The FCC has adopted a three-year pilot program that will disburse up to $200 million from the Universal Service Fund (USF) to schools and libraries seeking to cover eligible cybersecurity services and equipment. The pilot program will be funded separately from the Schools and Libraries E-rate program and will be open to eligible schools and libraries, including those that do not currently participate in the E-rate program.

Duration

The FCC acknowledged that many commenters in the proceeding advocated for a shorter pilot program duration; however, the FCC ultimately found a three-year period would be appropriate in order for the FCC to effectively measure the success of the program.

Budget

Schools and school districts will be eligible to receive up to $13.60 per student annually, on a pre-discount basis, with a funding floor set at a minimum of $15,000 annually and a maximum set at $1.5 million annually. Libraries will be funded with a pre-discount annual budget of $15,000 per library up to a maximum of $175,000 per system. Consortia comprised of a mixture of eligible schools and libraries will be eligible to receive pre-discounted funding up to $1.5 million annually. Pilot participants will be required to contribute a portion of the costs of the cybersecurity services and equipment based on their category one discount rate.

Eligible Services

The Eligible Services List for the pilot program consists of four categories:

• Advanced/next-generation firewalls. Defined as “equipment, services, or a combination of equipment and services that limits access between networks, excluding basic firewall services and components that are currently funded through the E-Rate program.” The FCC clarified that this definition includes services and equipment with features like intrusion detection and prevention, application-level inspection, anti-malware and anti-virus protection, VPN, Domain Name System (DNS) security, distributed denial-of-service (DDoS) protections, and content filtering technologies.

• Endpoint protection. Defined as “equipment, services, or a combination of equipment and services that implements safeguards to protect school- and library-owned end-user devices, including desktops, laptops, and mobile devices, against cybersecurity threats and attacks.” Anti-virus, anti-malware, and anti-ransomware services and equipment are included in this definition.

• Identity protection and authentication. Defined as “equipment, services, or a combination of equipment and services that implements safeguards to protect a user’s network identity from theft or misuse and/or provide assurance about the network identity of an entity interacting with a system.” Such safeguards may include DNS/DNS-layer security, content blocking and filtering/URL filtering, multi-factor authentication (MFA)/phishing-resistant MFA, single sign-on (SSO), and event logging.

• Monitoring, detection and response. Defined as “equipment, services, or a combination of equipment and services that monitor and/or detect threats to a network and that take responsive action to remediate or otherwise address those threats.” Such services may include the use of security operations centers (SOCs).

Application and Selection Process

USAC will be the administrator of the pilot program. Interested applicants will be required to submit a two-part FCC Form 484 application to USAC for review. The FCC will announce the effective date of the pilot program rules and the application filing window.