Cybersecurity Pilot Program

As broadband connectivity and Internet access have become essential for K-12 students and adults, the security and safety of networks and data has become of vital importance. Although broadband connectivity and Internet access can simplify and enhance the education and daily lives of K-12 students, school staff, and library patrons, they can also be used by malicious actors to steal personal information, compromise online accounts, and cause online personal harm or embarrassment. In response to the growing importance of cybersecurity to broadband connectivity and Internet access for K-12 schools and libraries, and in light of the increase in cyberattacks to disrupt or disable these critical networks, the Federal Communications Commission (Commission or FCC) established the Schools and Libraries Cybersecurity pilot program (Pilot or Pilot Program), a three-year pilot program within the Universal Service Fund (USF or Fund) to provide up to $200 million to defray the costs of eligible cybersecurity services and equipment for schools, libraries, and consortia of schools and libraries. Eligible schools, libraries, and consortia comprised of schools and libraries selected to participate in the Pilot Program may request and receive support through the Pilot Program to purchase a wide range of eligible cybersecurity services and equipment that best suit their particular needs, subject to budget ceilings, budget floors and per-student and per-library multipliers. During this short-term Pilot Program, the Commission will gather key data on the types of cybersecurity services and equipment that K-12 schools and libraries need to protect their broadband networks and data, and ensure that students, school staff, and library patrons are able to connect to advanced communications that are integral to education. Data and information collected through this Pilot Program may also aid in the considerations of broader efforts across the government to help schools and libraries address their cybersecurity concerns.

Schools must meet the statutory definition of elementary and secondary schools as defined in 20 U.S.C. § 7801(18) and 20 U.S.C. § 7801(38). Libraries must meet the statutory definition of library or library consortium found in the Library Services and Technology Act (LSTA) under 20 U.S.C. § 9122, and must be eligible for assistance from a state library administrative agency under that Act. In 2021, the Commission modified its definition of library to include Tribal libraries, clarifying that Tribal libraries are eligible for support. Schools and libraries may not operate as for-profit businesses. Schools with endowments exceeding $50,000,000 are also not eligible.

Beneficiary eligibility is the same as Pilot participant eligibility. Elementary and secondary public and private schools; public, academic, research, and private libraries; consortia of eligible schools and libraries.

As described above, applicants were required to provide general information about the schools, libraries, and consortia seeking support on the first part of the FCC Form 484), including information about applicants’ cybersecurity experience; their proposed Pilot projects, including a description of the cybersecurity goals and objectives to be achieved; the cybersecurity services and equipment to be purchased (and associated costs); and the cybersecurity risks their proposed Pilot projects would prevent or address. If selected to participate in the Pilot Program, applicants will be required to provide more detailed cybersecurity information on the second part of the FCC Form 484, such as information regarding management of cybersecurity risks; history of cyber threats and attacks within the most recent year; cybersecurity training; and cybersecurity challenges faced.

Participants selected for the Pilot Program are required to conduct competitive bidding on the eligible cybersecurity equipment and services the participants plan to use to implement their cybersecurity Pilot Program projects using a Pilot FCC Form 470. They will also need to submit the second part of the Pilot FCC Form 484, as discussed above, and their Pilot FCC Form(s) 471 to seek approval for the cybersecurity equipment and services for which they plan to seek funding. After the competitive bidding process is complete, the second part of their Pilot FCC Form 484 is submitted, their Pilot FCC Form(s) 471 have been reviewed, and USAC has issued funding commitment decision letters, Pilot participants and their service providers may seek reimbursement for the eligible cybersecurity equipment and services by submitting the relevant request for reimbursement forms (Pilot FCC Forms 472 and 474) to USAC. Requests for reimbursement forms may not be submitted to USAC until the requested equipment and services have been delivered or received. Pilot participants are not allowed to seek reimbursement from US

Applicants will receive notification if they have been selected for the Pilot and the Commission will announce selected Pilot participants in a Public Notice in early 2025. Once Pilot participants have conducted competitive bidding, they will then be required to submit the second part of the Pilot FCC Form 484, and seek approval for the requested cybersecurity equipment and services by submitting the Pilot FCC Form 471. Once the Pilot FCC Form 471 has been reviewed and approved, the Pilot participant will receive a funding commitment decision letter (FCDL) notifying them of the committed funding amount they are eligible to receive for the approved, eligible equipment and services. USAC reviews each funding request to ensure compliance with program rules and procedures. The competitive bidding, program application and other required program processes described herein are governed by the FCC’s rules at 47 CFR §§ 54.2000 et. seq. and associated FCC orders for the Schools and Libraries Cybersecurity Pilot Program.

The selection window to participate in the Pilot program ran from September 17, 2024 to November 1, 2024. Pilot participants will be selected in early 2025. Funding will be approved on a rolling basis. Requests for reimbursement must be submitted to the Administrator within ninety (90) days of the last date to receive equipment or services (which will be set based on three years from the date of the first funding commitment decision letter for each funding request). See also 47 CFR § 54.2008(d).