On June 11, 2024, the Federal Communications Commission (FCC) released an Order creating a limited cybersecurity pilot program for libraries and K-12 education, titled the Schools and Libraries Cybersecurity Pilot Program.[1] The goal of the Pilot Program is to provide funding for network security for libraries and K-12 schools in order to protect sensitive personal information and other data that is not otherwise covered under the FCC’s E-Rate program.[2]
The FCC plans to evaluate how Universal Service funds can successfully be applied for cybersecurity purposes within schools and libraries.[3] The goal is to learn how to most effectively use Universal Service funds to tackle the issue of cybersecurity attacks on libraries and K-12 schools through a three-year program.[4] The application process for the Pilot Program will open in fall 2024.[5]
1. Who is Eligible to Apply?
All schools, libraries, and consortia of schools and libraries that meet the E-Rate program’s eligibility requirements are eligible to apply, even if they are not E-Rate funding recipients.[6] Eligible schools include public and non-profit elementary and secondary schools, not to exceed grade twelve, including private schools if they do not have a large endowment and do not operate as a “for-profit” business.[7] Eligible libraries include public, academic, tribal, and research libraries.[8] Private libraries are only eligible to apply if the state determines that the library should be considered a library for purposes of this definition.[9] Eligible consortia of schools and libraries include “any local, statewide, regional, or interstate cooperative association of schools and/or libraries eligible for E-Rate support that seeks competitive bids for eligible services or funding for eligible services on behalf of some or all of its members.”[10] Lastly, Educational Service Agencies (ESAs), which includes Area Education Agencies (AEAs) within Iowa, are eligible to apply if they provide elementary or secondary education, as those terms are defined by state law.[11] Specifically, it must be verified that the ESA provides elementary education to its student population and whether the ESA facility provides elementary or secondary education, as defined by state law, at its facility.[12]
2. How Will Funding Be Allocated
The FCC has allocated $200 million over the three-year timeframe of the Pilot Program using E-Rate funds not expended in previous program years.[13] Schools, libraries, and consortia can obtain differing amounts of funding based on their student and/or library site/branch count.[14] Schools and school districts can receive up to $13.60 per student with a minimum of $15,000 and a maximum of $1.5 million.[15] Libraries and library systems can receive $15,000 per library for up to eleven library sites/branches, and library systems with more than eleven sites/branches are eligible for up to $175,000.[16] Consortia of schools and libraries are eligible for funding in the amounts stated previously for schools and libraries.[17] However, consortia solely comprised of schools are subject to a maximum of $1.5 million, while consortia solely comprised of libraries are subject to a maximum of $175,000.[18]
The above funding amounts are “pre-discount,” which is the price that the service provider agrees to accept as total payment for its telecommunications or information services.[19] “Pre-discount price” is the sum of the amount the service provider expects to receive from the eligible school or library and the amount it expects to receive as reimbursement from the universal service support fund (such as the Pilot Program).[20] Pilot Program recipients will use the E-Rate Program’s Category 1 discount matrix to determine the applicable discount, which is based on the number of students eligible for the National School Lunch Program (NSLP) in the school district in which the school or library is located.[21] The minimum discount participants can receive is twenty percent, and the maximum discount is ninety percent.[22] No Pilot Program recipient will receive one hundred percent (100%) reimbursement for the cybersecurity services/equipment that they request and receive.[23]
3. Eligible Services and Equipment
The FCC’s goal is to allow applicants to have the flexibility to determine which cybersecurity solutions best service their needs, hence a wide variety of network cybersecurity services and equipment are eligible under the Pilot Program.[24] In the Pilot Eligible Services List, the FCC specifies over seventy eligible cybersecurity tools and services that are divided into four categories: (1) Advanced/Next-Generation Firewalls, (2) Endpoint Protection, (3) Identity Protection, and (4) Authentication, Monitoring, Detection, and Response.[25] These may include services and equipment such as penetration testing, managed extended detection and response (MXDR), vulnerability scanning, and more.[26] Basic firewall services are not covered under this Pilot Program because they are covered with the E-Rate Program.[27] Other services and equipment that are ineligible under the Pilot Program include labor costs, consulting services unrelated to the installation and configuration of the eligible equipment and services, long-term planning and risk assessment surveys, insurance costs, and threat response exercises and training.[28] Lastly, the Pilot Program requires that recipients competitively bid for the services and equipment they require.[29]
4. Application Process
The first step to applying for the Pilot Program is for an applicant to complete a new form – Form 484 – which will be completed via the Universal Services Administrative Company (USAC) online application portal.[30] The form contains two parts – Part One is for the selection of Pilot Program participants and Part Two is for information requested of already-selected participants.[31] Part One of the application form requests basic information from applicants, such as name, address, and contact information.[32] It also requests a description of the applicant’s proposed Pilot project, the cybersecurity risks the project will address, and the cybersecurity equipment and services the applicant plans to request, along with a cost estimate.[33] Part Two of the application form asks selected recipients for detailed cybersecurity information, including current network vulnerabilities, any unauthorized network access, a cyber incident response plan, and more.[34]
The selection process for applicants will be driven by the FCC and USAC’s desire to include a variety of Pilot Program participants representing schools and libraries of all sizes and with a wide geographic range.[35] The selection process is also driven by the FCC and USAC’s goal to include applicants with a wide variety of cybersecurity experiences, including those who are “resource-challenged.”[36] Priority will also be given to applicants who are eligible for a ninety percent discount based on the E-Rate Category 1 discount matrix based on the NSLP.[37]
Lastly, once applicants have been selected, many of the rules and processes for the regular E-Rate program will apply, such as the twenty-eight (28) day competitive bidding requirement, a ten-year document retention requirement, participants being subject to audits, invoicing requirements, and abiding by the Children’s Internet Protection Act (CIPA).[38] However, one significant difference between the Pilot Program and the E-Rate program is that the Pilot Form 471 (the form that lists the services and equipment selected, the costs, and the selected service provider) will cover the applicant’s full Pilot costs for all three years of the program, instead of requiring annual applications like the E-Rate Program.[39]
5. What Prospective Applicants Should Do to Prepare for the Pilot Program
The application window for the Pilot Program will not open until fall 2024, and Form 484 will not be available until then.[40] However, prospective applicants can begin reviewing the information requested in Part One of the application and developing tentative answers.[41] This will put the prospective applicant ahead of the ball when the application opens in the fall.
ProCircular encourages potential applicants to contact us online today, give us a call at 844-95-SECUR (73287), or email us at sales@procircular.com and speak with one of our cybersecurity experts to learn more about the FCC’s Schools and Libraries Cybersecurity Pilot Program.
References
[1] Fed. Comm. Comm’n, Rep. and Ord. In the Matter of Schools and Libraries Cybersecurity Pilot Program 1 (June 11, 2024), https://www.fcc.gov/document/fcc-adopts-200m-cybersecurity-pilot-program-schools-libraries-0 [hereinafter Fed. comm. comm’n, rep. and ord.]; see also Am. Libr. Ass’n, Frequently Asked Questions on the FCC’s Order on the: Schools and Libraries Cybersecurity Pilot Program 1 (June 14, 2024), https://www.ala.org/sites/default/files/2024-06/ALA_FAQ_CybersecurityPilot_0.pdf.
[2] Fed. Comm. Comm’n, rep. and ord., supra note 1, at 3.
[3] Id. at 3; see also Schools and Libraries Cybersecurity Pilot Program, Fed. Comm. Comm’n (June 13, 2024), https://www.fcc.gov/cybersecurity-pilot-program.
[4] Fed. Comm. Comm’n, Statement of Chairwoman Jessica Rosenworcel (November 8, 2023), https://docs.fcc.gov/public/attachments/FCC-23-92A2.pdf; see also Am. Libr. Ass’n, supra note 1.
[5] Am. Libr. Ass’n, supra note 1.
[6] Fed. comm. comm’n, Rep. and Ord., supra note 1, at 20-21.
[7] 47 C.F.R. § 54.500 (2023); see also School and Library Eligibility, Universal Serv. Admin. Co., https://www.usac.org/e-rate/applicant-process/before-you-begin/school-and-library-eligibility/ (last visited July 11, 2024).
[8] 47 C.F.R. § 54.500 (2023).
[9] Id.
[10] Id.
[11] Fed. Comm. Comm’n, Rep. and Ord., supra note 1, at 20; see also Eligibility Table for Educational Service Agencies (ESAs), Universal Serv. Admin. Co. 1 (April 2024), https://www.usac.org/wp-content/uploads/e-rate/documents/Tools/ESA-Eligibility-Table.pdf.
[12] Fed. Comm. Comm’n, Rep. and Ord., supra note 1, at 20 n.119.
[13] Id. at 12-13.
[14] Id. at 14-16.
[15] Id. at 15-16.
[16] Id. at 16.
[17] Id.
[18] Fed. Comm. Comm’n, Rep. and Ord., supra note 1, at 16.
[19] 47 C.F.R. § 54.500 (2023).
[20] Id.
[21] Fed. comm. Comm’n, Rep. and Ord., supra note 1, at 17 n.94; see also Calculating Discounts, Universal Serv. Admin. Co., https://www.usac.org/e-rate/applicant-process/applying-for-discounts/calculating-discounts/#library-system (last visited July 11, 2024).
[22] Fed. Comm. Comm’n, Rep. and Ord., supra note 1, at 17; see also E-Rate – Schools & Libraries USF Program, Fed. Comm. Comm’n (July 1, 2024), https://www.fcc.gov/general/e-rate-schools-libraries-usf-program.
[23] Fed. Comm. Comm’n, Rep. and Ord., supra note 1, at 2-3.
[24] Id. at 22.
[25] Id. at 101-104.
[26] Id.
[27] Id. at 24.
[28] Id. at 103-104.
[29] Fed. Comm. comm’n, rep. and Ord., supra note 1, at 48-50.
[30] Id. at 33-35.
[31] Id.
[32] Id. at 35-37.
[33] Id.
[34] Id. at 45-46.
[35] Fed. comm. Comm’n, Rep. and ord., supra note 1, at 37.
[36] Id.
[37] Id. at 33-34.
[38] Id. at 48-50, 55-57.
[39] Id. at 51.
[40] Am. Libr. Ass’n, supra note 1, at 1.
[41] Id. at 2.