Cybersecurity Pilot Program

As broadband connectivity and Internet access have become essential for K-12 students and adults, the security and safety of networks and data has become of vital importance. Although broadband connectivity and Internet access can simplify and enhanc

The Pilot Program is a three-year program established to provide up to $200 million in universal service funds to help selected schools and libraries defray the costs of protecting their broadband networks and data, and allow the Commission to explore how it can contribute to addressing the cybersecurity needs of K-12 schools and libraries in an ongoing manner.

Schools must meet the statutory definition of elementary and secondary schools as defined in 20 U.S.C. § 7801(18) and 20 U.S.C. § 7801(38). Libraries must meet the statutory definition of library or library consortium found in the Library Services and Technology Act (LSTA) under 20 U.S.C. § 9122, and must be eligible for assistance from a state library administrative agency under that Act. In 2021, the Commission modified its definition of library to include Tribal libraries, clarifying that Tribal libraries are eligible for support. Schools and libraries may not operate as for-profit businesses. Schools with endowments exceeding $50,000,000 are also not eligible.

Beneficiary eligibility is the same as Pilot participant eligibility. Elementary and secondary public and private schools; public, academic, research, and private libraries; consortia of eligible schools and libraries.

For the information collections required under the Pilot Program, the FCC has received approval from the Office of Management and Budget (OMB) for a new information collection entitled Schools and Libraries Cybersecurity Pilot Program (OMB Control No. 3060-1323) on September 13, 2024. The information collection will expire on September 30, 2027, if not renewed. The following forms are required for selected Pilot participants: Schools and Libraries Cybersecurity Pilot Program Application (FCC Form 484 - Cybersecurity); Schools and Libraries Cybersecurity Pilot Program FCC Form 470 Description of Services Requested and Certification (FCC Form 470 - Cybersecurity); Schools and Libraries Cybersecurity Pilot Program FCC Form 471 Services Ordered and Certification (FCC Form 471 - Cybersecurity); Schools and Libraries Cybersecurity Pilot Program FCC Forms 472 or 474 Request for Reimbursement (FCC Forms 472/474 - Cybersecurity); and Schools and Libraries Cybersecurity Pilot Program FCC Form 488 Post-Commitment Change Request (FCC Form 488 - Cybersecurity). Interested schools, libraries, and consortia of schools and libraries applied to participate in the Pilot Program from September 17, 2024 through November 1, 2024, by filing the first part of an application form (Pilot FCC Form 484). The first part of the FCC Form 484 application includes questions about applicants' cybersecurity experience; information about their proposed Pilot projects, including a description of the cybersecurity goals and objectives to be achieved; the cybersecurity services and equipment to be purchased (and associated costs); and the cybersecurity risks their proposed Pilot projects would prevent or address. Applicants are also required to complete certifications. Applicants who are selected as Pilot participants will be required to provide more detailed cybersecurity information in the second part of the FCC Form 484 application, including management of cybersecurity risks; history of cyber threats and attacks within the most recent year; cybersecurity training; and cybersecurity challenges faced. The submission of the second part of the FCC Form 484 application will be required to be filed at the same time the Cybersecurity FCC Form 471 is submitted during application filing window. The Commission will make announcement of the selected Pilot participants and timing for the Pilot Program forms in a forthcoming Public Notice. The following subparts of 2 CFR § 200 apply to this program. Subpart A - Acronyms and Definitions, Subpart B - General Provisions, Subparts C-D (specifically only 2 CFR § 200.203 - Requirement to provide public notice of Federal financial assistance programs; 2 CFR § 200.303 Internal controls; and 2 CFR §§ 200.331-333 Subrecipient Monitoring and Management).

Pilot Program participants will receive a fixed per-student or per-library site budget and are required to pay the non-discount share of costs of the eligible equipment/services. Schools receive an annual, pre-discount budget of $13.60 per student, with a $15,000 minimum (for schools with 1,100 students or fewer) and up to the $1.5 million maximum annual funding cap. Libraries receive an annual, pre-discount amount of $15,000 per library site (up to 11 sites), with a $175,000 maximum (for 12 or more sites). Consortia budgets are calculated based on the school and library budgets within the consortium up to the maximum, annual funding cap of $1.5 million (for schools) and $175,000 (for libraries). The budgets provided to each Pilot participant will be based on three years and can be used as the expenses are incurred during the three years, up to the maximum budget amount. Pilot participants will receive discounts that will range from 20 to 90 percent of the costs of eligible equipment and/or services. Pilot Program participants will be eligible to seek reimbursement for a wide variety of cybersecurity services and equipment, subject to the $200 million overall Pilot Program limit and their individual budget caps. The broad categories of eligible services and equipment include: Advanced/Next Generation Firewalls; Endpoint Protection; Identity Protection and Authentication; and Monitoring, Detection, and Response. For a complete list of eligible services and equipment, visit https://www.fcc.gov/cybersecurity-pilot/cybersecurity-pilot-eligible-services-list.

The FCC Form 484 application filing window to participate in the Pilot Program opened September 17, 2024 and closed on November 1, 2024. Pilot participants are expected to be selected by the Commission in early 2025. Selected Pilot participants will be required to undergo a competitive bidding process before submitting their requests for funding and reimbursement requests to the Universal Service Administrative Company (USAC) (Administrator of the Pilot Program), for Pilot-eligible cybersecurity equipment and services. Requests for funding will be reviewed USAC and final funding commitments made based on eligibility of equipment and services requested before funding is disbursed to Pilot participants or their service providers. Funding is awarded directly to Pilot participants through a funding commitment decision letter (FCDL). Pilot participants and their service providers will seek reimbursement from USAC by submitting requests for reimbursement (i.e., invoices) as the eligible, approved, equipment and services are received/delivered. Funding is available to Pilot participants for three years beginning from the date of the first funding commitment decision letter. The invoice filing deadline is 90 days after the last date to receive service (which will be three years from the date of the first commitment decision letter for a funding request).

As described above, applicants were required to provide general information about the schools, libraries, and consortia seeking support on the first part of the FCC Form 484), including information about applicants' cybersecurity experience; their proposed Pilot projects, including a description of the cybersecurity goals and objectives to be achieved; the cybersecurity services and equipment to be purchased (and associated costs); and the cybersecurity risks their proposed Pilot projects would prevent or address. If selected to participate in the Pilot Program, applicants will be required to provide more detailed cybersecurity information on the second part of the FCC Form 484, such as information regarding management of cybersecurity risks; history of cyber threats and attacks within the most recent year; cybersecurity training; and cybersecurity challenges faced. Participants selected for the Pilot Program are required to conduct competitive bidding on the eligible cybersecurity equipment and services the participants plan to use to implement their cybersecurity Pilot Program projects using a Pilot FCC Form 470. They will also need to submit the second part of the Pilot FCC Form 484, as discussed above, and their Pilot FCC Form(s) 471 to seek approval for the cybersecurity equipment and services for which they plan to seek funding. After the competitive bidding process is complete, the second part of their Pilot FCC Form 484 is submitted, their Pilot FCC Form(s) 471 have been reviewed, and USAC has issued funding commitment decision letters, Pilot participants and their service providers may seek reimbursement for the eligible cybersecurity equipment and services by submitting the relevant request for reimbursement forms (Pilot FCC Forms 472 and 474) to USAC. Requests for reimbursement forms may not be submitted to USAC until the requested equipment and services have been delivered or received. Pilot participants are not allowed to seek reimbursement from US

Selection of Pilot participation begins with reviewing the first part of the Pilot FCC Form 484 and determining if an applicant is eligible to participate in the Pilot. When selecting participants, the goal for the Pilot Program is to facilitate the inclusion of a diverse set of Pilot projects and participants, and to target Pilot funds to the neediest populations most in need of cybersecurity support. To this end, it is anticipated that the Pilot Program will include a combination of large and small and urban and rural schools, libraries, and consortia, with an emphasis on funding proposed Pilot projects that include low-income and Tribal applicants. Prioritization will be performed in accordance with 47 CFR § 54.2001(d). Participants who are selected to participate in the Pilot Program based on the first part of their Pilot FCC Form 484, after complying with the competitive bidding requirements and completing the second part of the FCC Form 484, will be permitted to seek funding commitments and reimbursement for Pilot-eligible cybersecurity equipment and services.

Applicants will receive notification if they have been selected for the Pilot and the Commission will announce selected Pilot participants in a Public Notice in early 2025. Once Pilot participants have conducted competitive bidding, they will then be required to submit the second part of the Pilot FCC Form 484, and seek approval for the requested cybersecurity equipment and services by submitting the Pilot FCC Form 471. Once the Pilot FCC Form 471 has been reviewed and approved, the Pilot participant will receive a funding commitment decision letter (FCDL) notifying them of the committed funding amount they are eligible to receive for the approved, eligible equipment and services. USAC reviews each funding request to ensure compliance with program rules and procedures. The competitive bidding, program application and other required program processes described herein are governed by the FCC's rules at 47 CFR §§ 54.2000 et. seq. and associated FCC orders for the Schools and Libraries Cybersecurity Pilot Program.

The application filing window to submit the first part of the FCC Form 484 to participate in the Cybersecurity Pilot Program ran from September 17, 2024 to November 1, 2024. Once the FCC selects the Pilot participants, those participants will need to submit additional information using the second part of the Pilot FCC Form 484, and the Pilot FCC Forms 470 and 471. Additional detail on the selected Pilot participants and the upcoming deadlines for FCC forms will announced by the Commission in a forthcoming Public Notice, and will be made available on the FCC's website at https://www.fcc.gov/cybersecurity-pilot-program.

The selection window to participate in the Pilot program ran from September 17, 2024 to November 1, 2024. Pilot participants will be selected in early 2025. Funding will be approved on a rolling basis. Requests for reimbursement must be submitted to the Administrator within ninety (90) days of the last date to receive equipment or services (which will be set based on three years from the date of the first funding commitment decision letter for each funding request). See also 47 CFR § 54.2008(d).

An appeal of a decision issued by USAC or request for waiver of the Pilot Program rules must be filed within 30 days of the date of an action or decision by USAC.