Last week, the FCC issued the final version of the Cybersecurity Pilot Report & Order (FCC 24-63). Much of the textual content of the final Order matched the initial draft Order that had been circulated earlier in May (see our newsletter of May 20th). Fortunately, as discussed below, there were some significant clarifications.* Unfortunately, many questions remain.
- Application Timing: Applying for the Cybersecurity Pilot is a four-step process involving the filing of four forms, including:
- Form 484 (Part 1) to express interest in participating in the Pilot.
- Applicants selected as potential participants will then file a more detailed Form 484 (Part 2) for acceptance into the Pilot.
- Funding for the three years of the program will require competitive bidding for equipment and services similar to E-rate utilizing a Pilot Form 470.
- Again, similar to E-rate, applications for funding must be filed utilizing a Pilot Form 471.
The timing of each step in the application process has been delegated to the FCC’s Wireline Competition Bureau. To start, as indicated in a brief USAC announcement last week, the initial application window for Form 484 (Part One) will open “this fall.” A footnote in the Order indicates that program deadlines for entrance into the program and for the first year of funding should not start until the 2024-2025 school year begins. Actual dates have not yet been announced but here is a possible and aggressive schedule that would meet the Order’s guidelines:
This would be a tight schedule, admittedly more aggressive than the traditional E-rate cycle, but one that would align the E-rate and Pilot Form 471 deadlines and would give USAC time to begin issuing Pilot FCDLs before the first Pilot funding year starts July 1, 2025.
Note that the initial Pilot Form 470/471 filings are meant to cover the entire three years of the program and will not be required annually for FY 2026 and FY 2027. Nevertheless, the Order does give the WCB authority to open additional application windows if the first window’s demand does not exceed available funds.
- Sept. 3-27: Form 484 (Part One) window.
- Nov. 1: USAC announces preliminary Pilot program participants.
- Nov. 4 - Dec. 5: Form 484 (Part Two) window.
- Jan. 3: USAC confirms final Pilot program participants.
- Jan. 6: Pilot Form 470s made available for filing.
- Feb. 3 - Mar. 28 Pilot Form 471 window.
It may be useful, when considering these budget caps, to contemplate what they might mean for the overall scope of the $200 million Pilot. In a worst-case scenario, the Pilot would support only about 50 large school or school/library consortia at 90% discounts. This is, of course, an extreme possibility. The calculations do suggest, however, that the applicant base for the Pilot can best be estimated in the low hundreds, not in the thousands. Schools and libraries interested in the Cybersecurity Pilot need to understand that funding will likely be competitive. Successful applicants will need to know what they are doing and have a well-thought-out cyber plan.
A footnote authorizes the Bureau to make determinations as to specific services or equipment that have “substantially similar features or [are] their equivalents.”
Products and services deemed ineligible include:
Once selected applicants have submitted their Pilot Form 471 applications, there appears to be at least two possibilities.
- Budget Caps: The final Order clarifies a confusing aspect of the draft Order establishing prediscount budget caps for schools, libraries, and consortia. The budget caps in the final Order are expressed as annual caps — preceded by an explanation that “participants’ expenses are capped based on the full three-year duration of the Pilot and participants may seek reimbursement for more than the annual budget for any given Pilot Program year, so long as the total amount disbursed over the three-year term does not exceed three times the applicable annual budget.” Effectively, therefore, participant budgets for the entire three-year program, although not expressed this way in the Order, will be as follows:
- Schools or districts with 1,100 students or less will have a three-year, prediscount budget of $45,000.
- Schools or districts with more than 1,100 students will have a three-year, prediscount budget of $40.80 per student up to a maximum of $4.5 million.
- Each eligible library/site will have a three-year, prediscount budget of $45,000 for up to 11 libraries/sites. Library systems with more than 11 libraries/sites less will have a three-year, prediscount budget of $525 thousand, regardless of the number of extra libraries/sites.
- The three-year, prediscount budgets for consortia will be governed by the limits indicated above. This means that the maximum budget would be $4.5 million for a school-only consortium; $525 thousand for a library-only consortium; and the school-based $4.5 million for a school and library consortium.
- Eligible Services: No changes were made in the final list of eligible cybersecurity products and services. As provided in Appendix B, the Eligible Services List is divided into the following four categories:
- Advanced/next-generation firewalls.
- Endpoint protection.
- Identity protection and authentication.
- Monitoring, detection, and response.
- Any services, equipment, and associated costs that are already eligible through the E-rate program.
- Equipment that is not “network-based” (including “both cloud and server-based solutions”).
- Staff salaries and labor costs.
- Consulting services not related to the installation or configuration of eligible equipment.
- Any services or equipment on the FCC’s “Covered List” provided by companies deemed national security risks.
- Competitive Bidding: All products and services funded under the Pilot must be competitively bid. As with E-rate, the primary vehicle for initiating bidding will be the Pilot Form 470. As a limited exception, again similar to E-rate, Pilot participants will not be required to seek competitive bids on services and equipment purchased under master service agreements (“MSAs”) awarded pursuant to the E-rate Form 470 process as well as applicable federal, state, Tribal, or local government competitive bidding requirements. Note, however, that use of such MSAs may require mini bids.
- Selection Process: Although it is obvious that the $200 million Pilot funding cap will limit applicant participation, it is not yet clear where in the process such limits will hit. Conceivably, entities seeking to participate could be screened after submission of the Form 484 (Part 1), Form 484 (Part 2), Pilot Form 471, or progressively throughout that sequence. The Order states a clear emphasis on “funding low-income and tribal entities.”
- As discussed above, if funding requests from the initial applications are less than $200 million, the FCC may authorize additional application windows (perhaps open to new applicants).
- Conversely, if at any time demand exceeds available funds, funding will be allocated first to applicants with the highest discount rates.
More details on the Cybersecurity Pilot are expected to become available shortly on the USAC website, in USAC news briefs, in USAC training workshops, or from the FCC directly (perhaps in the form of published FAQs).