Cybersecurity Pilot Program FAQs

Budget

*2.0 Q: How do I calculate my budget for the Cybersecurity Pilot Program?
A: Budgets are fixed for the three-year program term and are calculated based on the entity type and the number of students or library sites the Pilot participant has. While budgets, including associated funding floors and caps, are expressed in terms of annualized dollar amounts in the Cybersecurity Pilot Program Report and Order, funding is capped based on the full three-year duration of the Pilot Program and not on an annual basis. This means that the amount of funding disbursed to a participant in a given year of the program may exceed the annual budget, so long as the total amount disbursed to a participant over the three-year term does not exceed three times that annual budget. Budget calculations must also take into account a Pilot participant’s non-discounted portion of the budget, which, in turn, is based on a participant’s discount rate.

The following provides a few illustrative examples of how the budget for certain entity types is calculated both annually and based on the three-year program term, as well as on a pre-discount and post-discount basis.

Schools and School Districts
Schools and school districts are eligible to receive up to $13.60 per student annually on a pre-discount basis, subject to a $15,000 pre-discount, annual funding floor and a $1.5 million pre-discount, annual cap. This means that a school or a school district with 1,100 or fewer students will receive a pre-discount, annual budget of $15,000 (or $45,000 during the three-year period), and a school or a school district with more than 1,100 students and up to 110,000 students will receive a maximum pre-discount, annual budget of $13.60 per student up to $1.5 million (or $4.5 million during the three-year period).

Thus, for example, a school with 1,200 students would calculate its pre-discount, annual budget by multiplying the total number of students by $13.60 (i.e., 1,200 students x $13.60). Using this formula, the school’s pre-discount, annual budget would be $16,320 per year, over the three-year program. To calculate the pre-discount, three-year budget, the school would multiply the pre-discount, annual budget by three ($16,320 x 3) for a total of $48,960. If the school qualified for a discount of 75%, the school’s annual, non-discount portion would be $4,080 ($16,320 x .25) or $12,240 total ($48,960 x .25) for the three-year term. The Pilot Program’s share of the total three-year budget would be $36,720, and the school’s share would be $12,240.

Libraries and Library Systems
Library and library systems with up to 11 libraries/sites are eligible to receive a pre-discount, annual budget of $15,000 per library, while those with 12 libraries/sites or more are eligible to receive a pre-discount, annual budget of up to $175,000.

As an example, the pre-discount, annual budget for a library with a single library site would be $15,000 per year. The same would be true for a library system with up to 11 libraries/sites. To calculate the pre-discount, three-year budget for either library, the library would multiply the pre-discount, annual budget by three ($15,000 x 3) to get $45,000 total for the three-year term. If the library qualified for a 90% discount, the Pilot Program’s share of the total three-year budget would be $40,500, and the library’s share would be $4,500.

In contrast, the pre-discount, annual budget for a library system with 12 or more libraries/sites would be the maximum annual budget of $175,000 per year, over the three-year program. To calculate the pre-discount, three-year budget, the library system would multiply the pre-discount, annual budget by three ($175,000 x 3) to get $525,000 total. If this library system qualified for a discount of 90%, the library system’s annual, non-discount portion would be $17,500 ($175,000 x .10) or $52,500 total ($525,000 x .10) for the three-year term. The Pilot Program’s share of the total three-year budget would be $472,500, and the library system’s share would be $52,500.

Consortia
Consortia comprised of eligible schools and libraries are eligible to receive up to $13.60 per student annually on a pre-discount basis, subject to $1.5 million pre-discount, annual cap for schools and a $15,000 pre-discount, annual budget if comprised of up to 11 libraries/sites, subject to the $175,000 pre-discount, annual cap for libraries. Note that consortia that are solely comprised of schools are subject to the $1.5 million pre-discount, annual budget cap applicable to schools, and consortia that are solely comprised of libraries are subject to the $175,000 pre-discount, annual budget cap for libraries. Consortia comprised of both eligible schools and libraries are subject to the $1.5 million pre-discount, annual cap applicable to schools.

Thus, for example, a consortium comprised of both eligible schools and libraries with 1,200 students and 10 library sites would first calculate its school-only, pre-discount, annual budget by multiplying the total number of students by $13.60 (i.e., 1,200 students x $13.60). Using this formula, the consortium’s school-only, pre-discount, annual budget would be $16,320 per year, over the three-year program. To calculate the school-only, pre-discount, three-year budget, the consortium would multiply the school-only, pre-discount, annual budget by three ($16,320 x 3) to get $48,960 total.

Next, the consortium would calculate its library-only, pre-discount, annual budget by multiplying the total number of libraries/sites by $15,000 (i.e., 10 library sites x $15,000). Using this formula, the consortium’s library-only, pre-discount, annual budget would be $150,000 per year, over the three-year program. To calculate the library-only, pre-discount, three-year budget, the consortium would multiply the library-only, pre-discount, annual budget by three ($150,000 x 3) to get $450,000 total.

To calculate the consortium’s final pre-discount, annual budget, the consortium would add its school-only, pre-discount, annual budget and library-only, pre-discount, annual budget, which totals $166,320 per year over the three-year program ($16,320 + $150,000 = $166,320 per year). The consortium’s final, pre-discount, three-year budget would be three times that amount or $498,960 total ($166,320 x 3). If the consortium qualified for a discount of 65%, the consortium’s annual, non-discount portion would be $58,212 ($166,320 x .35) or $174,636 total ($498,960 x .35) for the three-year term. The Pilot Program’s share of the total three-year budget would be $324,324, and the consortium’s share would be $174,636. For further information on and examples of how budgets are calculated, please refer to the Budget Examples.

*2.0(a) Q: How do I calculate my non-discount share of the costs associated with the services and equipment for which I seek funding?
A: A Pilot Participant’s non-discount share of the costs for eligible equipment and services is calculated by subtracting 1 from its discount rate expressed as a decimal (e.g., a 90% discount rate would be .90), then multiplying the resulting number by the pre-discount budget.

Equation: P = B x (1 – R)

B is the annual, pre-discount budget total
R is the discount rate expressed as a decimal (90% discount rate = .90)
P is the portion a school would pay (i.e., the non-discount share)
 

Thus, for example, the non-discount share for a school with a pre-discount, annual budget of $15,000 and a discount rate of 90% would be calculated as follows:

P = $15,000 x (1 –.90)
(1 - .90) = .1
$15000 x .1 = $1,500

P = $1,500
The school’s non-discount share is $1,500 per year (or $4,500 total).

2.1 Q: Are applicants expected to pay a portion of the costs of the equipment and services purchased through the Pilot Program?
A: Yes. Like the E-Rate program, Pilot participants will be required to pay the non-discounted share of the costs of the eligible services and equipment they purchase with Pilot Program funds. The percentage of the eligible costs that a Pilot participant will be required to pay will be based on the participant's Category 1 discount rate. See 47 CFR § 54.2007(e).

2.2 Q: Can I use other funds, including universal service, state, local, federal or Tribal resources, to pay for cybersecurity equipment and services?
A: Participants are not precluded from using other sources of funding to pay for cybersecurity equipment and services. However, to ensure efficient and appropriate use of the limited Pilot funds and avoid duplicative funding, Pilot participants may not receive Pilot funding for the same cybersecurity equipment and services funded through other sources.

2.3 Q: Will I receive my Pilot funding in equal amounts each year or can I request funding as I incur expenses?
A: Pilot participants can request reimbursement as eligible expenses are incurred, so long as they do not exceed their overall funding commitment for the three-year term of the Pilot Program. Participants must wait until after the receipt or delivery of Pilot-eligible services and equipment to submit invoices.

2.4 Q: Is the per-student funding amount calculated based on a school's total student enrollment or is it limited to those students that qualify as low income?
A: The per-student budget is based on a school's total student enrollment.

2.5 Q: How should I estimate the cost of the eligible services and equipment of my Pilot project on the FCC Form 484? I won't know exactly what it will cost until I complete the competitive bidding process.
A: Pilot applicants should make a reasonable effort to estimate the costs associated with their Pilot project. The FCC expects to use this information to get a sense of the different sizes and types of projects that are being proposed, in order to ensure a diverse pool of participants. Where available, applicants can use published pricing or reports, past estimates or incurred costs, or other sources of information.

Once applicants have submitted their cost estimates on the FCC Form 484, they will not be able to modify them. As discussed in FAQ 2.6, however, Pilot Program participants will have an opportunity to adjust their projected costs after completing the competitive bidding process and making final decisions about the services and equipment to be purchased.

2.6 Q: Will a Pilot participant's commitment be limited to the cost estimate provided in its FCC Form 484? If selected for the Pilot Program, can a participant apply for funding greater than their estimated cost, provided it doesn't exceed their maximum budget?
A: A Pilot participant will not be limited to the cost estimate provided in Part 1 of its FCC Form 484. A Pilot participant can apply, and receive funding, for eligible services and equipment up to its maximum budget.

2.7 Q: Can I apply for the Pilot Program even if I've already received (or intend to apply for) state funding for cybersecurity services and equipment?
A: Yes, but you may not use Pilot funding to cover the same costs that are funded through another source (i.e., no "double dipping" or duplicative funding). Consistent with our E-Rate rules, you may use another source to cover the non-discounted share of your Pilot-funded project or to supplement Pilot funds in order to fully cover the cost of the solution you intend to implement.

2.8 Q: Is there any chance that entities that have uncommitted Category Two funds can have those redirected to services eligible under the Cybersecurity Pilot?
A: No. E-Rate Category One or Category Two funding may not be used for advanced cybersecurity services and equipment that is eligible in the Pilot Program. The Commission will explore whether and how universal service funds, including E-Rate funds, could be used to support these types of services based on lessons learned from the Pilot Program.

2.9 Q: Will funding available through the Pilot Program be considered Category One or Category Two?
A: Neither. The Pilot Program is separate from the E-Rate program and, as such, the funding is considered neither Category One nor Category Two funding. As noted in FAQ 2.8, the Commission will explore whether and how universal service funds, including E-Rate funds, could be used to support advanced cybersecurity services and equipment after the conclusion of the Pilot Program.

2.10 Q: How will my total budget for the Pilot Program be determined?
A: A participant's reimbursable spending on eligible services and equipment is subject to an overall three-year budget cap. The cap is based on a participant's type (school, library or consortium) and size (student count and/or number of libraries and sites). See 47 CFR § 54.2001(b). To assist participants in determining their three-year budget cap for the Pilot Program, the Bureau has prepared a set of illustrative examples of budget calculations.

Eligibility

3.1 Q: Am I eligible to apply to participate in the Pilot if I am already using some advanced cybersecurity equipment and services? Can I apply if I don't have any cybersecurity experience?
A: The FCC expects to approve support for a variety of schools, libraries, and consortia, taking into account the varying stages of their cybersecurity experience. Schools, libraries, and consortia are therefore encouraged to apply regardless of their level of cybersecurity experience.

3.2 Q: Can a school district or library collaborate with a nonprofit organization to participate in the Pilot Program?
A: Non-eligible entities, such as state, local, and Tribal government entities, and other not-for-profit organizations may serve as Consortium Leaders. However, these types of Consortium Leaders are ineligible to receive Pilot benefits, discounts, and funding and therefore must pass through the benefits, discounts, and funding to their eligible school and library consortium members. See 47 CFR § 54.2002(c)(1) (requiring ineligible entities serving as Consortium Leaders to pass through the full value of the Pilot Program benefits to the eligible Pilot consortium members).

3.3 Q: Can an Educational Service Agency (or ESA) participate in the Pilot Program?
A: Educational Service Agencies (ESAs), also known as Educational Service Units (ESUs), Local Educational Agencies (LEAs), and Board of Cooperative Educational Services (BOCES), are eligible to serve as Consortium Leaders.

In addition, if a state recognizes an ESA as an eligible school under its state law, the ESA may apply as an applicant and seek support for its eligible members as it is currently allowed to in the E-Rate program. As with consortia applicants, an individual school may not participate as part of an ESA application and as an individual applicant and must decide how it would like to participate in the Pilot Program.

3.4 Q: Can I apply and participate in the Pilot Program individually, as well as part of a consortium?
A: No. Given limited funding for the Pilot Program and the FCC's objective to select as many participants as possible, schools and libraries may apply and participate only once as an individual school or library participant, or as part of a consortium.

3.5 Q: What does "E-Rate eligible" mean in terms of determining eligibility for the Pilot Program? Do I need to be a current participant in the E-Rate program to be eligible?
A: To evaluate Pilot Program eligibility, the FCC adopted the same definitions of elementary school, secondary school, library, and library consortium that it uses for the E-Rate program. Therefore, entities that are eligible to participate in the E-Rate program are also eligible to apply for the Pilot Program. A school, library, or consortium does not need to be an E-Rate applicant in order to apply for the Pilot Program.

Eligible Services and Equipment

4.1 Q: Can I purchase cybersecurity services and equipment from more than one of the four categories that the FCC has identified as eligible?
A: Yes. Equipment and/or services are eligible if they "constitute a protection designed to improve or enhance the cybersecurity of a K-12 school, library, or consortia." The four categories identified by the Commission are examples of eligible equipment and services, but are not the only ones. Other equipment and/or services are eligible if they meet the Commission's broad eligibility criteria.

4.2 Q: Can funds be used to pay for cybersecurity services and equipment (including renewal licenses) that I'm already receiving?
A: It depends. Pilot funding may be used to pay for existing cybersecurity services and equipment to the extent such services or equipment are not being paid for through another funding source and were awarded consistent with the competitive bidding exemption adopted in the Order. The exemption applies if the services or equipment were awarded pursuant to a master services agreement (MSA) negotiated by a federal, state, Tribal, or local governmental entity on behalf of a Pilot participant(s); and such MSA(s) were awarded pursuant to the E-Rate program FCC Form 470 process, as well as applicable federal, state, Tribal, or local competitive bidding requirements. The services and equipment are otherwise ineligible for reimbursement through the Pilot Program.

4.3 Q: Can funds be used retroactively, to pay for services and equipment that were purchased and used last year?
A: No. Pilot Program funds are intended to be used prospectively, during the course of the three-year funding term.

*4.4 Q: Can I receive reimbursement for a new multi-year license, provided it is for eligible services?
A: Yes. Provided they meet all other procurement and competitive bidding requirements, participants are permitted to seek funding for multi-year licenses for eligible recurring services that are longer than three years. However, only services delivered within the three-year Pilot Program time period can be reimbursed through the Program.

4.4a Q: If I paid for the cost of the multi-year license upfront, can I get reimbursed for the total cost in year 1? 
A: Yes, you may receive reimbursement for the cost of the license in the first year of the Pilot Program if you paid for the cost upfront. However, only services delivered within the three-year Pilot Program time period can be reimbursed through the Program. See FAQs 4.4 and 6.9.

Thus, for example, if you had a five-year multi-year license and paid for the total cost upfront, the Pilot Program would only reimburse you for the portion of the multi-year license cost covering the services delivered within the three-year Pilot Program term. The portion of the license cost covering the remaining two years is not reimbursable through the Pilot Program.

4.5 Q: For firewalls, will the Pilot cover high availability pairs or just a single firewall?
A: High availability firewall solutions are eligible as long as all other eligibility and program requirements are met.

4.6 Q: To what extent are consulting services eligible for reimbursement through the Pilot Program?
A: Consulting services tied directly to the actual installation and initial configuration of eligible equipment and services are eligible, provided that all other eligibility and competitive bidding requirements are met. Other consulting services are not eligible for reimbursement through the Pilot Program. See Eligible Services List

4.7 Q: Will the Pilot Program cover staff salaries and other labor expenses?
A: Staff salaries and labor costs are not eligible for reimbursement through the Pilot Program. See Eligible Services List

4.8 Q: Why won't the Pilot Program pay for staffing and cybersecurity training for staff and students?
A: The Pilot has a limited amount of funding available, and the Commission has focused on funding specific technologies rather than staff and training programs. That said, training costs are eligible in some scenarios. For example, training is eligible as part of the installation of equipment and services, if it is basic instruction on the use of the eligible equipment and services, directly associated with equipment and services installation, and part of the contract or agreement for the equipment and services. It must occur concurrently with or within a reasonable time after installation.

We note that vendors are also likely to include basic training at no additional cost as part of their sale of the eligible equipment and services and there are many free and low-cost cybersecurity training resources available through CISA and other federal government partners.

4.9 Q: If a service includes both eligible and ineligible components, can I cost-allocate out the ineligible portion?
A: Yes, as is also required in E-Rate, Pilot participants are required to perform a cost-allocation to remove from their Pilot Program funding requests any costs associated with ineligible components or functions of otherwise eligible equipment or services. See 47 CFR § 54.2006(c).

4.10 Q: Can I use Pilot funding to purchase cybersecurity protection for end-user devices, such as tablets, smart phones and laptops?
A: Cybersecurity services used on end-user devices that are owned or leased by a participating school or library are eligible, regardless of whether the services are network-based or locally installed on the end-user device. See Report & Order, FCC 24-63, Appendix B, note 4.

4.11 Q: Can I apply for Pilot Program funds to cover the costs associated with a basic firewall if I don't plan to seek E-Rate funding next year?
A: No. Basic firewalls are not covered by the Pilot Program.

4.12 Q:  Can equipment purchased with Pilot funds be physically installed or located at a facility that is ineligible for funding (i.e., not an eligible school or library)?  For example, could a consortium purchase equipment that would be located at a facility owned or operated by its consortium leader, if the consortium leader is ineligible for Pilot funds?
A:  Equipment purchased with Pilot funds can be installed or located at a facility that is owned or maintained by an entity that is ineligible for funding, so long as the equipment is for the exclusive use and benefit of the Pilot-eligible schools and libraries.

*4.13 Q: Can we request support for month-to-month cybersecurity services under the Pilot Program? If so, how would we go about doing so?
A: Yes, Pilot participants may request support for the monthly service costs associated with eligible services for up to 36 months (i.e., the term of the Pilot Program) and would need to indicate that they are doing so on their Pilot FCC Form 470. Please note that participants seeking support for monthly service costs need to file only one Pilot Program FCC Form 470 to cover the entire three-year term of the Pilot Program. We also remind Pilot participants that they must consider all bids received and select the most cost-effective bid using the price of the eligible services as the primary factor in their evaluation process.

Application/Selection Process

5.1 Q: How will Pilot Program participants be selected? Is it first come, first served? Lottery?
A: Participants will be selected through the FCC Form 484 application process. In the FCC Form 484 Part 1, applicants will be required to provide general information about the schools and libraries seeking support, as well as information about the proposed Pilot project. If selected to participate in the Pilot Program, participants will be required to provide more detailed information about their cybersecurity experiences in Part 2 of the FCC Form 484 application.

To facilitate the inclusion of a diverse set of Pilot projects and to target Pilot funds to applicants most in need of cybersecurity support, the FCC will award support to a combination of large and small and urban and rural schools, libraries, and consortia, with an emphasis on funding proposed Pilot projects that include low-income and Tribal applicants.

5.2 Q: To the extent the FCC is prioritizing applicants with the "greatest need," how is that defined?
A: Need generally will be determined based on an applicant's discount percentage rate. A school's discount percentage rate is determined based on the percentage of its student enrollment that is eligible for a free or reduced price lunch under the National School Lunch Program. The discount percentage rate for libraries and consortia will be calculated based on the percentage of student enrollment that is eligible for the National School Lunch Program in the public school district in which they are located. The discount rate percentage will then be adjusted by geographic location (i.e., urban or rural) in the same manner as it is in the E-Rate program. See 47 CFR § 54.2007.

5.2a Q: How do the prioritization rules fit with the goal to have a diversity of applicants?
A: If demand is greater than the $200 million cap, the FCC will look at applicants' discount band to select Pilot participants. Consistent with Pilot Program rules, applications in the 90% discount band will be reviewed first. If there is not enough support to fund all requests within the 90% discount band, the FCC will look at applicants' specific National School Lunch Program percentages, starting with the highest percentage. To ensure diversity in the applicant pool, application review will also consider the other criteria identified in the Report and Order – applicant type, urban/rural, small/large, and Tribal – within each discount band.

5.3 Q: How will the Commission ensure diversity of stakeholder representation if it is prioritizing applicants with the "greatest need," as defined by an applicant's discount percentage rate?
A: The Commission expects that it will be able to ensure diversity of geography, size and cybersecurity experience, while prioritizing applicants with the greatest need. The selection criteria adopted in the Report and Order provides the flexibility needed to ensure that a wide array of well-defined projects, submitted by a variety of applicant types, will be selected.

5.4 Q: How long will it take for Pilot Program participants to be selected?
A: USAC, together with the FCC, expects to complete review of Part 1 of the applications and select participants as expeditiously as possible. The timing of the selection process will depend on the number and quality of the applications received.

5.5 Q: If an applicant is not selected in the first year, can they still apply to participate in future years of the Pilot?
A: Given the level of stakeholder interest in the Pilot Program, we expect to fully commit the available funds in the first year.

5.6 Q: If I am selected to participate in the Pilot Program, do I need to remain in it for all three years?
A: Yes, we expect applicants selected to participate in the Pilot Program will be committed to participating for the entire three-year term of the Pilot. In doing so, we expect it will help participants maximize their benefits and ensure the Commission is able to gather the data it needs to fully evaluate the Pilot. Additionally, we hope participants will be mindful of the opportunity to participate in the program and recognize the many others who, if selected, would be eager to participate for the entire three-year term.

Choosing to participate in the Pilot but failing to satisfy Program requirements (such as reporting obligations) by withdrawing early from the Pilot may result in a referral of a participant to the Enforcement Bureau, a hold on future disbursements, a rescission of committed funds, and/or recovery of disbursed funds.

5.7 Q: Will everyone who applies for the Pilot Program be selected?
A: No. While the Commission hopes to select as many applicants as possible to participate in the Pilot, we anticipate that the demand will exceed the available funding.

5.8 Q: Given the limited budget and the Commission's focus on schools and libraries at the highest discount percentage level, should I take the time to submit an application?
A: There is no way to know who is going to apply, so we encourage all eligible schools, libraries, and consortia to consider submitting an application for the Pilot Program. The FCC specifically established a streamlined application process to make it easier for prospective participants to submit an application.

5.9 Q: How many applicants does the FCC expect to select to participate in the Pilot Program? I've heard that only 50 will be chosen.
A: There is no set number of applicants that the FCC expects to select as Pilot participants. We encourage everyone who is eligible to apply, as we hope to select as many applicants as possible to participate in the Pilot Program.

5.10 Q: Can prospective applicants use a consultant to prepare the FCC Form 484 and other forms?
A: Similar to the E-Rate program, prospective applicants may hire a consultant to help prepare their FCC Form 484, but need to include the consultant's consultant registration number (CRN) on their account profile in the E-Rate Productivity Center (EPC). If needed, consultants may obtain a CRN from USAC. Consultants participating in the Pilot Program application process are subject to the same suspension and debarment rules that apply to universal service programs.

5.11 Q: Is special assistance available for smaller schools and libraries to help them complete the application process?
A: Yes. USAC is planning special training for small, less-resourced schools and libraries, as well as schools and libraries that have not participated in the E-Rate program. In addition, USAC will host office hours and offer a help desk for applicants that require additional assistance in filling out the forms needed to apply for, and participate in, the Pilot Program. Schools and libraries are also welcome to email cyberpilot@fcc.gov if they have questions.

5.12 Q: Does our willingness to share data affect our chance of being selected?
A: Yes. Given the underlying purposes of the Pilot and the importance of the performance goals and data reporting to the Pilot Program, the FCC will consider an applicant's willingness to provide data when selecting Pilot participants.Specific data reporting requirements will be established in forthcoming Public Notice(s).See FAQ 8.1.

5.13 Q: Will I improve my chances at being selected if I only ask for funding to support basic cybersecurity needs or should I opt for a more comprehensive solution?
A: There is no "right" or "wrong" answer to any of the questions regarding an applicant's experience, needs, or resources. Applicants should answer truthfully and thoughtfully about what solutions best fit their needs, given resource and other considerations. One of our goals is to ensure the Pilot contains a diverse cross-section of applicants with differing cybersecurity postures and experiences.

5.14 Q: Will I improve my chance of being selected for participation in the Pilot if my project will be "self-sustaining" at the conclusion of the Pilot Program? What does it mean to be "self-sustaining"?
A: There is no "right" or "wrong" answer to the question regarding whether an applicant's Pilot project will be self-sustaining at the conclusion of the Pilot Program. Applicants should answer truthfully and thoughtfully, based on their best estimate regarding resources that will be available at the conclusion of the Pilot Program.
A project is considered "self-sustaining" if it can remain operational (i.e., the applicant has the ability to continue the service or maintain the equipment) without additional Pilot funds at the end of the program. Applicants will be requested to identify what funding source, if any, they expect to utilize, including federal, state, local, Tribal, or other funding sources.

5.15 Q: Can I modify the proposed Pilot project I submitted with the FCC Form 484 Part 1 after I am selected to participate in the Pilot Program?
A: Yes, Pilot participants may modify their Pilot project after they submit their FCC Form 484 Part 1. However, once the FCC has issued a Funding Commitment Decision Letter approving a participant's requested cybersecurity services and equipment, any subsequent changes would require approval consistent with the Pilot Program rules.

5.16 Q: What are the consequences if an individual school or library applies as both an individual and consortium (i.e., submits duplicative applications)?
A: Individual and consortia applicants should make every effort to ensure that an individual school or library is applying only once to participate in the Pilot Program. An applicant should contact USAC as soon as it becomes aware of any duplicative applications.

If an applicant inadvertently applies both individually and as part of a consortium, it will need to decide which application it wants to be included on and which application USAC should remove it from. If the applicant decides to pursue an individual application and asks USAC to remove it from a consortium application, the applicant should notify the Consortium Leader that it no longer wants to be listed on the consortium application so that the consortium may modify its application accordingly.

Failure to correct the duplicative applications could result in the applicant and/or the consortium being removed from the Pilot Program.

*5.17 Q: Does a Consortium Leader need to obtain authorization to act on behalf of a consortium member in conducting the competitive bidding process and/or requesting and applying for Pilot Program funding on behalf of each consortium member?
A: Yes, Consortium Leaders are required to collect and retain letters of agency (LOAs) from their consortium members affirming their authorization to act on the member's behalf in the Pilot Program, similar to the requirement in the E-Rate Program. If the Consortium Leader is authorized by the terms of an existing E-Rate LOA, a Consortium Leader may rely on the existing LOA to act on behalf of the consortium member for the Pilot Program, otherwise a new LOA is required for the Pilot Program. The Consortium Leader is also required to retain LOAs from their members as required by the program rules and provide upon request.

If an individual Pilot applicant provides an LOA to a Consortium Leader authorizing them to apply in the Pilot Program on their behalf, they should not also submit an individual application.

*5.17a Q: I have an existing, E-Rate LOA, but it does not specifically reference the Pilot Program. Is this sufficient for purposes of demonstrating that the Consortium Leader is authorized to act on behalf of its consortium members as required by the Program rules?
A: If an existing letter of agency (LOA) for the E-Rate program does not specifically reference the Cybersecurity Pilot Program, you may use the existing E-Rate LOA for purposes of the Cybersecurity Pilot if the E-Rate LOA is broad enough to grant the Consortium Leader authority to act on the your behalf.

In lieu of a LOA, consortia that have a statutory or regulatory basis for which participation by the schools or libraries is mandatory in the consortium, may provide copies of the relevant state statute or regulation to demonstrate that the Consortium Leader has the authority to act on behalf of the consortium members. See Request for Review of the Decision of the Universal Service Administrator by Project Interconnect, CC Docket Nos. 96-45, 97-21, Order, 16 FCC Rcd 13655, 13659, para. 10 (Common Car. Bur. 2001) (Project Interconnect Order) (affirming USAC's letter of agency (LOA) requirement for consortia); see also Request for Waiver of the Decision of the Universal Administrator by South Carolina Division of the Chief Information Officer, CC Docket Nos. 96-45, 02-6, 21 FCC Rcd 5987, 5991, para. 9 (WCB 2006) (finding that the Consortium Leader was authorized under SC statute to apply for E-Rate funding on behalf of the consortium members).

Although LOAs are one way for the Consortium Leader to demonstrate that it has authority to act on behalf of its consortium members in the Pilot Program, there may be other documentation that can also be used for this purpose.

5.18 Q: What is the process for withdrawing from the Pilot Program once I am accepted? At what point will I be penalized and what are the potential consequences?
A: We expect that applicants selected to participate in the Pilot Program will be committed to participating for the entire three-year term. Applicants are urged to carefully evaluate whether they are able to satisfy Pilot obligations prior to submitting their FCC Form 484 Part 1 applications. To the extent a Pilot participant determines that it must withdraw from the Pilot, it should contact the Wireline Competition Bureau (by emailing cyberpilot@fcc.gov) for additional information about the withdrawal process.

Penalties for failure to comply with Pilot Program rules may result in a referral of a participant to the Enforcement Bureau, a hold on future disbursements, a rescission of committed funds, and/or recovery of disbursed funds. See 47 CFR §§ 54.2004(d)(5) and 54.2004(e). The scope of any potential consequence for non-compliance with the Pilot Program rules will depend on the specific circumstances, including whether any funds have been disbursed. The Commission does not anticipate routinely referring Pilot participants to the Enforcement Bureau for rule violations.

5.19 Q: Will I be able to apply for the Pilot Program if I am on Red Light status?
A: Prospective applicants on Red Light status (or prospective applicants that share a Taxpayer Identification Number (TIN) with an entity on Red Light) must resolve outstanding debts on or before the FCC Form 484 Part 1 application deadline, November 1, 2024, to be eligible to be selected participate in the Pilot Program. To confirm that your entity is eligible to be selected to participate in the Pilot Program, visit the FCC's CORES webpage, to check your financial status with the FCC. If your entity is on Red Light, you must pay the amount(s) owed and resolve the Red Light status on or before November 1 to be eligible to be selected as a Pilot Program participant.

5.20 Q: Will the information I provide on the FCC Form 484 Part 1 or Part 2 be made public?
A: Recognizing that the FCC Form 484 application would contain sensitive information, the Commission bifurcated the application into Parts 1 and 2, in part to limit the amount of sensitive cybersecurity information provided by applicants at the application stage and by participants after being selected. As such, the FCC Form 484 Part 1 required applicants interested in participating in the Pilot to provide basic information about their cybersecurity needs, experience, and plans to use Pilot Program funding if selected for the Pilot. In contrast, the FCC Form 484 Part 2 collects more detailed cybersecurity information, but only from those applicants who have been selected as Pilot participants.

To protect the sensitive cybersecurity information collected on both Parts 1 and 2 of the form, the form can only be accessed by persons designated by the applicant’s or participant’s E-Rate Productivity Center (EPC) Account Administrator, USAC, and the FCC. Neither applicants nor participants are able to view each other’s FCC Forms 484, and the data collected is not publicly available.

In short, due to the sensitive nature of the cybersecurity-related information collected on Parts 1 and 2 of the FCC Form 484, the FCC will treat the information collected as presumptively confidential under its rules and withhold it from routine public inspection. The FCC also will not share the information collected on the form with other federal agencies for incident reporting or compliance purposes.

5.21 Q: I received a letter from USAC notifying me that I have been selected as a participant in the Pilot Program. Does the amount noted in the letter reflect my total, approved budget for the three-year program term or does it reflect the approved budget for just the first year?
A: Pilot participants that were selected as participants in the program via the Wireline Competition Bureau’s January 16, 2025 Public Notice received an acceptance letter from USAC, the Administrator of the Pilot Program, notifying them of their selection and specifying the preliminary pre-discount commitment amount for the three-year Pilot Program term. For the vast majority of Pilot Program participants (i.e., those participants that do not fall within the 90% discount percentage and 81% National School Lunch Program (NSLP) discount band), this amount represents the full award of your maximum Pilot Program budget for the three-year term. For those participants that fall within the 90% discount percentage and 81% NSLP discount band and who will, as a result, receive support on a pro-rata basis, this amount represents a partial award of your maximum Pilot Program budget for the three-year term.

As explained in the letter, the preliminary pre-discount commitment amount can be used during the budget, competitive bidding, and bid selection process for the Pilot Program and is based on the information and details provided during the submission and evaluation of the FCC Form 484 Part 1. Unless you are a participant that falls within the 90% discount percentage and 81% NSLP discount band, we do not anticipate that this preliminary pre-discount commitment will increase as the Pilot Program funding amount is capped at $200 million. Pilot participants that fall within this discount percentage and NSLP discount band and received pro-rata based budgets, however, may see this amount increase to the full three-year budget amount as available funds permit.

Competitive Bidding and Requests for Services

6.1 Q: Will the FCC Forms 470/471 for the Pilot Program be the same ones that are used for E-Rate?
A: The Pilot FCC Forms 470/471 are modeled on the forms used for the E-Rate program but will be their own distinct forms. There will not be any material difference in the information required.

6.2 Q: Will data from the FCC Forms 470/471 be available through Open Data?
A: Yes. We expect to make the data from the FCC Forms 470/471 available through Open Data.

6.3 Q: Can a participant use multiple vendors?
A: Yes. Pilot participants will be required to conduct a competitive bidding process similar to the E-Rate program and select service provider(s) using the price of the eligible equipment and services as the primary factor. Participants will be able to select multiple service providers as they are able to do in the E-Rate and ECF programs, provided such selection is consistent with the competitive bidding and other program rules for the Pilot Program.

6.4 Q: How does the competitive bidding exemption (CBE) work in the Pilot program?
A: Pilot participants are not required to perform a new competitive bidding process when seeking support for equipment/services from a Master Services Agreement (MSA) or State Master Contract (SMC) awarded pursuant to the E-Rate Form 470 process and applicable federal, state, Tribal, or local competitive bidding requirements if the MSA or SMC was negotiated by a governmental entity on behalf of the Pilot participant. The MSA or SMC will need to be reviewed and will be posted to USAC's website as an approved contract under the CBE.

Selected Pilot participants who want to rely on an MSA or SMC that do not qualify under the CBE may seek a waiver of the FCC's competitive bidding rules by providing evidence demonstrating that the MSA or SMC was negotiated using procurement and vendor selection requirements identical or equivalent to those of the governmental entity-negotiated contracts that qualify under the CBE.

6.4a Q: Are the E-Rate FCC Forms 470 that qualify for the competitive bidding exemption (CBE) limited to specific E-Rate Funding Years?
A: Yes, Pilot participants may only seek an CBE for FCC Forms 470 that were posted in E-Rate Funding Years 2023, 2024, and 2025. Entities that would like to start competitive bidding for new state master contracts may use the E-Rate FY 2025 FCC Form 470 to initiate the procurement process.

6.4b Q: What is the process for requesting a competitive bidding exemption (CBE)?
A: If you meet the requirements for a CBE (see FAQ 6.4), you must submit your request to USAC for review and approval by emailing CybersecurityPilotMSAorSMC@usac.org. Within three business days, USAC will send you a secure BOX link, which you will use to submit any document and information needed, such as a copy of the Master Services Agreement(MSA) or State Master Contract (SMC) and the corresponding E-Rate FCC Form 470 that initiated the competitive bidding process that resulted in the MSA/SMC.

If approved, the MSA/SMC along with its establishing E-Rate FCC Form 470 will be made available on USAC’s website as a contract exempt from the competitive bidding requirements so that Pilot participants may review and make use of these contracts where appropriate.

6.5 Q: What qualifies an MSA as having been "negotiated by a governmental entity" as required by the CBE?
A: To qualify, an MSA must have been negotiated by a federal, state, Tribal, or local governmental entity, either directly or through a separate governmental entity created by a federal, state, Tribal, or local government for the purpose of providing services to schools and libraries. Other entities, such as non-governmental corporations and other not-for profit entities that were not created by a state legislature, do not qualify for this exemption.

6.6 Q: Am I required to use a mini-bid process if my MSA qualifies under the CBE?
A: Yes, with one exception. When a CBE-qualifying MSA identifies multiple vendors for the same services/equipment, a Pilot participant must perform a mini-bid process, using the price of the eligible equipment and services as the primary factor, to select among multiple-award schedules for the MSA. The mini-bid process is not required, however, if the vendors were ranked by lowest price in the MSA and the Pilot participant selects the lowest-price vendor.

6.7 Q: May Pilot participants convert an existing non-competitively bid contract into Pilot-eligible contract based on the Kalamazoo Orderfrom the E-Rate program? That is, can an existing contract, that does not qualify under the CBE, be converted to a qualifying contract if the participant initiates a new bidding process in which it treats the existing contract as a bid received?
A: No, unlike the E-Rate program, the Pilot Program does not allow existing, non-qualifying contracts to be converted into eligible contracts based on the E-Rate program's Kalamazoo precedent. Existing contracts only qualify for the Pilot if they fall within the CBE.

6.8 Q: What is the process for seeking a waiver of the competitive bidding rules for a Master Services Agreement (MSA) or State Master Contract (SMC) that was not negotiated by a governmental entity?
A: Prospective Pilot applicants and selected Pilot participants who want to rely on a non-qualifying MSA or SMC must file a waiver request and include in the waiver request a copy of the MSA or SMC for FCC review. FCC staff will determine if the MSA or SMC meets the required standard of identical or equivalent procurement and vendor selection requirements as compared to a competitive bidding exemption (CBE) qualifying contract. Petitioners should provide relevant supporting documentation to demonstrate the requirements of the CBE qualifying contract were met.

*6.9 Q: How should I request services or license agreements that would begin mid-way through the three-year term of the Pilot, once my existing contract expires? Can I submit more than one Pilot FCC Form 470 and Form 471? Or should I request those services or license agreements upfront, before my existing contract expires?
A: The Pilot Program contemplates that participants would file a Pilot FCC Form 470 and one Pilot FCC Form 471 to cover the entire three-year term of the Pilot by the August 18, 2025 deadline. To the extent a Pilot participant seeks to receive support for a license or service that covers only part of the term of the Pilot Program, it should solicit bids for those services when it files the Pilot FCC Form 470 at the beginning of the Pilot and then request the services for the term of the Pilot Program to be covered by the new or extended contract using the Pilot FCC Form 471.

Participants are reminded that the Pilot Program does not allow existing, non-qualifying contracts to be converted into eligible contracts based on the E-Rate program's Kalamazoo precedent. Existing contracts only qualify for the Pilot if they fall within the competitive bidding exemption. See FAQ 6.7. Participants are also reminded that they must carefully consider all bids received and select the most cost-effective service offering using price of the eligible services and equipment as the primary factor in their bid evaluation process.

Only eligible services and equipment delivered within the three-year Pilot Program time period can be reimbursed through the Program. See FAQ 4.4.

6.10 Q: How should I competitively bid services that I plan to request on a month-to-month basis? In the E-Rate program, I would rebid every year – is that the same process that will be used for the Pilot Program?
A: The Pilot Program contemplates that participants would file one Pilot FCC Form 470 and one Pilot FCC Form 471 to cover the entire three-year term of the Pilot program. Pilot participants that plan to request services on a month-to-month basis should do so when they file their single Pilot FCC Form 470 at the beginning of the Pilot and request the month-to-month services using their single Pilot FCC Form 471 for the 36-month period of the Pilot Program. Participants are reminded that they must carefully consider all bids received and select the most-cost effective service offering using price of the eligible services and equipment as the primary factor in their bid evaluation process.

6.11 Q: My cybersecurity needs have changed since submitting the FCC Form 484 Part 1. Can I seek bids for different services and/or equipment that would better address my current needs, even if they are different from what I included on my FCC Form 484 Part 1?
A: Yes, you may seek bids for different cybersecurity services and/or equipment than was included in the proposed project plan included in your FCC Form 484 Part 1. However, your request is still limited to your overall three-year budget for the Pilot Program as reflected in your acceptance letter, and support is only available for eligible equipment and services. In addition, once USAC has issued a Funding Commitment Decision Letter (FCDL) approving a participant's requested cybersecurity services and equipment, any subsequent changes would require approval consistent with the Pilot Program rules.

6.12 Q: Can I seek bids for additional cybersecurity services and/or equipment if the bids I received are lower than my overall budget?
A: Yes. If you received bids lower than your overall, three-year budget and have funds remaining within your budget, you may, but are not required to, seek bids for additional cybersecurity services and/or equipment so long as the deadline for submitting an FCC Form 470 has not passed and the request for bids covers the three-year program term. As a reminder, the last day to post an FCC Form 470 to meet the 28-day waiting period is August 18, 2025 at 11:59 p.m. E.T. Pilot participants may also return unneeded funds if they do not wish to seek bids for additional cybersecurity services and/or equipment.

6.13 Q: Are the FCC Forms 471 subject to Program Integrity Assurance (PIA) reviews similar to those conducted in the E-Rate program? If so, what can I expect from them?
A: To ensure compliance with the Commission’s rules, FCC Form(s) 471 submitted in the Pilot Program will be subject to PIA reviews similar to those reviews USAC conducts on the FCC Form(s) 471 submitted in the E-Rate program. Pilot participants can expect USAC to reach out to the contact(s) listed on the FCC Form 471 to inquire about information provided on the form and/or request supporting documentation. To expedite the review of these forms, we encourage Pilot participants to timely respond to such requests.

6.14 Q: I am a service provider and am interested in submitting bids in response to selected participants’ requests for bids. What are the parameters around communicating with selected Pilot participants? 
A: Service providers must ensure that all communications with selected Pilot participants do not violate the requirement that the competitive bidding process be fair and open (see generally section 54.2005 of the Pilot Program rules). As in the E-Rate program, a fair and open competitive bidding process means that:

• All bidders must be treated the same;
• No bidder can have advance knowledge of the Pilot Program project information;
• There are no secrets in the process. All bidders must know what is required of them, and information must be shared with all bidders; and
• Service providers and potential service providers cannot offer or give gifts to Pilot participants (including their consultants and other representatives) (subject to section 54.2005(d)(3) and (4) of the Pilot Program rules).

6.15 Q: I am a service provider and am interested in submitting bids in response to selected participants’ requests for bids. How can I look up Pilot FCC Forms 470 to which I might want to respond? 
A: If you wish to view Pilot FCC Forms 470 posted by Pilot participants, you can use the Cybersecurity Pilot FCC Form 470 Download Tool to search for cybersecurity equipment and services that you may bid on. All certified Pilot FCC Forms 470 will be available through this tool as they are submitted by Pilot participants. Pilot participants have until Monday, August 18, 2025 at 11:59 p.m. E.T to submit and certify their Pilot FCC Form(s) 471.

6.16 Q: Can I submit more than one FCC Form 470 to seek bids for eligible cybersecurity services and/or equipment?
A: Yes, Pilot participants may submit more than one FCC Form 470 through the Cybersecurity Pilot Program portal and separate components of their overall project. However, each FCC Form 470 must cover the full, three-year program term and must be submitted by the deadline of August 18, 2025 to allow for the timely submission of the FCC Form 471 before the application filing window closes on September 15, 2025.

Invoicing and Reimbursement

7.1 Q: Will the applicant have the option to select which invoicing method is used or will the service provider be able to decide?
A: Consistent with the E-Rate program, Pilot participants have the option to select which invoicing method they prefer. See 47 CFR § 54.2008(f).

7.2 Q: Will reimbursement be each year? Or at the end of the last year of the Pilot?
A: Requests for reimbursement may be submitted after equipment is received or services are provided. Any requests for reimbursement must be submitted within 90 days after the last date to receive equipment/service as set forth in the first funding commitment decision letter. See 47 CFR §§ 54.2001(c) and 2008(d).

7.3 Q: What are the requirements to be a service provider?
A: USAC's website lays out the process and requirements for becoming a service provider. Consistent with E-Rate program requirements, all service providers will be required to file an FCC Form 498 and obtain a service provider identification number (SPIN) if they do not already have one to be able to participate in the Pilot Program. Note that a prospective service provider does not need a SPIN in order to submit a bid but will need a SPIN to provide the eligible services/equipment and receive funding through the Pilot Program through either the Billed Entity Applicant Reimbursement (BEAR) or the Service Provider Invoice (SPI) invoicing methods.

7.4 Q: If an eligible school or library obtains an eligible service from a network provider, but such eligible service is being provided by a third-party vendor, is that still reimbursable under the program?
A: Resale arrangements are reimbursable under the Pilot Program if the applicable eligible cybersecurity services and equipment are received from an eligible service provider (i.e., a service provider that has a valid Service Provider Identification Number (SPIN) and has met all of the other requirements to participate as a service provider in the Pilot Program). The fact that the eligible services and equipment are provided by a third-party vendor to the eligible service provider (who then provides them to the Pilot Participant) does not change their eligibility, as long as the service provider with whom the school or library contracted for the eligible equipment/services is selected through a competitive bidding process that meets all of the Pilot Program's competitive bidding requirements (Pilot Program FCC Form 470) and the other Pilot program rules are met.

*7.5 Q: What is the Service Start Date for the Pilot Program?
A: The Service Start Date for the Pilot Program will coincide with the opening of the Pilot FCC Form 471 application filing window. That date will be announced in a forthcoming public notice.

This FAQ has been superseded by FAQ 1.8.

7.6 Q: Can a Pilot participant place an order for Pilot-funded equipment or services before it receives its funding commitment decision letter (FCDL)?
A: A Pilot participant may place an order for Pilot-funded equipment and services before it receives a Funding Commitment Decision Letter (FCDL) from USAC, but it assumes the risk to the extent the funding commitment amount on the FCDL may be less than the cost of what was purchased.

The service start date for the Pilot Program will coincide with the opening of the Cybersecurity Pilot Program FCC Form 471 application filing window. That date will be announced in a forthcoming Public Notice. See FAQ 7.5.

Performance Goals and Data Reporting

8.1 Q: Are there special reporting requirements that a Pilot participant would need to satisfy? If so, are such reports due monthly, yearly or only at the end of the Pilot?
A: Applicants that are selected to participate in the Pilot Program will be required to submit periodic reports, consisting of initial, annual, and final reports. Pilot-specific data reporting requirements, including the format for reporting such data and metrics, will be established by the FCC in forthcoming Public Notice(s). Please note that the failure to submit initial, annual, and final reports may result in a referral to the Enforcement Bureau, a hold on future disbursements, a rescission of committed funds, and/or recovery of disbursed funds. See 47 CFR § 54.2004(e).

8.2 Q: When will the reporting metrics be published, so that applicants are informed of what information they will be required to report to the FCC and can ensure that potential vendors are able to provide the required data?
A: Annual reporting requirements are expected to largely mirror the information that is required in the FCC Form 484 (Parts 1 and 2). Pilot participants may also be asked to answer a series of yes/no or multi-select questions to provide additional detail regarding their cybersecurity expertise and any cyber events that have taken place during the reporting term.

In establishing reporting requirements, the Commission is sensitive to balancing its need to collect Pilot Program data with the burden it puts on Pilot participants. All reporting requirements are subject to the Paperwork Reduction Act approval process.

*8.3 Q: The FCC Form 484, Part 1 asks a series of "yes" or "no" questions regarding an applicant's willingness (and the willingness of their selected service provider) to collect and share certain data if selected to participate in the Pilot Program. Are service providers required to share this data?
A: No, service providers are not required to share any data regarding the Cybersecurity Pilot Program with the FCC. However, Pilot participants may choose to require that their selected service provider(s) share certain data with them, including, for example, metrics around their participation in the program and data to help determine the cost-effectiveness of the Pilot Program. If Pilot participants require their selected service provider(s) to provide such data to them and wish to share the data with the FCC as part of the participants' initial, annual, or final data reporting requirements, they may choose to do so (see FAQs 8.1 and 8.2).

8.4 Q: Is there any further information regarding the reporting requirements available? When are they due and will training on these requirements be provided to Pilot participants?
A: The Wireline Competition Bureau (Bureau) provided further information regarding the reporting requirements in a Public Notice released on January 16, 2025. Specifically, regarding the submission of the initial report, information provided in the FCC Forms 484 Part 1 and 2 constitutes the necessary data to establish a reporting baseline for purposes of meeting this requirement; and, thus, the timely submission of these forms satisfies this requirement. Applicants were required to submit the FCC Form 484 Part 1 by November 1, 2024, and selected Pilot participants are required to submit Part 2 of the form by September 15, 2025. No other additional information is required of Pilot participants to satisfy the initial reporting requirement.

Regarding the submission of the annual and final reports, Pilot participants are required to submit each annual report no later than 60 days following the conclusion of the first and second years of the Pilot Program and the final report no later than 60 days following the conclusion of the final year of the three-year Pilot Program. The Bureau will announce when the annual reporting form has been approved by the Office of Management and Budget, and the Bureau or USAC will provide additional information regarding the deadlines for submitting the annual and final reports. As noted in the Public Notice, the deadline for the submission of the annual and final reports will be staggered based on the issuance date of a Pilot participant’s Funding Commitment Decision Letter(s).

For the annual reports, Pilot participants will be required to respond to questions similar to those included in the FCC Form 484 Part 1 and Part 2, as well as additional questions, which will allow participants to provide further detail regarding their cybersecurity expertise and any cybersecurity events that have taken place during the reporting period. A list of questions Pilot participants should be prepared to answer is included in the Public Notice. We expect USAC to announce trainings regarding these reporting requirements as the deadlines for submitting them approach.