discriminate against an individual or class of individualson account of (h) age; (i) race; (j) colour; (k) religion; (l) creed; (m) sex; (n) sexual orientation; (na) genderidentity; (nb) gender expression; (o) physical disability or mental disability; (p) an irrational fear ofcontracting an illness or disease; (q) ethnic, national or aboriginal origin; (r) family status; (s) marital status;(t) source of income; (u) political belief, affiliation or activity; (v) that individual’s association with anotherindividual or class of individuals having characteristics referred to in clauses (h) to (u)

Ontario Human Rights Code: Employment

“5 (1) Every person has a right to equal treatment with respect to employment without discriminationbecause of race, ancestry, place of origin, colour, ethnic origin, citizenship, creed, sex, sexual orientation,age, record of offences, marital status, family status or disability.”

Quebec’s Charter of Human Rights and Freedoms: Right to Equal Recognition and Exercise of Rights

and Freedoms

“16 No one may practise discrimination in respect of the hiring, apprenticeship, duration of the probationperiod, vocational training, promotion, transfer, displacement, laying-off, suspension, dismissal orconditions of employment of a person or in the establishment of categories or classes of employment.”

Reasonable accommodation refers to measures taken by Fortinet to eliminate or reduce barriers toemployment due to a conflict with an employee’s work requirement(s) and protected ground(s). If anemployee establishes the existence of such conflict, Fortinet will collaborate with the employee and thirdparties (if applicable) to provide reasonable accommodation where possible without causing undue

hardship.

Page 4

Roles and Responsibilities

Accommodation is a collaborative process between the employer, employee seeking accommodation,and any third parties if applicable. Each party plays an important role in this process:

 If accommodation is needed, it is the responsibility of the employee to inform Fortinet of suchconflict with the employee’s work and protected ground(s). Fortinet may request for medicaland other expert information that is relevant and necessary to identify the employee’s work-related capabilities, restrictions, and limitations.

 Upon an employee establishing the need for accommodation, Fortinet will review jobrequirements and examine accommodation options. Fortinet will consult with the affectedemployee and any applicable third parties who may provide relevant and necessaryinformation or advice to determine an appropriate accommodation strategy.

 Fortinet will then provide reasonable accommodation where possible, without causing undue

hardship.

The employee is responsible for the costs of providing additional documentation if more information isrequired to determine appropriate accommodation options.

It is expected that the employee seeking accommodation will cooperate with Fortinet in identifyingreasonable accommodation. The employee shall recognize that a perfect solution may not beachieved, and shall not turn down proposed accommodation made in good faith that is reasonable in

all circumstances.

Accommodation Process

 The employee will provide Fortinet with a written request for accommodation, identifying theconflict between the job requirement(s) and the protected ground(s). The employee willprovide information outlining the employee’s work-related capabilities, restrictions, andlimitations, incurring any costs involved. If requested, employee will provide Fortinet withexpert information from medical and/or non-medical professionals where relevant andnecessary, to identify reasonable accommodation options.

 Fortinet, the employee and third parties, if applicable, will work together to identify reasonable

accommodation options.

 Fortinet will, where possible, provide reasonable accommodation based on the informationprovided and where applicable, prepare and implement a return-to-work plan.

 As assessment will be made to determine the efficacy and reasonableness of accommodation,and a decision will be made to determine if it is necessary on an ongoing basis from theperspective of both the employee and Fortinet.

Page 5

Limitations

Fortinet is not required to provide accommodation that would cause undue hardship. Undue hardshipmay include, but not limited to circumstances:

 Where the accommodation would cause a significant safety hazard;

 Where the accommodation would interfere unreasonably with the rights of other employees;

 Where the individual seeking accommodation is unable to perform work that is of value to

Fortinet;

 Where the accommodation would unreasonably disrupt any part of the operations of Fortinet;or

 Where the accommodation would pose undue financial hardship on Fortinet.

The accommodation process does not require Fortinet to create a new position to existing staffing

levels.

Where an employee seeking accommodation fails or refuses to cooperate and facilitate theaccommodation process, or makes unreasonable requests, Fortinet’s responsibility to providereasonable accommodation shall come to an end.

Protection from Discrimination

An employee shall not be discriminated against for disclosing that he/she requires or is seeking

reasonable accommodation.

Documentation Control and Retention

Any employee information related to reasonable accommodation will be kept in confidence. Onlyauthorized personnel shall be granted access to such files.

101 Employment Equity Program

What is Employment Equity?

Employment equity is essentially fairness in employment. The purpose of this program is to eliminatebarriers to employment and accommodate those individuals protected under the human rightslegislation. This program ensures that all individuals have access to job opportunities at Fortinet, andthat their qualifications are assessed based on the position’s requirements.

Page 6

Who are the Designated Groups Protected Under Human Rights?

Under the employment equity legislation, the four designated protected groups are:

 Aboriginal Peoples

 Persons with Disabilities

 Members of Visible Minorities

 Women

Who is Responsible for the Implementation of this Program?

Senior Official: John Whittle, VP Legal and Corporate DevelopmentAdvisor: Joyce Chow, Senior Director, Human Resources

Implementation: Joyce Chow, Senior Director, Human Resources

François Guay, Director, Human Resources

For more information, please visit:

http://wiki.fortinet.com/twiki/bin/view/HumanResources/CanadaHR-EmploymentEquity

Page 7

102 Accessible Customer Service Policy

Intent

This policy is intended to meet the requirements of the Accessibility Standards for Customer Service,Ontario Regulation 429/07 under the Accessibility for Ontarians with Disabilities Act, 2005, and appliesto the provision of goods and services to the public or other third parties, not to the goods themselves.

All goods and services provided by Fortinet Technologies (Canada) ULC shall follow the principles ofdignity, independence, integration and equal opportunity.

Scope

a) This policy applies to employees, volunteers, agents and/or contractors working in Ontario.

b) This policy applies to the provision of goods and services at premises owned and operated by

Fortinet Technologies (Canada) ULC.

c) This policy applies to employees, volunteers, agents and/or contractors who deal with thepublic or other third parties that act on behalf of Fortinet Technologies (Canada) ULC, includingwhen the provision of goods and services occurs off the premises of Fortinet Technologies(Canada) ULC such as: delivery services, call centers, vendors, drivers, catering and third

party marketing agencies.

d) The section of this policy that addresses the use of guide dogs, service animals and servicedogs only applies to the provision of goods and services that take place at premises ownedand operated by Fortinet Technologies (Canada) ULC.

e) This policy shall also apply to all persons who participate in the development of FortinetTechnologies (Canada) ULC’s policies, practices and procedures governing the provision ofgoods and services to members of the public or third parties.

Definitions

Assistive Device – is a technical aid, communication device or other instrument that is used to maintainor improve the functional abilities of people with disabilities. Personal assistive devices are typicallydevices that customers bring with them such as a wheelchair, walker or a personal oxygen tank thatmight assist in hearing, seeing, communicating, moving, breathing, remembering and/or reading.

Disability – the term disability as defined by the Accessibility for Ontarians with Disabilities Act, 2005,and the Ontario Human Rights Code, refers to:

 any degree of physical disability, infirmity, malformation or disfigurement that is caused bybodily injury, birth defect or illness and, without limiting the generality of the foregoing, includesdiabetes mellitus, epilepsy, a brain injury, any degree of paralysis, amputation, lack of physicalco-ordination, blindness or visual impediment, deafness or hearing impediment, muteness orspeech impediment, or physical reliance on a guide dog or other animal or on a wheelchair or

other remedial appliance or device;

 a condition of mental impairment or a developmental disability;

Page 8

 a learning disability, or dysfunction in one or more of the processes involved in understanding

or using symbols or spoken language;

 a mental disorder; or

 an injury or disability for which benefits were claimed or received under the insurance planestablished under the Workplace Safety and Insurance Act, 1997.

Guide Dog – is a highly-trained working dog that has been trained at one of the facilities listed inOntario Regulation 58 under the Blind Persons’ Rights Act, to provide mobility, safety and increased

independence for people who are blind.

Service Animal – as reflected in Ontario Regulation 429/07, an animal is a service animal for a person

with a disability if:

 it is readily apparent that the animal is used by the person for reasons relating to his or her

disability; or

 if the person provides a letter from a physician or nurse confirming that the person requiresthe animal for reasons relating to the disability.

Service Dog – as reflected in Health Protection and Promotion Act, Ontario Regulation 562 a dog otherthan a guide dog for the blind is a service dog if:

 it is readily apparent to an average person that the dog functions as a service dog for a person

with a medical disability;

 or the person who requires the dog can provide on request a letter from a physician or nurseconfirming that the person requires a service dog.

Support Person – as reflected in Ontario Regulation 429/07, a support person means, in relation to aperson with a disability, another person who accompanies him or her in order to help withcommunication, mobility, personal care, medical needs or access to goods and services.

General Principles

In accordance with the Accessibility Standards for Customer Service, Ontario Regulation 429/07, this

policy addresses the following:

A. The Provision of Goods and Services to Persons with Disabilities;

B. The Use of Assistive Devices

C. The Use of Guide Dogs, Service Animals and Service Dogs

D. The Use of Support Persons

E. Notice of Service Disruptions

F. Customer Feedback

G. Training

H. Notice of Availability and Format of Required Documents

I. Recruitment

J. Processes to Accommodate Employees

Page 9

A. The Provision of Goods and Services to Persons with Disabilities

Fortinet Technologies (Canada) ULC will make every reasonable effort to ensure that its policies,practices and procedures are consistent with the principles of dignity, independence, integration

and equal opportunity by:

 ensuring that all customers receive the same value and quality; allowing customers with disabilities to do things in their own ways, at their own pace whenaccessing goods and services as long as this does not present a safety risk; using alternative methods when possible to ensure that customers with disabilities haveaccess to the same services, in the same place and in a similar manner; taking into account individual needs when providing goods and services; and communicating in a manner that takes into account the customer's disability.

B. Assistive Devices

Customer’s own assistive device(s):

Persons with disabilities may use their own assistive devices as required when accessing goodsor services provided by Fortinet Technologies (Canada) ULC.

In cases where the assistive device presents a safety concern or where accessibility might be anissue, other reasonable measures will be used to ensure the access of goods and services. Forexample, open flames and oxygen tanks cannot be near one another. Therefore, theaccommodation of a customer with an oxygen tank may involve ensuring the customer is in alocation that would be considered safe for both the customer and business. Or, where elevatorsare not present and where an individual requires assistive devices for the purposes of mobility,service will be provided in a location that meets the needs of the customer.

C. Guide Dogs, Service Animals and Service Dogs

A customer with a disability that is accompanied by a guide dog, service animal or service dog willbe allowed access to premises that are open to the public unless otherwise excluded by law. “Nopet” policies do not apply to guide dogs, service animals and/or service dogs.

Exclusion Guidelines:

If a guide dog, service animal or service dog is excluded by law (see applicable laws below)Fortinet Technologies will offer alternative methods to enable the person with a disability to accessgoods and services, when possible (for example, securing the animal in a safe location and

offering the guidance of an employee).

Dog Owners' Liability Act, Ontario: If there is a conflict between a provision of this Act or of aregulation under this or any other Act relating to banned breeds (such as pitbulls) and a provisionof a by-law passed by a municipality relating to these breeds, the provision that is more restrictivein relation to controls or bans on these breeds prevails.

Recognizing a Guide Dog, Service Dog and/or Service Animal:

If it is not readily apparent that the animal is being used by the customer for reasons relating to hisor her disability, Fortinet Technologies may request verification from the customer.

Page 10

Verification may include:

 a letter from a physician or nurse confirming that the person requires the animal for

reasons related to the disability;

 a valid identification card signed by the Attorney General of Canada; or, a certificate of training from a recognized guide dog or service animal training school.

Care and Control of the Animal:

The customer that is accompanied by a guide dog, service dog and/or service animal isresponsible for maintaining care and control of the animal at all time.

Allergies:

If a health and safety concern presents itself, for example in the form of a severe allergy to theanimal, Fortinet Technologies (Canada) ULC will make all reasonable efforts to meet the needs of

all individuals.

D. Support Persons

If a customer with a disability is accompanied by a support person, Fortinet Technologies (Canada)ULC will ensure that both persons are allowed to enter the premises together and that thecustomer is not prevented from having access to the support person.

There may be times where seating and availability prevent the customer and support person fromsitting beside each other. In these situations Fortinet Technologies (Canada) ULC will make every

reasonable attempt to resolve the issue.

In situations where confidential information might be discussed, consent will be obtained from thecustomer, prior to any conversation where confidential information might be discussed.

E. Notice of Disruptions in Service

Service disruptions may occur due to reasons that may or may not be within the control orknowledge of Fortinet Technologies. In the event of any temporary disruptions to facilities orservices that customer's with disabilities rely on to access or use Fortinet Technologies (Canada)ULC goods or services, reasonable efforts will be made to provide advance notice. In somecircumstances such as in the situation of unplanned temporary disruptions, advance notice may

not be possible.

Notifications will Include:

In the event that a notification needs to be posted the following information will be included unless

it is not readily available or known:

 goods or services that are disrupted or unavailable

 reason for the disruption

 anticipated duration

 a description of alternative services or options

Page 11

Notifications Options:

When disruptions occur, Fortinet Technologies (Canada) ULC will provide notice by:

 posting notices in conspicuous places including at the point of disruption, at the mainentrance and the nearest accessible entrance to the service disruption; contacting customers with appointments; verbally notifying customers when they are making a reservation or appointment; or by any other method that may be reasonable under the circumstances.

F. Feedback Process

Fortinet Technologies (Canada) ULC shall provide customers with the opportunity to providefeedback on the service provided to customers with disabilities. Information about the feedbackprocess will be readily available to all customers and notice of the process will be made availableduring training sessions and through the Human Resources Department. Feedback forms alongwith alternate methods of providing feedback such as verbally (in person or by telephone) orwritten (hand written, delivered, website or email), will be available upon request to

accessibility@fortinet.com).

Submitting Feedback:

Customers can submit feedback to:

Human Resources

1826 Robertson Road

Ottawa, ON K2H 5Z6

(613) 225-9381

Customers who wish to provide feedback by completing an onsite customer feedback form orverbally can do so to the Human Resources Department.

Customers that provide formal feedback will receive acknowledgement of their feedback, alongwith any resulting actions based on concerns or complaints that were submitted.

G. Training

Training will be provided to:

a) all employees, volunteers, agents and/or contractors who deal with the public or other thirdparties that act on behalf of Fortinet Technologies; for example: salespersons, drivers, vendors,event operators, call centers and third party marketing agents; and,

b) those who are involved in the development and approval of customer service policies,

practices and procedures.

Page 12

Training Provisions:

As reflected in Ontario Regulation 429/07, regardless of the format, training will cover the following:

 A review of the purpose of the Accessibility for Ontarians with Disabilities Act, 2005. A review of the requirements of the Accessibility Standards for Customer Service, Ontario

Regulation 429/07.

 Instructions on how to interact and communicate with people with various types of disabilities. Instructions on how to interact with people with disabilities who:

o use assistive devices;

o require the assistance of a guide dog, service dog or other service animal; oro require the use of a support person (including the handling of admission fees). Instructions on how to use equipment or devices that are available at our premises or that weprovide that may help people with disabilities. Instructions on what to do if a person with a disability is having difficulty accessing your

services.

 Fortinet Technologies (Canada) ULC’s policies, procedures and practices pertaining toproviding accessible customer service to customers with disabilities.

Training Schedule:

Fortinet Technologies (Canada) ULC will provide on-line training as soon as practicable. Trainingwill be provided to new employees, volunteers, agents and/or contractor who deal with the publicor act on our behalf during orientation and throughout the employment lifecycle here at Fortinet.Revised training will be provided in the event of changes to legislation, procedures and/or practices.

Record of Training:

Fortinet Technologies (Canada) ULC will keep a record of training that includes the dates trainingwas provided and which employee attended the on-line training session.

H. Notice of Availability and Format of Documents

Fortinet Technologies (Canada) ULC shall notify customers that the documents related to theAccessibility Standard for Customer Service are available upon request and in a format that takesinto account the customer's disability. Notification will be given by posting the information in aconspicuous place owned and operated by Fortinet Technologies (Canada) ULC, the website

and/or any other reasonable method.

Administration

If you have any questions or concerns about this policy or its related procedures please contact:

Human Resources

1826 Robertson Road, Ottawa, ON

(613) 225-9381

This policy and its related procedures will be reviewed as required in the event of legislative

changes.

Page 13

I. Recruitment

Fortinet is committed to fair and accessible employment practices. We notify the public and staffthat, when requested, Fortinet will accommodate people with disabilities during the recruitmentand assessment processes and when people are hired.

 Let job applicants know that we will accommodate disabilities during the selection process. If a job applicant requests accommodation, consult with them and make adjustments that best

suit their needs.

 Notify successful applicants of our policies for accommodating employees with disabilities.

J. Processes to Accommodate Employees

Fortinet has developed and put in place a process for developing individual accommodation plansand return-to-work policies for employees that have been absent due to a disability:

 Outline the steps we will take to help our employees return to work when they:o Have been absent because of a disability, ando Need some form of disability-related accommodation to return to work.

Fortinet will ensure the accessibility needs of employees with disabilities are taken into account ifFortinet is using performance management, career development and redeployment processes:

 Make performance management accessible by:o Reviewing our employees’ accommodation plans to understand their needs and seewhether we need to make adjustments to help them succeedo Making performance management documents, such as performance plans, availablein accessible formats, such as large print, when asked, ando Providing feedback and coach our employees in a way that is accessible to them, suchas using plain language for an employee who has a learning disability.

 When we provide career development opportunities, consider what accommodations your

employees with disabilities may need to:

o Learn new skills, or;

o Take on more responsibilities in their current position;o Consider what we could do to help our employees with disabilities succeed in otherpositions in our organization when they change jobs.

Referenced Documents:

 Accessibility for Ontarians with Disabilities Act, 2005 Accessibility Standards for Customer Service, Ontario Regulation 429/07

 Blind Person’s Rights Act, 1990

 Dog Owners' Liability Act, Ontario

 Food Safety and Quality Act 2001, Ontario Regulation 31/05 Health Protection and Promotion Act, Ontario Regulation 562

 Ontario Human Rights Code, 1990

Page 14

200 Canada Immigration Policy

As a condition of employment, all employees are required to present proof of identity and eligibility tolegally work in Canada. Legal working status in Canada includes Canadian Citizenship, Permanent

Residency, or a valid work permit.

Maintaining Legal Working Status in Canada

It is the employee’s responsibility to ensure that their work permit is valid and not expired to maintain

legal working status in Canada.

While Human Resources will monitor the expiration of work permits, it is the employee’sresponsibility to obtain and maintain legal working status in Canada and update Human Resourceswith any changes in legal working status. Depending on the complexity of work permit applications,Fortinet may work with an immigration consulting firm to prepare your application and will cover theconsulting fee. However you will have to submit the application to Citizenship and ImmigrationCanada (CIC). Employees are eligible to receive reimbursement from Fortinet for work permitrenewal applications and may submit the expense though the expense system with proof of paymentand the Immigration Costs Reimbursement Form with HR signature. While your spouse andchildren can be included in the application, Fortinet will only cover the cost of the employee.

Once a work permit renewal application has been submitted to CIC, you are on implied status aslong as the application is submitted prior to your work permit expiry date. While on implied status,you will still be able to legally work in Canada even though your work permit may have expired.

Intra-company Transferees

As a global company, Fortinet is able to transfer employees in various capacities – executives,senior managers, and specialized knowledge workers – to the Canadian subsidiary without theinvolvement of Human Resources and Skills Development Canada (HRSDC).

To qualify for an intra-company transfer, the employee must be employed by Fortinet for a minimumof (1) one year. Upon approval of the intra-company transfer, the transferee will work with HumanResources and the Immigration Consulting firm to prepare the application. Processing times mayvary depending on the country. Intra-company transfers are determined on a case-by-case basisand the decision remains the sole discretion of Fortinet.

Once CIC has approved the intra-company transfer and a work permit has been issued, thetransferee will receive reimbursement for a one-way plane ticket to either the Burnaby, BC orOttawa, ON Fortinet office. Please note airfare costs for your spouse and children are not coveredby Fortinet. Upon arrival to Canada, temporary accommodation may be arranged upon request andFortinet will cover the cost for a maximum of (2) two weeks.

To ensure you receive reimbursements for the intra-company transfer process which includes thework permit and airfare for yourself, all original receipts must be submitted to the expense systemwithin (2) two months of you starting work in Canada.

Please refer to the Global Relocation Policy on FUSE for more information

Page 15

Permanent Residency Applications

Employees on a work permit may decide to apply for permanent residency (PR) in Canada. While itis the employee’s responsibility to prepare and submit the PR application to CIC, Fortinet will provideconsultation and supporting documentation as the employer, as requested by CIC.

Employees interested in applying for PR should consider Express Entry through the CanadianExperience Class or Federal Skilled Worker Program. As each program has specific criteria, pleasevisit the Government of Canada website for more information.

Reimbursement

Employees are eligible to receive reimbursement for their work permit and/or permanent residencyapplication. Employees who are undergoing employer-sponsored applications will receivereimbursement of up to a maximum of $1,500.00 CAD, and employees who are undergoing non-employer-sponsored applications will receive reimbursement of up to a maximum of $2,000.00 CADto cover the fees incurred from submitting work permit and/or permanent residence applicationsdirectly. This amount covers work permit and PR-related costs and will only be reimbursed upon thesubmission of original receipts and the Immigration Costs Reimbursement Form with HR signaturethrough the expense system. You can find the Immigration Costs Reimbursement Form on FUSE.Fortinet acknowledges that work permit and PR fees may be incurred at different times, dependingon the stage of the application. Please ensure you submit each expense within (2) two months ofthe date it was incurred, or you risk having the reimbursement request denied.

Fortinet will only reimburse the work permit and PR costs for the employee. Any costs pertaining toyour spouse and/or child(ren) are your responsibility.

Employees who submit work permit and/ or PR applications during their probation period will receivereimbursement after they have passed probation. Fortinet will only reimburse applicants who appliedfor work permit renewal and/ or PR while being employed by Fortinet. For example, if you startedyour PR application prior to joining Fortinet, you would not be eligible to get reimbursed for costsincurred before joining Fortinet. However, any costs incurred after you join Fortinet is eligible for

reimbursement.

There is a claw back that applies to the Immigration Policy. The full amount that has been submittedfor reimbursement will be clawed back if:

 The employee voluntarily leaves Fortinet but has not received his or her PR status. Or,

 The employee voluntarily leaves Fortinet within one year of informing HR he or she hasreceived a new work permit and/ or PR status.

The claw back amount is not pro-rated. Fortinet will recover the full amount from the employee’sfinal paycheck or request for a reimbursement of said amount.

Below is a list of costs that could be associated with a PR application:

 PR Application Processing Fee

 Right of PR Fee

 PR Card Fee

 Language Test Exam

 Medical Exam

 Police Clearance

Page 16

 Translations of required documents if not in French or English

 Photos

 Work Permit Application Fees

Note that this is not a complete list of all eligible reimbursable costs. If you are unsure about whethersomething can be reimbursed as an immigration expense, please check with HR.

For more information regarding potential costs associated with a PR application, please visit the

Government of Canada website.

Employer-sponsored Applications

Provincial Nominee Program (BC Provincial Nominee Program (PNP) and Ontario Immigrant

Nominee Program (OINP))

Both BC PNP and OINP are employer-sponsored permanent residency programs. To be eligible forconsideration, employees need to have worked at Fortinet in Canada for a minimum of one (1) yearor at Fortinet’s sole discretion. Having met this minimum requirement does not guarantee thatFortinet will sponsor you as a provincial nominee. As this is an employer-sponsored program, thedecision to sponsor an employee as a provincial nominee remains the sole discretion of Fortinet.

If Fortinet decides to sponsor an employee, Fortinet would cover the cost of any fees associated withthe application. The immigration consultant fees will be covered by Fortinet.

Please visit the BC PNP and OINP websites, or speak to your local HR Representative, for more

information about these programs.

Page 17

201 Training Policy

What is the Employee Development Fund (“The fund”)?

The fund is provided to senior management to use towards employee work-related training and teambuilding purposes. The fund is available to all employees of Fortinet, including managers and team

members.

Why is Employee Development Important?

Training provides the tools and skill sets that help employees be successful on the job; it also helpsimprove the satisfaction and engagement level of employees in the organization. Trained andenergized employees also help problem solve and stimulate growth. Through professionaldevelopment and training, employees improve existing skills and develop new skills. Throughtechnical seminars, employees gain a fresh look on new technologies which they can bring back as

innovations in the workplace.

What can the Fund be Used For?

Below is a list of allowable use of the fund:

- Work-related conferences/seminars

- External instructor-led, work-related courses- Soft skills and language skills training (e.g. E.S.L.)- Purchase of online training materials or technical books

- Profession-related association fee

- Employee club subsidies (e.g. FortiMasters)- Team building event (i.e. team social activities, project completion celebration, etc.)

How to Apply the Fund?

Based on the budget constraints, it may not be feasible to cover training for all employees and analternate creative approach may be required. For example, managers can consider a “knowledgesharing” approach where trained team members will present training materials to the rest of the team.This will foster team communication, team building and individual presentation skills. Managers mayalso want to check with other department managers on each other’s training needs; if there is enoughinterest in a particular topic, it may be possible to bring the training in-house. This may turn out to bea training which is more catered to your needs and more cost effective.

How to Evaluate Training ROI?

When planning for training, managers are responsible for assessing employees’ training needs as wellas the team’s business needs. Managers should foster a culture of learning by supporting professionaldevelopment opportunities with a high ROI (return on investment). Specifically, here are the criterialeaders should consider when evaluating the ROI of training opportunities:

Page 18

 Does the training match their work responsibilities? Does the training match their career path? Can the employee apply the knowledge back to the workplace? Are there opportunities for them to apply and practice what they’ve learned? Can the extended team benefit and learn the knowledge through internal knowledge transfer? Consider the focus of the training: is it focused on the employee’s strengths or weaknesses?o It is good to provide training on areas where employees have a knowledge gap thatneeds to be addressed to carry out their responsibilities; these training provide themwith the tools and skills to be successful in their jobso It is better to provide training on areas where employees’ strengths are; these trainingreinforce their strengths and have proven to provide an even higher ROI Consider training planning from two perspectives:o as hands-on technical training to improve work-related skill-set and to learn new

technologies

o as a retention effort for employees

 What other training alternatives exist which would address this specific learning and business

need?

When Can Training be Taken?

Training is to be taken during a time that is convenient and mutually agreed by the manager and theemployee. Training is permitted during working hours with the assumption that the team has adequateresources. For example, training during product release time may not be the best option.

When planning for training, below are the some responsibilities for both the employees and the

managers:

Employee’s responsibility

- Research and present training plan, including training topic, time and costs to managers for

approval.

- Research and present seminars/conferences details, including conference agenda, time and

costs to managers for approval.

- Suggest training topics, both internal and external (i.e. hard technical skills or soft skills) that

may benefit the team to managers.

- Provide feedback on training through the online training feedback survey.

Manager’s responsibility

- Collaborate with HR on individual development plans for your team members- Partner with HR on training feedback and possible training topics.- Encourage employees to consider the types of job-related training that will benefit them.- Encourage employees to recommend training and team building events that will benefit the

team/company as a whole.

- Communicate with other department managers: is there a common topic that your teams can

be trained on?

- Assess and approve/decline employee training request based on training needs and business

needs.

- Organize and facilitate knowledge sharing/case studies within teams.

Page 19

Leveraging Your Human Resources Partners

If there is significant interest in a particular training topic, HR can help organize group training or bringthe training in-house. This approach is beneficial from a cost and time/travel perspective.

When to Confirm Training Plans?

Training should be an on-going communication between managers and employees. Team trainingplan needs to be confirmed (at least tentatively) before the start of each quarter. For example, thetraining plan for Q3 needs to be confirmed by the end of Q2 (June).

Employee Development Fund Oversight

Each VP is responsible for their department's Training budget and final approvals on training costs.

Planning and Approving Training Expenditures

1. Senior managers (or delegates) must add an entry for the proposed training into theappropriate Training Plan on wiki (R&D Training Plans). This serves several purposes: toprovide oversight into who is being trained on what, to help track the quarterly team trainingexpenditures, and to serve as a record of training having taken place. The latter is also required

for purposes of ISO 9001 auditing.

2. At the start of each year or as required, the management team will be advised of the per headaverage budget for each region. Senior managers are expected to update their Training Planson the wiki to indicate what their total annual budget for their team will be based on theheadcount they own multiplied by the per head budget in their region. See template text inyour training plans for where to fill in this information.

3. When ready to book a training expense (either a purchase request or and expense report) inthe https://oa.apo.myfortinet.com/ system.

o For a PR and ER

 set Account to Seminars and Training Expense (even for team building

events)

 attach a file to the PR or ER showing a snapshot of the wiki Training Planthat highlights this particular training expense (the expense will not be

approved without this snapshot).

 attach supplemental documents to the PR or ER as such receipts, pre-approvals from manager, travel documents etc.

4. After obtaining all approvals, manager will arrange and organize training.

5. Manager to update the wiki Training Plan regularly with actual completion dates

Page 20

202 Overtime Policy

Exempt Employees are not eligible to receive overtime. Exempt employees include:

 High technology professionals (BC)

 Information technology professionals (Ontario)

 Employees in Management Positions

Under the B.C. Employment Standards Act, the definition of a “High technology professional” has beenrefined to include the following job functions:

 Analyzes, designs or develops information systems based on computer or other technologies; Analyzes, designs or develops scientific or technological products, materials, devices or

processes;

 Carries out scientific research and experimental development; or Is engaged as a sales or marketing professional in relation to the above services, systems,

products or research.

Under the Ontario Employment Standards Act, 2000, the definition of an “Information technologyprofessional” has been refined to an employee who:

 Is primarily engaged in the investigation, analysis, design, development, implementation,operation or management of information systems based on computer and relatedtechnologies through the objective application of specialized knowledge and professional

judgment

How Overtime is Calculated

B.C. Employees

Non-exempt employees are eligible for overtime if they work more than eight (8) hours a day or forty(40) hours a week. Overtime pay is calculated based on the following:

 Non-exempt employees will earn one-and-a-half (1.5) hours of “in lieu” time for every hour

worked over eight (8) hours a day

 Non-exempt employees will earn two (2) hours of “in lieu” time for every hour worked over

twelve (12) hours a day

 Non-exempt employees will earn one-and-a-half (1.5) hours of “in lieu” time for every hourworked over forty (40) hours in a given week

 Non-exempt employees will earn one-and-a-half (1.5) hours of “in lieu” time for every hourworked on a statutory holiday if a substitution statutory holiday is not an option. Overtimewill not be earned for time worked on a statutory holiday if a non-exempt employee takeshis/her statutory holiday on a different date, as agreed upon with his/her manager. Allstatutory holiday substitutions must be pre-approved by management and submitted to

HR.

Page 21

Ontario Employees

Non-exempt employees are eligible for overtime if they work more than forty-four (44) hours in a workweek. Overtime is calculated on a weekly basis. Overtime pay is calculated based on the following:

 Non-exempt employees will earn one-and-a-half (1.5) hours of “in-lieu” time for every hourworked over forty-four (44) hours in a given week

 Non-exempt employees will earn two-and-a-half (2.5) hours of “in lieu” time for every hourworked on a statutory holiday if a substitution statutory holiday is not an option. Overtimewill not be earned for time worked on a statutory holiday if a non-exempt employee takeshis/her statutory holiday on a different date, as agreed upon with his/her manager.

 All statutory holiday substitutions must be pre-approved by management and submitted

to HR.

Overtime Approval

(1) Informal pre-approval: before working the overtime hours, employee must submit overtimehours to be worked via email for manager and VP approvals. Overtime hours will not becounted if they have not been pre-approved by management.

(2) Formal post-approval: after working the pre-approved overtime hours, employee must prepareand submit the overtime timesheet to his/her manager for signatures and approvals. Onceovertime worked has been approved, employees can decide if they want their overtime paidout or banked. If the employee wants overtime paid out, they should submit their timesheet toPayroll, copying their manager, by every Friday at noon PST.

Only an employee who had worked overtime is required to submit his/her overtime timesheet.

Banked Overtime Policy

For non-exempt employees at Fortinet who have worked approved overtime, there is an option to bankovertime as “in lieu” time which employees can take off at a later date as agreed to by an employeeand their manager. At an employee’s request, bank time balances may be paid out at any time duringthe year. Requests must be submitted to HR via email at least one pay period in advance. Bankedovertime not used by December 31 each year will automatically be paid out in the first pay in Januarythe following year. In order to bank overtime, non-exempt employees will be required to sign a banked

overtime agreement.

PTO must be taken before banked time can be used. If there is a statutory holiday substitution, the

substitution day will be used first.

Banked Overtime Tracking and Usage

Actual banked overtime will be calculated based on the hours employees reported in overtimespreadsheets. If the employee wants to bank overtime, timesheets need to be completed, approvedby their manager, and submitted to HR for tracking. To use banked overtime, employees can submita request to HR via email, copying their manager.

Page 22

203 General Office Policy

Hours of Work

All Fortinet employees have a forty (40) hour work week. The standard workday for employees iseight (8) hours plus one (1) hour unpaid for lunch.

While Fortinet offers flexibility with start and finish times each workday, core hours are between10:00AM and 4:00PM. During this time, all employees are required to be in the office excluding theone (1) hour lunch break. If employees need to be away from the office during these hours, priorapproval should be obtained from your manager.

Telecommuting

Unless agreed upon with your manager, working from home should be very infrequent and should notexceed eight (8) hours per month. For many roles such as Software, Hardware, or QA Engineers,working from home is not feasible as these employees require full access to the Fortinet network,

which is only available in the office.

If an employee needs to work from home, a valid reason should be provided and approved by your

manager:

Valid reasons include:

 Employee needs to be in a telephone call at an inconvenient time and it is therefore more

practical to work from home.

 Extreme weather conditions making it difficult to commute to work (school closures, public

transit not running).

Drugs and Alcohol

Fortinet is committed to maintaining a healthy, drug and alcohol-free work environment. There is zerotolerance for the possession, use or being intoxicated by drugs or alcohol at the workplace and anyemployee who is in violation is subject to disciplinary action, up to and including termination.

Smoking in the Workplace

Fortinet maintains a smoke-free environment, and does not tolerate any type of smoking in theworkplace. This includes cigarettes, cigars, chewing tobacco, and electronic cigarettes (with vapor ornicotine cartridges). In compliance with local provincial laws, employees who wish to smoke may doso outside of the office building in designated smoking areas, as long as it is at least six (6) meters

away from workplace entrances.

Page 23

No Scents is Good Sense

Fortinet strives to ensure the comfort and safety of our employees and visitors by encouraging anenvironment free from smoke, fragrances, chemical-based and scented products, and/or unpleasantsmells. These odors are distracting and may trigger allergic reactions or create health problems suchas the onset of respiratory distress and headaches. This includes all noticeable odors from any source,such as personal items, perfumes/colognes/deodorants, and air fresheners.

In order to protect individuals with sensitivities to fragrances and scents, and to prevent others fromdeveloping such sensitivities, we ask for your cooperation towards a fragrance/scent-safe environmentin the workplace. Employees, visitors and guests are strongly encouraged to avoid or minimize theuse of fragrances or scented products at all Fortinet offices.

Personal Use of Company Telephones

Telephones provided by Fortinet are used for regular business activity. Excessive use andunauthorized personal local and long distance calls are prohibited.

Business Cards

Business cards are provided only to management. However, exceptions can be made for employeeswho are in a position that involves extensive external communication, and business cards arerequired. Please go to the HR Fuse page under “General Employee Services and Information” for

more information.

Employee Access Cards

According to Fortinet's Site Access Policy, employee access cards must be worn by employees andvisible at all times. All employees are issued an office access card and must not lend it to anyone.Lost and stolen access cards must be reported to Reception immediately so the card can becancelled for security purposes. Replacement access cards are $20 if employees lose their initialone. If an access card is not working, a replacement card will be provided at no charge.

Access card information shall be used for the purposes of ensuring the safety and security ofemployees and may be used for disciplinary purposes. Access card information is saved in our securedatabase for 365 days before being deleted from the system. Please refer to our Privacy Policy formore information on how personal information is managed at Fortinet.

Employee Desks

Employees are encouraged to maintain a tidy workspace. Computer screens should be locked andconfidential material must be securely stored away when an employee steps away from their desk.This ensures that work is secure and is kept confidential.

Printouts and Photocopies

Employees who are using public printers and photocopiers in the office should retrieve thesedocuments from the machines immediately if sensitive and confidential information is involved.

Page 24

Recording Devices

The use of any recording devices (audio or video) is prohibited unless authorized by the executive

team.

Visitor Policy

All visitors are required to sign in at reception, wear and have visible a guest access badge at alltimes, and be accompanied by a Fortinet employee at all times. Please read and understand theVancouver Site Access Policy before having any visitors in the office.

Any confidential company information must not be shared with the individual(s). Non-Fortinetemployees do not have access to the Fortinet corporate network, but may use the wirelessconnection for visitors and may obtain this information from Reception or MIS.

Page 25

300 Quality Management

Fortinet Technologies was successfully registered as an ISO 9001:2000 Company in May 2008. TheQuality Management Team has published comprehensive quality policies and procedures which all

employees need to be familiar with.

A self-directed guide to Quality Management at Fortinet is available on the Wiki at:http://wiki.fortinet.com/twiki/bin/view/QualityManagement/IntroducingTheQualityWiki.

Please review the Fortinet Quality System Manual, which contains Fortinet's Quality Policy.

It is mandatory that all employees complete training on their required training processes for theirrespective role to be complaint with ISO.

Employees are responsible for maintaining their own training records on their own wiki page byproactively setting up their required training list and complete the training.

Managers are responsible for reviewing training needs and competencies throughout the year andreport at least once per year through performance reviews. Following performance reviews, managersneed to ensure that each employee’s competency record is updated.

More information can be found at:

http://wiki.fortinet.com/twiki/bin/view/QualityManagement/QualityManagementDoc10105

Please contact the Quality Team for more information: quality@fortinet.com

Page 26

400 Resignations & Terminations

Resignations

An employee may voluntarily terminate his/her employment upon providing two (2) weeks of writtennotice to their manager and the Human Resources department at Fortinet.

Terminations

Fortinet reserves the right to terminate an employee’s employment at any time for reasons other thancause, upon the provision of the minimum notice of termination, termination pay, and/or severancepay entitlements provided for pursuant to B.C’s Employment Standards Act, Ontario’s EmploymentStandards Act, 2000, or other applicable provincial legislations, as amended, depending on theprovince the employee is working in. No other notice of severance entitlements shall apply.

To confirm, the payments provided for above represent Fortinet’s maximum termination andseverance obligations to an employee. This provision shall remain in full force and effect unamended,notwithstanding any other alterations to the terms and conditions of an employee’s employment,unless agreed to by Fortinet in writing. These provisions expressly supersede any previous

representations, oral or written.

Fortinet reserves the right to terminate an employee’s employment for just cause, at any time, without

notice or pay in lieu of notice.

Page 27

401 Privacy Policy

Complying with the Personal Information Protection Act (PIPA), a provincial legislation, Fortinet hasdeveloped the Privacy Policy to demonstrate our commitment to safeguarding employees’ personal

information.

It is important to note that the terms of the Privacy Policy only extend to Fortinet employees and theuse of their personal information. Any customer information collected within our sales teams is usedsolely for business purposes only, which is excluded from PIPA.

The Privacy Policy outlines the principles and practices that Fortinet will adhere to in protectingemployees’ personal information. Our privacy commitment includes ensuring the accuracy,confidentiality, and security of employees’ personal information. Employees may request access to,and correct personal information at any time.

Personal information is defined as information about an employee including but not limited to:

 Name,

 Age,

 Home address,

 Phone number,

 Social insurance number,

 Marital status,

 Education,

 Employment information,

 Dependent’s information, and

 Legal working status information

Personal information does not include contact information as described below, which is excluded from

PIPA:

Contact information is defined as information that would enable an employee to be contacted at aplace of business and includes the following information:

 Name,

 Position/job title,

 Business phone number,

 Business fax number,

 Business address, and

 Business email

Fortinet will communicate the purposes for collecting personal information, either verbally or in writing,before or at the time of collection, unless the purpose is obvious to the employee and the information

is voluntarily provided by the employee.

In compliance with the terms of PIPA, Fortinet is required to:

 Demonstrate how personal information is currently used, Obtain employee consent for use of personal information in the present and future, Demonstrate the safeguards in place that secure personal information,

 Develop a privacy policy,

Page 28

 Develop and publish a complaint and request for information process, complete with a privacyofficer who is responsible for the obligations under PIPA.

Under the terms of PIPA, Fortinet is permitted to collect, use, and disclose employee information forthe sole purpose of establishing and managing the employment relationship as long as employees arenotified of the collection, use, and disclosure of such information (to whom and for what purposes).

For existing employees, it is assumed that there is consent to disclose personal information for thepurposes of managing the employment relationship and for other purposes as outlined in this policy.

Fortinet Use of Personal Information

Fortinet will use employees’ personal information in the following ways:

 To establish and manage the employment relationship;

 To enrol employees and their dependents in the Group Benefits Plan, or change personalinformation related to the plan as requested by employees, including dependent information

and beneficiary information;

 To establish direct deposit and manage ongoing payroll with the payroll service provider;

 To fulfill legal obligations under Fortinet’s Stock Options Program;

 To provide immediate medical attention if required;

 To appropriately document intellectual property activity in applying and publishing require

patents;

 To enrol employees in a company program;

 To deliver requested services;

 To meet any federal, provincial, or local regulatory requirements;

 To verify and identify an employee’s legal working status in Canada; and

 To assist in the application and/or renewal process with Human Resources and SkillsDevelopment Canada (HRSDC) and Citizenship and Immigration Canada (CIC) for employeeswith work permits, or are applying for permanent residence status.

Page 29

Consent

Unless authorized to do so as part of managing the employment relationship as noted above, Fortinetwill obtain employee consent to collect, use, or disclose personal information.

Consent may be provided verbally, in writing, electronically, or through an authorized representative.Consent may also be implied if the purpose of the collection, use, and disclosure of personalinformation is obvious to the employee and the employee voluntarily provides such personal

information.

Consent to use or disclose personal information may be implied if an employee is given notice and areasonable opportunity to opt out of having their personal information be used for purposes that werenot originally stated at the time the information was collected.

Where the release of personal information is necessary to provide a service or product, employeesmay withdraw their consent from Fortinet to use their personal information. If an employee decides towithdraw their consent from Fortinet to use their personal information, and this decision restrictsFortinet’s ability to provide a service or product, Fortinet will ensure all information is communicatedto the affected employee to ensure there is full disclose of the situation and any consequences

associated with it.

Fortinet may collect, use, or disclose personal information without an employee’s knowledge or

consent in the following circumstances:

 Where the collection, use or disclosure of personal information is required by law;

 Where an individual’s personal security, health, or life is threatened in an emergency;

 Where personal information is available through a public source (e.g. telephone directory);

 Where legal advice is required;

 Where debt is owed to Fortinet by an employee;

 Where protection is needed by Fortinet against fraudulent activity;

 Where an investigation is needed for an anticipated breach of agreement of contravention of

law.

Retaining Personal Information

If an employee’s personal information is used for a decision that directly impacts such employee,Fortinet will retain the personal information used for a minimum of one year so there is a reasonableopportunity for the impacted employee to request access to such information.

Furthermore, employment information will be retained for the duration of time as required by law.

Page 30

Accuracy of Employee Personal Information – Corrections & Changes

Fortinet strives to ensure employees’ personal information is accurate and complete when using theinformation for decision-making impacting the employee, or disclosing such information toorganizations such as benefits or payroll providers.

Employee records are required by law. To ensure Fortinet has the most up-to-date information, it isthe responsibility of the employee to notify Human Resources in writing of any changes to theirpersonal information including, but not limited to changes in:

- Legal name, home address, phone number, marital status, dependents’ information,beneficiary information, or emergency contact information.

Any requests to correct or change personal information needs to be in writing and supplemented with

supporting documentation, if applicable.

Securing Personal Information

Fortinet is committed to protecting employee personal information from unauthorized access,collection, use, disclosure, modifications, or disposal of such information.

The following security measures will be followed to ensure that employee personal information is

appropriately protected:

 Securing employee records in locked cabinets in a locked room Ensuring computers are locked when employees with access to personal information is

away from their desk

 User IDs

 Firewall protection.

Our Commitment to Employees

Fortinet will limit the collection, use, and disclosure of employee personal information to the extentrequired to conduct business described above. Employee personal information will be safeguarded,limiting access to personal information on a need-to-know basis. Third party service providers will berequired to comply with PIPA in order to have access to employee personal information.

Employees’ request to review and update their personal information will be honoured in a timely

manner.

Employment References

All requests for references should be directed to Human Resources. No executive, manager oremployee is authorized to release references for current or former employees. This is in line with thePrivacy Legislation in Canada. If a current or former employee requests disclosure of theiremployment information in writing, the Human Resources team will provide information on thesalary earned and some job information, as agreed with the current or former employee.

Page 31

Personal Information in Emails

Fortinet’s email system is used solely for business purposes and is subject for review by Fortinet atany time. This email system is not at all intended for the collection, use, or disclosure of employee

personal information.

Access to Your Own Personnel File

Employees may review their own personnel file upon request during regular business hours.Personnel files may not be removed from Human Resources and must be reviewed in the presence

of a Human Resources Representative.

Privacy Policy Questions, Requests or Complaints

Please direct any questions, requests or complaints regarding the collection, use, and disclosure ofemployee personal information to the Director of Human Resources. A response can be expectedwithin two (2) business days with the commitment to meet obligations to review personal informationor respond to complaints within the thirty (30) day limit as specified under PIPA.

500 Pay

Canadian employees are paid semi-monthly – on the 15th and the last day of each month throughdirect deposit to the bank account the employee has setup with Fortinet. If a regular pay day falls ona holiday or a weekend, employees will be paid on the preceding work day. In a calendar year, there

are twenty-four (24) pay periods.

For new employees, a hardcopy pay statement is available for his/her first pay period. All subsequent

pay statements are available online.

Employees are required to register for an online account with ADP (http://registerme.adp.ca) to view

pay statements and tax forms.

Page 32

If an employee needs to make any changes to their banking information, or if there appears to be anerror on the pay statement, please contact the Payroll administrator.

Compensation packages are confidential and not to be discussed amongst Fortinet employees.Should this occur, it may result in disciplinary action, up to and including terminations. The appropriatedisciplinary action will be determined on a case-by-case basis and the final decision remains the sole

discretion of Fortinet.

Sales Commissions

Commissions earned each month by sales employees are paid out 45 days after the end of month.

501 Benefits

Fortinet is committed to providing employees and their families with a comprehensive benefits planthat focusses on overall health and wellness.All regular employees who work at least 24 hours per week are eligible to join our benefits planeffective their first day of hire at Fortinet.For more information on the benefits plan, please refer to our Group Benefits page on Fuse.

600 Workplace Violence, Bullying, Harassment & Sexual Harassment Program

Fortinet does not tolerate harassment or bullying of any kind.

Fortinet is committed to providing a safe, violence-free, harassment and bullying-free workplace andstrictly prohibits employees, contractors, consultants, customers, vendors, suppliers, visitors, oranyone else on company premises or engaging in a company-related activity from behaving in aharassing, violent or threatening manner and strictly prohibits all such behavior. This policy applies tointerpersonal and electronic communications such as email, telephone, and social media channels.

Page 33

Employees must not engage in the bullying and harassment of others. Employees should immediatelydirect complaints to their manager and Human Resources. Complaints will be resolved confidentially

to the extent possible.

Workplace violence, harassment and bullying that is directed towards an employee may stem fromany individual, including clients, coworkers, friends, current or former family members, and strangers.It also includes employees’ right to refuse work if they believe that they are at risk of physical injurydue to possible workplace violence and details of domestic violence occurring at the workplace.

Fortinet is responsible for providing awareness in these areas:

 Education, including providing clear definitions of workplace violence, harassment, sexual

harassment and bullying

 Employees’ Right to refuse work in unsafe conditions

 Domestic violence at work

 Employer’s responsibilities

 Reporting mechanism for incidents of workplace harassment, including when the alleged

harasser is the employer or supervisor

Safety in the Workplace

Fortinet recognizes the importance of providing a safe workplace for all employees. If an employeedeems a condition to be unsafe to work in, they have the right to refuse work.

For more details on this topic, refer to Fortinet International Employee Handbook – Safety in the

Workplace.

Workplace Violence

Workplace violence is defined as:

 Exercise of physical force by a person against a worker in a workplace that causes or could

cause physical injury to the worker

 Attempt to exercise physical force against a worker in a workplace that could cause physical

injury to the worker

 Statement or behaviour that is reasonable for a worker to interpret as a threat to exercisephysical force against the worker in a workplace that could cause physical injury to the worker

Workplace violence includes threatened, attempted, or actual behaviour of a person that causes or islikely to cause physical injury to an employee in workplace settings.

Examples of Workplace violence includes:

 Physical attacks such as kicking, hitting, and pushing Verbal or written threats that express an intent to harm

Page 34

 Threatening behaviour such as shaking fists or destroying property

Domestic Violence

All Fortinet staff are responsible for taking every precaution reasonable in the circumstances for theprotection of workers when they are aware, or ought reasonably to be aware, that domestic violencemay occur in the workplace, and that it would likely expose a worker to physical injury.

Recognizing Domestic Violence

 Employee seems to be covering unexplained bruises Employee is missing work more often than usual Employee engaged in frequent heated personal calls Employee appears nervous talking about or when around abuser Abuser shows up at workplace looking for employee Abuser asks or threatens coworkers about employee.

If employees are concerned about domestic violence entering the workplace, they should report theseconcerns to their manager or Human Resources immediately.

In the event that both the worker and their spouse work at the same organization and there areconcerns about domestic violence occurring in the workplace, the matter will be dealt with according

to Fortinet’s Workplace Violence Policy.

Fortinet is responsible for assessing the reported situation, adhering to procedures, policies, fosteringa safe work environment to address all relevant risks, and, if necessary, reporting to the police and/or

emergency services.

For more details on what constitutes as workplace violence, refer to Fortinet International Employee

Handbook – Workplace Violence.

Workplace Harassment & Bullying

Workplace harassment is defined as engaging in a course of vexatious comment or conduct againsta worker in a workplace that is known or ought reasonably to be known to be unwelcomed behaviour.Workplace Bullying includes any inappropriate conduct or comment by a person towards a worker thatthe person knew or reasonably ought to have known would cause that worker to be humiliated orintimidated. This excludes any reasonable action taken by an employer or people manager relating tothe management and direction of workers or the place of employment.

Examples of Workplace harassment and bullying include:

 Engaging in verbal abuse (e.g. yelling, name calling, and making threats)

 Belittling a worker’s opinions

 Spreading malicious rumours

 Undermining or sabotaging a worker’s work Deliberately ignoring or excluding a worker (silent treatment)

 Vandalizing personal belongings

 Harmful hazing or initiation practices.

Page 35

Bullying and harassment behaviour does not include:

 Expressing differences of opinion

 Offering constructive feedback about work related behaviour Managing a worker’s performance and taking reasonable disciplinary actions or assign work.

For more details on what constitutes as workplace harassment, refer to the Fortinet WorldwideEmployee Handbook – Maintaining a Harassment – Free Environment

Assess the Risk

The Health & Safety Committee will be conducting periodic assessments and providing feedback tomanagement regarding areas, divisions, or groups that may be at risk for workplace violence and/or

harassment.

Surveys requesting feedback on these topics will be sent out on occasion to collect feedback fromemployees. If you have any suggestions or feedback please emailhealthandsafety_ottawa@fortinet.com or healthandsafety_bc@fortinet.com.

If employees observe or become aware of any actions or behaviours that violate this policy, they mustnotify their manager or Human Resources immediately.

Control the Risk

Risks identified in the risk assessment and employee feedback surveys will be assessed and

implemented if appropriate.

These may include:

 Developing safe work procedures specific to the identified risk A method of informing workers of potentially violent situations Implementing a workplace violence training program for all employees Ensuring employees are aware of their right to refuse work based on unsafe conditions.

Employee Communication

 New employees will receive a copy Fortinet’s Worldwide Employee Handbook which includesour policies on Workplace Violence, Harassment, Bullying and Reporting Procedures. Further discussion on this topic will occur during new hire orientation All of these policies will be made available on Fortinet’s intranet All employees in the provinces of BC and Ontario will undergo a Workplace Violence andHarassment training to help them better identify situations that constitute as harassment and

procedures for reporting these incidents

 All employees are asked to review Fortinet’s International and Canadian Handbook on anannual basis which is reviewed and updated annually.

Report, Investigate and Remedy Complaints

Informal:

If you are being bullied, harassed or have been a victim of violence:

Page 36

 Inform the person perpetuating the actions immediately that their actions are not acceptable

to you as soon as they start to occur.

 Describe the specific actions that they took that caused you to feel uncomfortable. Whenconfronted, in many instances, the person will stop. Sometimes a person in not aware thatthey are acting in an unacceptable manner. This may also prevent the act from escalating

and possibly becoming dangerous.

 It is important to keep a record of dates and times where you have spoken to the person whohas committed the act of bullying, harassment or violence and inform yourmanager/supervisor or Human Resources what occurred.

Where the actions continue, employees are directed to use the formal reporting process.

Formal:

Where bullying, harassment or violence has either continued to occur after a conversation with theindividual or was extreme or dangerous in nature, employees are required to report it immediately.

Process:

 Speak with your supervisor/manager or with Human Resources or another member ofManagement where your supervisor/manager is the cause of concern and report the

incident.

 Write out a statement detailing the incidents including:

o The names of the parties involved

o Any witnesses to the incident(s)

o The location, date, and time of the incident(s)o Details about the incident (behaviour and/or words used)o Any additional details that would help with an investigation A fact finding investigation will be instigated. Where it is determined that the person has contravened the law, the appropriate authorities

will be contacted.

 All complaints shall be taken seriously and investigated fairly. Employees that submit a report or complaint of bullying, harassment or violence in goodfaith, shall not be subject to any form of reprisal or retaliation as a result of the complaint. Confidential reporting can also be submitted through:1. Via the internet: https://secure.ethicspoint.com/domain/en/default_reporter.asp2. Via Telephone: Within Canada and the US, dial 888-359-6290

Investigate:

If Fortinet becomes aware of any forms of harassment, bullying or violence an investigation will ensue.Employees are asked to provide as much details as possible to assist with the investigation. Allinvestigations will be conducted as confidentially as possible.

Most investigations at Fortinet will be conducted internally. In complex or sensitive situations, an

external investigator might be hired.

Investigations will:

 be undertaken promptly and diligently, and be as thorough as necessary, given the

circumstances

Page 37

 be fair and impartial, providing both the complainant and respondent equal treatment in

evaluating the allegations

 be sensitive to the interests of all parties involved, and maintain confidentiality be focused on finding facts and evidence, including interviews of the complainant,

respondent, and any witnesses

 incorporate, where appropriate, any need or request from the complainant or respondent forassistance during the investigation process.

What will be Included

Investigations will include interviews with the alleged target, the alleged bully, and any witnesses.If the alleged target and the alleged bully agree on what happened, then Fortinet will not investigateany further, and will determine what corrective action to take, if necessary.

The investigator will also review any evidence, such as emails, handwritten notes, photographs,or physical evidence like vandalized objects.

Follow-up

The alleged bully and alleged target will be advised of the investigation findings. Fortinet will keepa confidential, written record of investigations, including the findings. Human Resources will reviewand revise workplace procedures to prevent any future bullying and harassment incidents in theworkplace. Appropriate corrective actions will be taken within a reasonable time frame. If Fortinetdetermines that violence, harassment or bullying has occurred, remedial actions will be takenappropriate to the circumstance. Any employees who participate in such activities will be subjectedto disciplinary action, up to and including termination.

For more details on Complaint Procedures at Fortinet refer to the Fortinet Worldwide EmployeeHandbook – Complaint Procedures for Discrimination and Harassment Matters and Complaint

Procedures for Other Matters.

601 Health & Safety

Burnaby Office:

To reach First Aid Attendants, please call: ext. 6666 from your desk phone

First Aid Room: located on the 4th floor close to the kitchenette off the elevator lobby

First Aid Attendants - please refer to: http://wiki.fortinet.com/twiki/bin/view/Facilities/HealthAndSafety

Emergency Phone Numbers

 Fire/Ambulance/Police: 9-911

 Building Emergency Contact: 604-551-0792

Page 38

 Building Non-Emergency Contact: 604-646-9999

 Fortinet Office Manager: 604 551-0792

If you or someone around you needs medical attention, dial ext. 6666 to page the first aid

attendants.

If it is a major medical emergency, call 911, then call ext. 6666.

Nearest Hospital:

Burnaby Hospital - 3935 Kincaid Street, Burnaby, BC

Nearest Walk-in Clinic:

Kensington Medical Clinic - 6548 Hastings Street, Burnaby, BC; 604 299-9769Hours of Operation: http://www.kensingtonmedicalclinic.com/

Taxi Service:

Bonny’s Taxi: 604 435-6655

Burnaby Taxi: 604 433-4466

Yellow Cab: 604 681-1111

Ottawa Office: 1826 Robertson Road and 326 Moodie DriveTo reach all First Aid Attendants, please call ext. 7777

First Aid-kit: located at Reception and H&S Room (Robertson Road)

First Aid Attendants - please refer to:

https://fuse.fortinet.com/page/hr-canada-self-service-health-and-safety-ottawahttps://fuse.fortinet.com/page/hr-canada-self-service-health-and-safety-burnaby

Emergency Phone Numbers

 Fire/Ambulance/Police: 911

Building Emergency Contact (after hours):

Robertson

Rhonda Goodfellow

The Regional Group of Companies Inc.

1737 Woodward Drive, 2nd Floor

Tel:(613) 230-2100 ext. 7213

Fax:(613) 230-9880

Moodie

Building Manager – John Nageri: 613-223-4371 (Cell)

Fortinet Office Admin: 613 225-9381 ext. 7000

If it is a major medical emergency, call 911 and ext. 7777.

Page 39

Nearest Hospital:

Queensway Carleton Hospital – 3045 Baseline Road, Ottawa, ON; 613 721-2000

Nearest Walk-in Clinic:

Appletree Medical Centre

2150 Robertson Rd #4, Nepean, ON K2H 9S1

Hours vary daily, hours posted on their website the night before.http://www.appletreemedicalgroup.com/locations.php

Taxi Service:

Blue Line Taxi: 613 238-1111

West Way Taxi: 613 727-0101

If there is a fire in the building, emergency procedures are located by the emergency exits where the

fire extinguishers are located.

Emergency Procedures

Medical

All illnesses or injuries must be reported to a First Aid Attendant and to HR

Collapse or Serious Injury

Person closest to injured person:

1. Ensure scene of the accident is safe and that there are no signs of further danger to you or the

injured person.

2. Do not move the injured person unless there is a high risk of further injury and it is safe for you

to do so.

3. Stay calm and do not leave the injured person unattended.4. Call 911 immediately and then contact the First Aid Attendant and report the exact location ofthe injured person and his/her condition.5. Be prepared to assist when directed by the First Aid Attendant.

Minor Injury or Illness

1. Contact the First Aid Attendant immediately – call:

ext. 6666 (Burnaby office) or

ext. 7777 (Ottawa office)

2. Follow the First Aid Attendant's instructions and provide as much information as

possible.

3. Ensure that your manager is informed that you have reported to the First Aid Attendant.

Alarm Bells

1. Evacuate the building as quickly as possible.2. Follow the direction of your area's Fire Warden or their designated alternate and go to your

assembly area.

Page 40

Assembly area:

Burnaby:

Sidewalk in front of building - 4190 Still Creek Drive

Ottawa Robertson:

Far end of the parking lot in front of the building

Ottawa Moodie::

Far end of back parking lot

Fire

If you discover a fire:

1. Immediately shout “FIRE” and activate the nearest internal fire alarm pull station.2. Dial 9 - 911 for Fire Department. State the location and nature of the emergency or havesomeone else do so and report back to you.

For assistance:

Burnaby office: call security at 9-604-294-3544 | after hours: 9-604-968-4811Ottawa Robertson office: 613-225-9381 x7000 | after hours: 613-787-5511

Ottawa Moodie office:

3. If trained and safe to do so, attempt to extinguish or control the fire with appropriate fire-fighting

equipment.

4. If not safe to do so, or if you cannot extinguish or control the fire, then try to contain it by closing

the doors.

5. Evacuate the area and proceed to your assembly area.6. Report to your fire warden to ensure an accurate headcount.

**Do not stay in the building under any circumstances

**Do not use the elevators.

**Exit through the closest stairwell

**If you are injured and cannot evacuate the building, head to an area of refuge located in the stairwells**Do not leave the assembly area until instructed by the Evacuation Control Officer.

**Do not get in your car and leave

**Do not re-enter the building for any reason until it is indicated it is safe to do so.

Security

If you need help, take the following actions (as required):

1. Call Security at 9-604-812-5947

2. If it’s a more serious matter, dial 9 - 911 for police and notify your manager.3. Take only reasonable measures to protect other staff from violence and to protect companyproperty from damage, do not endanger yourself.4. Report all threats to your Manager and Health & Safety Committee – using incident report

form.

5. For non-emergency security issues such as escort, patrol, and building after hours pleasecall 9-604-968-4811 (Burnaby office) or 613-787-5511 (Ottawa office).

Page 41

Building Issues

If you discover an issue in the building that is not an immediate hazard, report it to a member of the

Facilities team.

Building Emergency

If you discover building damage that is an immediate hazard:

1. Take reasonable measures to protect employees from the hazard or send a co-worker to reportthe damage (and report back to you) while you stand and watch over the hazard.2. Report hazard to building maintenance including location and description of damage.3. Burnaby office: Building maintenance dial 9-604-551-07924. Ottawa Robertson Office: Building maintenance dial 9-613-225-9381 ext. 7500 or

Regional Group 9-613-230-2100 ext. 7213

5. Ottawa Moodie Office: Building Manager – John Nageri: 613-223-4371 (Cell)

Building Evacuation Plan

Responsibilities

1.1 Building evacuation team members

Each floor has one (1) Incident Commander (and alternate), and two (2) area wardens, who will directthe evacuation of persons from their respective areas as quickly as possible in a safe and controlled

manner.

1.1.1 Incident Commander

The Incident Commander ensures that:

 Building evacuation plan is developed and maintained. Evacuation diagrams are developed and posted. Evacuation drills are conducted at least once a year. Inspections of exit paths (including exit doors) are performed regularly. All necessary repairs of components for exit paths are completed. Plans for the modification of any part of an exit path are reviewed. An up to date list of area wardens is maintained.

During a fire alarm, the Incident Commander: Proceeds to main entrance and checks the enunciator panel to determine location of the alarm. Meets with area wardens and informs them where the emergency is located. Checks to see if anyone is in the areas of refuge and report that to the fire department

Following a fire alarm, the Incident Commander Notifies area wardens that it is safe to re-enter the building. Ensures the alarms are reset after the evacuation alarm. Prepares a report following an evacuation.

 Reports to management.

1.1.2 Floor Wardens (East Warden and West Warden)

Floor Wardens will:

 Assist the Incident Commander when requested Evacuate all persons from their respective areas as quickly as possible in a safe and controlled

manner.

Page 42

 Proceed immediately to the enunciator panel to determine the location of the alarm. Meet the Incident Commander and emergency services personnel Assess the situation, assists in first aid if required, and informs the Incident Commander Report to the Incident Commander if there is anyone in the areas of refuge

Emergency Services

Personnel of any special hazards in the area: Ensures the alarms are reset after the evacuation alarm. Ensure complete and immediate withdrawal of all personnel in his/her area through a

predetermined route.

 Inform his/her backup person in the event that they are absent from the building. Ensure that all doors are closed, but not locked, in his/her area and check the washrooms. Insist that personnel move to the designated assembly area. Notify the Incident Commander that their area is clear. Notify personnel that they may re-enter the building when permission has been given by theemergency services personnel and the Incident Commander.

Note: If the emergency occurred in the area warden’s area, the area warden evacuates all personnel,assesses the situation and prevents access to the area except for the Incident Commander, and

emergency services personnel.

The area warden will notify the Incident Commander or emergency services personnel of any specialhazards in the immediate area of the emergency.

1.2 MANAGERS AND SUPERVISORS

Managers and supervisors will:

 Know evacuation procedures for the area under their supervision. Inform new personnel of evacuation procedures. Assign one person and one alternate for each mobility-, sight-, or hearing impaired person whomay need assistance during an evacuation. Ensure that exit paths are kept clear and unobstructed at all times. Notify the Incident Commander of plans for modification of any part of an exit path (including

exit doors).

BUILDING EVACUATION

2.1 DISCOVERY OF FIRE

1. DO NOT PANIC

2. Assess the situation, use a fire extinguisher if you are confident that you can control the firewithout placing yourself or others in danger, call for help3. If you are not confident, leave the fire area immediately assist anyone in immediate danger to

evacuate

4. Activate the fire alarm by pulling the closest pull station to you

5. Call 9 – 911

6. Alert people nearby and trigger the fire alarm by pulling the closest pull station to you7. Evacuate the building and inform the Incident Commander of the fire location8. Close all doors behind you to confine the fire

Page 43

2.2 EVACUATION PROCEDURE

 Evacuate the building in an orderly fashion using the safest and closest exit route. In winter orinclement weather get your jacket if it is safe to do so

 DO NOT USE THE ELEVATOR!

 If safe to do so, take personal belongings (keys, purses, wallets, etc.) Follow instructions from the Incident Commander and floor wardens If safe to do so, close doors behind you if you are the last one to exit an office If safe to do so, secure any hazardous materials or equipment before leaving Assist others who may be in need of assistance Proceed to the designated evacuation assembly area (see attached map) and report to your

Floor Warden or Supervisor

 Do not re-enter the building until instructed to do so by the emergency services personnel and

Incident Commander

 Do not get in your car and leave the premises

Note: The Incident Commander will only allow re-entry to a building after the emergency servicespersonnel has authorized such re-entry. The chain of command on authorization to re-enter anevacuated building flows from the emergency services personnel to the Incident Commander, areawardens, and managers and supervisors, who in turn instruct personnel accordingly

700 Employee Paid Time Off (PTO)

PTO is accrued and is to be used for all absences related to vacation, illness, or other personal

reasons.

Full time employees are entitled to three (3) weeks (15 work days) of PTO in their first year ofemployment with Fortinet, and four (4) weeks (20 work days) of PTO in their second and subsequent

years with Fortinet.

Part-time employees will be paid out PTO on each pay. Part-time employees with less than five (5)years of service with Fortinet will receive 4% of their pay and employees with five (5) or more years of

service will receive 6% of their pay.

The maximum amount of PTO that can be carried over from one calendar year to the next is 120 hours(15 work days). It is the employees’ responsibility to ensure they do not exceed the maximumcarryover. PTO balances can be accessed in the Human Resources Information System (HRIS).

Employees may not take PTO before it is earned. If employees need to take time off, they may takean unpaid leave of absence. Requests for time-off, whether paid or unpaid, must be submitted to yourmanager in advance through the HRIS as early as possible.

Time off must be taken at times that are mutually convenient to the employee and Fortinet. Whenmultiple employees have time off requests, the decision of who may take PTO is determined by staffingneeds and business requirements. It is the manager’s responsibility to ensure there is adequatecoverage within his/her team. Staffing and business requirements will take precedence in approving

any extended time off.

Page 44

BC and Quebec Commission Based Employees

In accordance with B.C and Quebec’s employment standards, commission based employees whowork in these two (2) provinces will accrue PTO on their earned commissions which will be paid outmonthly. Employees with less than five (5) years of service with Fortinet will receive 4% of paidcommissions for that month. Employees with five (5) or more years of service will receive 6% of paid

commissions for that month.

701 Attendance

Attendance at Work

Fortinet recognizes the need for occasional time away from work, providing employees with PTO andunpaid leave options. However, frequent absences or tardiness for any reason can have an adverseeffect on an employee’s ability to satisfy job requirements and meet performance expectations.

Unacceptable attendance is defined as, but is not limited to:

 Repeated, unplanned absences or tardiness, resulting in work or services being delayed,rescheduled, or not completed when expected.

 Absences or tardiness that places continuous undue hardship on other employees to make up

for lost productivity.

Employee’s Responsibility

An employee must notify their manager and obtain approval in advance for planned absences. Timeoff must be taken at times that are mutually convenient to both the employee and Fortinet. It is themanager’s responsibility to ensure an employee’s planned absence will have minimal impact on

business operations.

In the event of an unplanned absence, an employee must notify their manager as soon as possibleand no later than the beginning of their scheduled workday. Should the absence be expected to lastmore than one workday, the manager must be made aware so alternative plans can be made to ensure

adequate coverage of responsibilities.

Regular and punctual attendance at work is as equally important as providing proper notification ofabsences. Absenteeism results in inconvenience and added-on responsibilities for colleagues and adisruption to regular business operations.

Fortinet reserves the right to request an employee to provide a medical doctor’s certificate for any

medical-related absences.

Excessive absenteeism may result in disciplinary action up to, and including termination. Theappropriate disciplinary action will be determined on a case-by-case basis and the decision remains

the sole discretion of Fortinet.

Unauthorized Absences

Page 45

If an employee is absent from work for up to three (3) consecutive days without notifying his/hermanager, the employee is subject to disciplinary action. If the absence continues for more than three(3) days without proper notification, Fortinet will assume that the employee has voluntarily severed theemployment relationship with Fortinet, and the employee will be terminated at Fortinet’s sole

discretion.

702 Types of Leaves

Maternity/Pregnancy and Parental Leave (BC and ON)

The BC and Ontario Employment Standards Acts (ESA) provides eligible employees who are pregnantor are new parents with the right to take unpaid time off work, while the Federal Employment InsuranceAct provides eligible employees with maternity and/or parental benefits that may be payable to theemployee during the period he or she is off on an ESA maternity/pregnancy and/or parental leave.

It’s important to point out that the rules governing the right to take time off work for maternity/pregnancyand parental leave under ESA are different from the rules regarding the payment of EI maternity andparental benefits. For example, under ESA a new father has the right to begin his parental leave atany time within 52 weeks of the birth of his child but EI benefits can only be claimed within a 52 weekperiod. This means that if the new father starts his leave on week 40 after the baby’s birth, he can onlyclaim 12 weeks of EI but has the right to continue the rest of his leave without EI benefits.

BC ESA – unpaid, protected Ontario ESA – unpaid, EI – benefitsleave protected leave provided by federal

government while on

leave

Maternity/  Up to 17 consecutive  Up to 17 consecutive weeks  Can get EI benefitsPregnancy weeks LOA without pay LOA without pay (can begin up to 15 weeks (canLeave (can begin at any time up to leave at any time up to, and begin as early as 1211 weeks prior to expected including her due date, as weeks before duedate of delivery and long as employment with date)continue leave up to 17 company started at least 13

week max) weeks ago)

BC ESA – unpaid, protected Ontario ESA – unpaid, EI – benefitsleave protected leave provided by federal

government while on

leave

Parental Leave Birth Mothers who took Birth Mothers who took Standard Parental

Maternity Leave Pregnancy Leave Benefits

 Up to 35 consecutive  Up to 61 consecutive  Paid for aweeks and can begin the weeks and can begin the maximumleave at any time within 52 leave at any time within 78 of 35 weeks andweeks of the birth of the weeks of the birth of the must be claimed

child child within a 52 week

period (12 months)

Fathers or Mothers who Fathers or Mothers who after the week thedid not take Maternity did not take Pregnancy child was born

Leave Leave  The weekly benefit

rate is 55% of your

Page 46

 Up to 37 consecutive  Up to 63 consecutive average weeklyweeks and can begin weeks and can begin the insurable earningsleave at any time within 52 leave at any time within 78 up to a maximumweeks of the birth of the weeks of the birth of the amount

child child

 For example – you Extended Parental

can wait until 50 Benefits

weeks after baby is  Paid for a

born to start your maximum

leave and you will of 61 weeks and

still have 37 weeks must be claimed

within a 78 week

period (18 months)

after the week the

child was born

 The weekly benefit

rate is 33% of your

average weekly

insurable earnings

up to a maximum

amount

Additional Info  Note that the BC ESA has  For both Pregnancy and  Once you selectnot updated the act to Parental Leave, the one option, youinclude the extended employee must have had can’t switch to theparental benefits – this started employment at other onemeans that there is no least 13 weeks before the  Both parents canguaranteed job protection baby’s due date share the benefitbeyond the maximum LOA (Pregnancy Leave) and 13lengths noted above weeks before starting Leaves can be shorter leave (Parental Leave)than the maximum but  Leaves can be shortermust be taken all at once than the maximum but(i.e. you can’t go on leave, must be taken all at oncecome back to work, then (i.e. you can’t go on leave,go on leave again) come back to work, then

go on leave again)

For more Maternity/Pregnancy Leave - Pregnancy and Parental Government of

information BC ESA Leave Canada –

please visit Employment

Parental Leave – BC ESA Insurance

Requesting Maternity/Pregnancy and Parental Leave

Before going on leave, you must notify your manager and HR, in writing, at least: Four (4) weeks before the day you plan on taking leave (BC employees) Two (2) weeks before the day you plan on taking leave (Ontario employees)Once the leave dates have been confirmed, you must enter them into the Human ResourcesInformation System. Please use “Canada Unpaid LOA w/ benefits – Parental Leave”.

Note – if your leave request is more than 90 days, you will need to submit separate requests in the

HRIS.

While on leave, requests to change the end date of the leave must be submitted in writing to HumanResources at least four (4) weeks before the original return-to-work date.

Page 47

Benefits While on Maternity/Pregnancy and Parental Leave (BC and ON)

Since Maternity/Pregnancy and Parental leaves are protected under the provincial ESA, you maintainmost of your benefits as if you were still actively working.

Benefit What happens while on leave

Extended Health and Dental No change

Insured Benefits (Life No change – except you will need to provide monthly post-datedinsurance, STD, LTD, AD&D) checks to cover premiums that normally would be deducted from

payroll

Healthcare Spending Account No change

Group RRSP No change – Fortinet will continue to match your contributions butyou need to provide monthly post-dated checks to cover yourcontributions that normally would be deducted from payroll

Employee and Family No change

Assistance Program (EFAP)

Stock Award Vesting No change

PTO You will not accrue any paid PTO while on leave but you do accrueunpaid PTO at the same rate that can be used when you return

from leave

Employee Stock Purchase This benefit will stop and contributions that you have made for thisProgram (ESPP) contribution period will be applied to the next purchase, and youwill be eligible to continue on the program when you return from

your leave

Parking (BC employees) You must give us 30 days’ notice if you want to cancel your parking

while on leave

Bereavement Leave (BC and ON)

Upon the death of a member of an employee’s immediate family, an employee is entitled up to three(3) days of paid leave for grieving. An additional two (2) days of paid leave is granted to employeeswho must travel out-of-province to attend memorial services.

Immediate family is defined as the employee’s:

 Spouse/partner/Parents/Guardian, including parents/guardian of your spouse/partner Grandparents of the employee and spouse Grandchildren of the employee and spouse

 Siblings

 Birth, Adopted, and Step Children

 Children’s spouses

All bereavement leave requests must be submitted in the Human Resources Information System for

approvals.

The final decision to any exceptions will be made by Human Resources.

Page 48

Jury and Witness Duty (BC and ON)

If an employee is required to attend court as a juror or witness, Fortinet will grant up to two (2) weeks(10 days) of paid leave so employees can fulfill their jury or witness responsibilities as a Canadian

citizen.

If jury or witness duty goes beyond two (2) weeks in a calendar year, it will be unpaid leave.

An employee must report to work on days or parts of days when he/she is not required to serve in

court.

Fortinet will continue to provide health insurance benefits as well as PTO accrual and stock vestingfor the full term of the jury and witness duty absence for up to thirty (30) days.

All jury and witness duty leave requests must be submitted in the Human Resources InformationSystem for approvals. Human Resources reserve the right to request an employee to provide proof of

jury or witness duty.

Reservists’ Leave (BC and ON)

An employee who is a reservist is entitled to unpaid leave for the prescribed period or, if no period is

prescribed, for as long as

(a) the employee is deployed to a Canadian Forces operation outside Canada or is engaged, eitherinside or outside Canada, in a pre-deployment or post-deployment activity required by theCanadian Forces in connection with such an operation,(b) the employee is deployed to a Canadian Forces operation inside Canada that is or will beproviding assistance in dealing with an emergency or with its aftermath, or

(c) the prescribed circumstances apply.

A request for leave must

(a) be in writing,

(b) be given to the employer,

i) at least 4 weeks before the employee proposes to begin leave or,ii) if the employee receives notice of the deployment less than 4 weeks before it will begin, assoon as practicable after the employee receives the notice, oriii) within the prescribed period if the prescribed circumstances apply

All reservists’ leave requests must be submitted in the Human Resources Information System forapprovals. Human Resources reserve the right to request an employee to provide informationregarding the request for reservists’ leave.

While on leave, all health and dental benefit coverage will continue. The employee will need to providepost-dated cheques for any benefit/RRSP contributions normally made by the employee via payroll

deductions.

"Canadian Forces" has the same meaning as in section 14 of the National Defence Act (Canada);"reservist" means a member of the reserve force, as defined in section 2 (1) of the National Defence

Act (Canada).

Unpaid Time off Due to Injury or Illness (BC and ON)

Page 49

If you are injured or ill and unable to work, you may take unpaid time off to recover.Illness – If you take more than 3 unpaid days due to illness, we may ask for a doctor’s note. If youwere on unpaid time off due to illness for more than 7 days, please come speak to HR as you mayqualify for reimbursement of lost wages through various programs, depending on the nature of your

illness.

Injury – if you are injured (personal or work related) and cannot work, please speak to HR immediately.If your unpaid leave is 30 days or less, you will maintain most of your benefits as if you were stillactively working, as per below. If your unpaid leave is longer than 30 days, you will need to provide adoctor’s note in order to maintain the benefits noted below, with the exception for PTO accrual andStock Award Vesting, which ends after 30 days of unpaid leave.

Benefit What happens while on leave

Extended Health and Dental No change

No change – except if your leave is longer than 30 days, you will

Insured Benefits (Life insurance,

need to provide monthly post-dated checks to cover premiums that

STD, LTD, AD&D)

normally would be deducted from payroll

Healthcare Spending Account No change

No change – Fortinet will continue to match your contributions, but ifyour leave is longer than 30 days, you need to provide monthly post-

Group RRSP

dated checks to cover your contributions that normally would be

deducted from payroll

Employee and Family

No change

Assistance Program (EFAP)

No change to regular vesting schedule - except if your leave is longer

Stock Award Vesting

than 30 days, then stock award vesting stops

No change – except if your leave is longer than 30 days, then PTO

PTO accrual stops

Benefit What happens while on leave

This benefit will stop and contributions that you have made for thisEmployee Stock Purchase contribution period will be applied to the next purchase, and you willProgram (ESPP) be eligible to continue on the program when you return from your

leave

You must give us 30 days’ notice if you want to cancel your parking

Parking (BC employees)

while on leave

Unpaid Personal Leave of Absences (BC and ON)

Page 50

Employees approved to go on an unpaid personal leave of absence for more than 30 days will notaccrue PTO, benefits, or stock vesting effective from day 31 of their leave .

Requests for unpaid personal leaves of over two weeks in a period of six months must be submittedin the HR Information System for tracking time off for approval at least four (4) weeks before the

expected start date of the leave.

Note that approvals from both management and Human Resources are needed for all unpaid personalleave of absences and employees are not guaranteed the time off.

Page 51

BC-Specific Leaves

Compassionate Care Leave

An employee can take up to eight (8) weeks of unpaid leave within a 26 week period to care for or

support a gravely ill family member.

“Family member” means someone who is:

 in relation to an employee:

o a member of an employee’s immediate family*;o an employee’s step-sibling, aunt or uncle, niece or nephew;o a current or former foster parent, foster child, ward or guardian; oro the spouse of an employee’s sibling or step-sibling, child or step-child, grandparent,grandchild, aunt or uncle, niece or nephew, current or former foster child or guardian.

 in relation to an employee’s spouse:

o a parent or step-parent, sibling or step-sibling, child, grandparent, grandchild, aunt oruncle, niece or nephew, current or former foster parent, or current or former ward;

and

 anyone who is considered to be like a close relative regardless or whether or not they arerelated by blood, adoption, marriage or common law partnership.

A medical certification stating that the family member is gravely ill or proof of approved EI applicationfor compassionate care leave is required within 2 weeks of starting the leave. All compassionatecare leave requests must be submitted in the online time off tracking system for approvals as soon

as possible.

While on leave, all health and dental benefit coverage will continue. The employee will need to providepost-dated cheques for any benefit/RRSP contributions normally made by the employee via payroll

deductions.

While on compassionate care leave, employees are entitled to receive Employment Insurance fromthe government. Please visit the Government of Canada website for more information or contact

Human Resources.

Family Responsibility Leave

An employee is entitled to up to 5 days of unpaid leave during each employment year to meet

responsibility related to:

b) the care, health or education of a child in the employee's care, orc) the care or health of any other member of the employee's immediate family.

"immediate family" means

(a) the spouse, child, parent, guardian, sibling, grandchild or grandparent of an employee, and(b) any person who lives with an employee as a member of the employee's family;

Page 52

Ontario-Specific Leaves

Personal Emergency Leave

Personal emergency leave is job-protected time off work for up to 10 days per calendar year. Thefirst two days of personal emergency leave will be paid if the employee has been employed forone week or longer. This leave may be taken for personal illness, injury or medical emergency. Itcan also be taken for the death, illness, injury, or medical emergency of, or urgent matter relating

to, the following family members:

 your spouse

 a parent, step-parent, foster parent, child, step-child, foster child, grandparent, step-grandparent, grandchild or step-grandchild of you or your spouse

 the spouse of your child

 your brother or sister

 a relative who is dependent on you for care or assistance.

Family Caregiver Leave

Family caregiver leave is unpaid, job-protected time off work to provide care or support to specifiedfamily members who have a serious medical condition. Family caregiver leave may be taken for any

of the following family members:

 your spouse

 a parent, step-parent, foster parent, child, step-child, foster child, grandparent, step-grandparent, grandchild or step-grandchild of you or your spouse

 the spouse of your child

 your brother or sister

 a relative who is dependent on you for care or assistance.Family caregiver leave can be up to eight weeks per calendar year with respect to each specifiedfamily member. The eight weeks do not have to be taken consecutively.

Medical certificate

You are eligible to take family caregiver leave if an individual who is qualified to practice as aphysician, registered nurse or psychologist issues a certificate stating that the family member hasa serious medical condition, which may include a condition that is chronic or episodic.

The medical certificate must name the individual and state that he or she has a serious medicalcondition. There is no requirement that the certificate specify what the medical condition is; but itmust state that it is “serious.” It is for the patient’s qualified health practitioner to make anassessment as to whether his or her medical condition is “serious.”If the medical certificate sets out a period during which the individual will have a serious medicalcondition, the certificate will support absences as family caregiver leave during that period. If noperiod is set out, the certificate will support absences as family caregiver leave from the date it is

Page 53

issued until the end of the calendar year in which it is issued. You must provide Human Resourceswith a copy of the certificate, if requested. You are responsible for obtaining and paying the costs

(if any) of obtaining the certificate.

Family Medical Leave

Family medical leave is unpaid, job-protected time off work to provide care or support to certainspecified individuals who have a serious medical condition with a significant risk of dying within 26weeks. Family medical leave may be taken for any of the following individuals:

 your spouse

 your parent, step-parent or foster parent your brother, step-brother, brother-in-law, step-brother-in-law, sister, step-sister, sister-in-law

or step-sister-in-law

 a child, step-child, foster child, son-in-law or daughter-in-law of you or your spouse a grandparent, step-grandparent, grandchild or step-grandchild of you or your spouse your father-in-law, step-father-in-law, mother-in-law or step-mother-in-law an uncle, aunt, nephew or niece of you or your spouse the spouse of your grandchild, uncle, aunt, nephew or niece

 your spouse’s foster parent

 any other person who considers you to be like a family memberYou may take family medical leave for up to 28 weeks in a 52-week period with respect to eachspecified individual. The 28 weeks of family medical leave do not have to be taken consecutively.If two or more employees in Ontario take the leave to care for the same person, the 28 weeks must

be shared.

Medical certificate and attestation form

For you to be entitled to family medical leave, a medical doctor or a nurse practitioner must issuea certificate stating that the individual has a serious medical condition with a significant risk ofdeath within 26 weeks. You must provide Human Resources with a copy of the certificate, ifrequested. You are responsible for obtaining and paying the costs (if any) of obtaining the

certificate.

If you take leave for a person who considers you to be like a family member, you must also giveyour employer, upon request, a copy of a completed Compassionate Care Benefits Attestationform, in which it states that you are considered to be like a family member.

Critical Illness Leave

Critical illness leave is unpaid, job-protected time off work to provide care or support to a criticallyill minor child or adult who is a family member. You must be employed by Fortinet for at least six

Page 54

consecutive months to be eligible for this leave. A “minor child” is someone who is under 18

years of age.

“Critically ill” means that a person’s baseline state of health has significantly changed and their lifeis at risk as a result of an illness or injury.

A “family member” includes any of the following:

 your spouse

 your parent, step-parent or foster parent your brother, step-brother, brother-in-law, step-brother-in-law, sister, step-sister, sister-in-law

or step-sister-in-law

 a child, step-child, foster child, son-in-law or daughter-in-law of you or your spouse a grandparent, step-grandparent, grandchild or step-grandchild of you or your spouse your father-in-law, step-father-in-law, mother-in-law or step-mother-in-law an uncle, aunt, nephew or niece of you or your spouse the spouse of your grandchild, uncle, aunt, nephew or niece

 your spouse’s foster parent

 any other person who considers you to be like a family memberCritical illness leave taken to care for a minor child can be up to 37 weeks in a 52-week period.Critical illness leave taken to care for an adult can be up to 17 weeks in a 52-week period.

If the minor child or adult remains critically ill after the end of the 52-week period, you may beeligible for additional leaves of up to 17 or 37 weeks in subsequent 52-week periods. The weeksof leave do not have to be taken consecutively.

Medical certificate

The leave is available to you if an individual who is qualified to practice as a physician, registered

nurse or psychologist:

 issues a certificate stating that a minor child or adult is critically ill and requires the care orsupport of one or more family members, and sets out the period during which the minor child or adult requires the care or support.You must provide Human Resources with a copy of the certificate, if requested. You areresponsible for obtaining and paying the costs (if any) of obtaining the certificate.

Organ Donor Leave

Organ donor leave is unpaid, job-protected leave for the purpose of undergoing surgery to donatean organ to a person. Organ donor leave can be taken to undergo surgery to donate all or part ofone of the following organs to a person: kidney, liver, lung, pancreas, small bowel.

Page 55

Generally speaking, you may take leave for up to 13 weeks. However, you may extend the leavefor up to an additional 13 weeks, if you are not yet able to perform the duties of your job becauseof the organ donation. To extend the leave, you must get a certificate from a legally qualifiedmedical practitioner stating that you are not yet able to perform the duties of your job because ofthe organ donation, and will be unable to do so for a specified period of time. The leave may beextended more than once, but the total period of extension cannot be more than 13 weeks.Therefore, the maximum leave period is 26 weeks.

Child Death Leave

Crime-related child death or disappearance leave is available to employees whose child dies ordisappears and it is probable, considering the circumstances that it resulted from a crime. Youmust have been employed by Fortinet for at least six consecutive months to be eligible for thisleave. You are not entitled to the leave if you are charged with the crime or if it is probable,considering the circumstances, that your child was a party to the crime.

An employee may take a leave of up to 104 weeks with respect to the death of a child and up to52 weeks with respect to the disappearance of a child. Employees must inform their employers inwriting that they will take this leave, and provide a written plan indicating the weeks in which theleave will be taken. In most cases, an employee must take the leave in a single period.

Crime-Related Child Disappearance Leave

Crime-related child disappearance leave is available to employees whose child disappears and itis probable, considering the circumstances that it resulted from a crime. You must have beenemployed by Fortinet for at least six consecutive months to be eligible for this leave. You are notentitled to the leave if you are charged with the crime or if it is probable, considering thecircumstances, that your child was a party to the crime.

An employee may take a leave of up to 104 weeks for the disappearance of a child. Employeesmust inform their employers in writing that they will take this leave, and provide a written planindicating the weeks in which the leave will be taken. An employee must take the leave in a single

period.

Page 56

Domestic or Sexual Violence Leave

If an employee or an employee’s child has experienced or been threatened with domestic orsexual violence, the employee is entitled to take a leave for particular purposes. To qualify, youmust have been employed by Fortinet for at least 13 weeks before the start of the leave. Theleave may only be taken for a reason relating to the violence or threat of violence against theemployee or the employee’s child, including:

 seeking medical attention for a physical or mental injury or disability caused by the violence obtaining services from a victim services organization receiving psychological or other professional counselling relocating, either temporarily or permanently seeking legal or law enforcement assistance, including participation in a criminal or civil trialAn employee may not take the leave if the act(s) of domestic or sexual violence were committed

by the employee.

An employee may take up to 10 days and/or 15 weeks of leave within a calendar year for thedefined purposes. Fortinet can count part of a day taken off as a full day or part of a week as a full

week.

The first five days of the leave taken within a calendar year will be paid, and the rest are unpaid.

Page 57

Who to Contact

If you have questions about any of the policies in this handbook, please feel free to reach out to your

Human Resources Business Partner.

You can also find a lot of valuable information Online on the Fuse: https://fuse.fortinet.com/hr-canada

Page 58