Apply for FCC Funding to Improve Your Cybersecurity

New details have been released regarding the FCC Cybersecurity Pilot Program application process. The application window opens on September 17, 2024, and requires both a general overview and detailed cybersecurity information in a two-part application.

The Federal Communications Commission (FCC) released a public notice announcing the Cybersecurity Pilot Program application filing window for K-12 Schools and Libraries.

The Application Window
Opens: Tuesday, September 17, 2024, at 8am EST
Closes: Friday, November 1, 2024, at 11:59pm EST

Filling Out FCC Form 484 Application Information

The application window will open on Tuesday, September 17, 2024, at 8am EST, and close on Friday, November 1, 2024, at 11:59pm EST.

Part One Application Information

For the first part of the FCC Form 484 application, we direct the Bureau and USAC to collect a general level of cybersecurity information from schools, libraries, and consortia that apply to participate in the Pilot Program. At a minimum, applications to participate in the Pilot Program must contain the following required information:

• Names, entity numbers, FCC registration numbers, employer identification numbers, addresses, and telephone numbers for all schools, libraries, and consortium members that will participate in the proposed Pilot project, including the identity of the consortium leader for any proposals involving consortia.

• Contact information for the individual(s) who will be responsible for the management and operation of the proposed Pilot project (name, title or position, telephone number, mailing address, and email address).

• Applicant number(s) and type(s) (e.g., school; school district; library; library system; consortia; Tribal school or library (and Tribal affiliation)), if applicable; and current E-Rate participation status and discount percentage, if applicable.

• A broad description of the proposed Pilot project, including, but not limited to, a description of the applicant’s goals and objectives for the proposed Pilot project, a description of how Pilot funding will be used for the proposed project, and the cybersecurity risks the proposed Pilot project will prevent or address.

• The cybersecurity equipment and services the applicant plans to request as part of its proposed project, the ability of the project to be self-sustaining once established, and whether the applicant has a cybersecurity officer or other senior-level staff member designated to be the cybersecurity officer for its Pilot project.

• Whether the applicant has previous experience implementing cybersecurity protections or measures (answered on a yes/no basis), how many years of prior experience the applicant has (answered by choosing from a preset menu of time ranges (e.g., 1 to 3 years)), whether the applicant has experienced a cybersecurity incident within a year of the date of its application (answered on a yes/no basis), and information about the applicant’s participation or planned participation in cybersecurity collaboration and/or information-sharing groups.

• Whether the applicant has implemented, or begun implementing, any Education Department or CISA best practices recommendations (answered on a yes/no basis), a description of any Education Department or CISA free or low-cost cybersecurity resources that an applicant currently utilizes or plans to utilize, or an explanation of what is preventing an applicant from utilizing these available resources.

• An estimate of the total costs for the proposed Pilot project, information about how the applicant will cover the non-discount share of costs for the Pilot-eligible services, and information about other cybersecurity funding the applicant receives, or expects to receive, from other federal, state, local, or Tribal programs or sources.

• Whether any of the ineligible services and equipment the applicant will purchase with its own resources to support the eligible cybersecurity equipment and services it plans to purchase with Pilot funding will have any ancillary capabilities that will allow it to capture data on cybersecurity threats and attacks, any free or low-cost cybersecurity resources that the applicant will require service providers to include in their bids, and whether the applicant will require its selected service provider(s) to capture and measure cost-effectiveness and cyber awareness/readiness data.

• A description of the applicant’s proposed metrics for the Pilot project, how they align with the applicant’s cybersecurity goals, how those metrics will be collected, and whether the applicant is prepared to share and report its cybersecurity metrics as part of the Pilot Program.

Complete details can be found here.

The Federal Communications Commission (FCC) released a public notice announcing the Cybersecurity Pilot Program application filing window for K-12 Schools and Libraries.

The Application Window
Opens: Tuesday, September 17, 2024, at 8am EST
Closes: Friday, November 1, 2024, at 11:59pm EST

The three-year, $200million program aims to support K-12 schools, libraries, and consortia in enhancing their cybersecurity infrastructure by providing funding for eligible cybersecurity services and equipment.

Important highlights include:

• Application Process: Interested schools, libraries, and consortia must submit Part 1 of the Form 484 to provide basic information about their cybersecurity needs and plans.
• Eligibility: The program is open to all schools and libraries that meet the E-rate Program’s eligibility requirements, including those that have not previously participated in the E-rate Program.
• Budget: The program offers up to $13.60 per student annually for schools and $15,000 per library annually, with funding caps based on the size of the applicant institution.
• Eligible Services and Equipment: Funding can be used for advanced firewalls, endpoint protection, identity protection, and other cybersecurity measures. Some items, such as basic firewalls and certain staff salaries, are ineligible.
• Application Requirements: Prospective applicants must have an FCC Registration Number, a Billed Entity Number, and be registered with SAM.gov. They must also ensure they are in good financial standing with the federal government.
• Evaluation and Selection: Applications will be evaluated based on various criteria, including the applicant’s cybersecurity needs and the ability to meet program objectives.

The FCC’s Public Notice can be viewed here.

USAC conducted a webinar last week to preview the first form — FCC Form 484 Part 1 — to be used by schools and libraries seeking to participate in the Cybersecurity Pilot Program.  As previously discussed, Part 1 of the Form 484 will be used to review prospective participants in the Pilot.  From that review, the FCC will select what we expect to be a much smaller number of applicants to participate in the program itself by filing the next three forms:  Form 484 Part 2, and Pilot versions of the Form 470 and Form 471.

For those schools and libraries who might have thought that Form 484 Part 1 would be used to simply express their interest in the Cyber Pilot, last week’s webinar was a revelation.  The successful completion of Form 484 Part 1 will require a thorough understanding of cybersecurity and a well-thought-out plan for participation in the Pilot.

We strongly recommend that any potential Pilot participant watch — or even re-watch — last week’s webinar (see online recording and slides). The slides have information that will help in preparing Form 84 Part 1. A summary of the key points is provided below.

• Access to the Pilot Program and its forms will be via a new section in EPC, much like the sections currently in EPC for E-rate and ECF.  The Pilot section will become available today (see USAC Newsletter discussed below).  The Form 484 Part 1 will not be available until the FCC announces the opening of the Form 484 Part 1 window this “fall.”  Basic information for existing E-rate applicants will be pre-populated into the Pilot section.
• Consultants will see the Pilot section in their EPC accounts but will not have access into their clients’ Pilot accounts unless proactively granted access by those clients.
• Once into the Pilot section, a user can start a Form 484 Part 1 by clicking the “waffle” in the upper righthand corner of the home screen (see red arrow).
  

• The Form 484 Part 1 itself will require:
  • A project summary is limited to 5,000 characters; longer summaries can be uploaded as an attachment.
  • Identification of services and equipment proposed to be purchased.
  • Description of how Pilot funding will be used to protect the network, again limited to 5,000 characters and/or an upload.
  • List of cybersecurity risks to be addressed.
  • Selection of primary area of focus.
  • Selection (from a list) of goals and objectives.
  • Yes/no questions focusing on best practices of national cybersecurity recommendations by CISA (Cybersecurity and Infrastructure Security Agency), NIST (National Institute of Standards and Technology), and the U.S. Department of Education.
  • Yes/no questions on cybersecurity expertise and other sources of funding.
  • Yes/no questions on cybersecurity incidents and implementation of best practices.
  • Yes/no questions on staffing and use of other free or low-cost cybersecurity resources.
  • Estimated costs and access to funding to cover non-discounted costs.*
  • Yes/no questions on metrics to evaluate Pilot Program outcomes.
• Based on a review of the Form 484 Part 1 submissions, the FCC will select a subset of applicants to move forward in the actual Pilot.  Unstated in the webinar, but implicit in the information requested in Form 484 Part 1, is that selection to continue further in the Pilot will depend critically on an applicant’s answers to the requirements listed above.
• As a separate objective for selection, the FCC indicated that it would seek to include “a diverse set of Pilot Program projects and to target Pilot Program funds to the populations most in need of cybersecurity support, the FCC will award support to a combination of large and small and urban and rural schools, libraries, and consortia, with an emphasis on funding proposed Pilot projects that include low-income and Tribal applicants.”  Diversity aside, it appears that only higher discount rate applicants are likely to be chosen.

One other point that was clarified during the Q&A sections of the webinar dealt with consortium applications.  As applicant information is carried over from the E-rate portion of EPC into the Pilot portion, all members of an E-rate consortium will be included with that consortium.  If an E‐rate consortium plans to file a Pilot application, not all the consortium members need to be included.  However, the Form 484 Part 1 must clarify which members are to be included and which members are not.  Alternatively, the participating members may create a new consortium and apply for a new consortium BEN.  Members of a Pilot consortium cannot also apply as individual Pilot applicants.