Cybersecurity Pilot Application Window Opens

September 18, 2024

~ User Guide Available ~

~ FAQs Updated ~

Yesterday, the FCC’s $200 million Cybersecurity Pilot Program (CPP) Form 484 Part 1 Application Window opened in EPC, and will close on November 1, 2024.  Applicants can start the application and save it as a draft, but will not be able to certify it until the FCC makes a special announcement (they need to clear a small administrative hurdle before they can accept certified forms). 

The Form 484 contains 6 sections, with multiple questions within each section.  Some questions (especially Y/N questions) contain progressive disclosure, depending on your answers.  A few of the questions appear to ask the same question, but they are, in fact, slightly different.

Form 484 User Guide:  USAC has posted a Cyber Pilot Form 484 User Guide at: https://e-ratepa.org/wp-content/uploads/2024/09/USAC-Form-484-Part-1-User-Guide.pdf.  The Guide is outstanding and I encourage everyone to review it prior to starting the application, and use it as a resource as you are working your way through the application.  The Guide also shows exactly what questions are asked and what your possible answers can be. 

Where to Find Cybersecurity Pilot Portal:  When you log in to EPC, click on the waffle in the upper right corner of your Landing Page. 

Do you get this message instead of seeing the CPP Portal?

If so, it means that your EPC Account Administrator (AA) has not yet granted you permission under User Permissions in their AA EPC Portal.  Below are instructions for how the AA can manage EPC User Permissions.  If you’re unsure who is your EPC AA for your school or library, or if that person is no longer with the organization, call USAC at 888-203-8100 and they will work with you to change the EPC AA to a different staff member.   

Instructions for Designating Cyber Pilot Users in EPC: Applicants are now able to designate which EPC users will have certain permissions for the Cybersecurity Pilot Program.  To review and set user permission levels, applicants should follow the steps (note – USAC denotes the Pilot at CBR in EPC): 

  1. Log into EPC
  2. From the landing page, click Manage Users
  3. Check the checkbox for your Billed Entity Number (BEN) and select Manage User Permissions
  4. Select CBR User Permissions
  5. Select the appropriate CBR 484 Permission level for each user
  6. Click Submit

Granting Permission to E-rate Consultants:  Because of the highly sensitive nature of the Form 474 data, only 3 consultant contacts may be granted access to your CPP Portal.  There is no limit to the number of school or library staff that are EPC Users who may be granted access.

Most Frequently Asked Questions I’m Receiving:

  1. Should I submit separate applications for each service type?  Answer:  No – all services/equipment must be put on a single Form 484 application.  In fact, the system will only permit each applicant to submit a single application.
  2. Is this funding basically guaranteed like it is with E-rate and was with ECF?  Answer:  No – this is a competitive grant and only $200 million is available. 
  3. Can I skip this application window and just apply next year?  Answer:  No – although the FCC said this is a 3-year program, there is only one application window.  But applicants may apply for 3 years’ worth of equipment and services.
  4. How will applicants be selected?  The FCC will target Pilot funds to the populations most in need of cybersecurity support.  If more than $200 million funding is requested, the FCC will prioritize highest discount applicants but will also ensure that selectees are geographically and size diverse.
  5. Will we be required to participate in the data reporting program/process if we’re selected?  Yes.  I encourage applicants to consider this added layer of effort when deciding whether they wish to apply.

Updated FCC Cyber Pilot FAQs:  The FCC has just provided additional updates to the Cyber Pilot FAQs (new FAQs always marked with *) which I’ve pasted below (important clarifications highlighted).

* 5.2a Q: How do the prioritization rules fit with the goal to have a diversity of applicants?

A: If demand is greater than the $200 million cap, the FCC will look at applicants’ discount band to select Pilot participants. Consistent with Pilot Program rules, applications in the 90% discount band will be reviewed first. If there is not enough support to fund all requests within the 90% discount band, the FCC will look at applicants’ specific National School Lunch Program percentages, starting with the highest percentage. To ensure diversity in the applicant pool, application review will also consider the other criteria identified in the Report and Order – applicant type, urban/rural, small/large, and Tribal – within each discount band.

* 5.4 Q: How long will it take for Pilot Program participants to be selected?

A: USAC, together with the FCC, expects to complete review of Part 1 of the applications and select participants as expeditiously as possible. The timing of the selection process will depend on the number and quality of the applications received.

* 5.6 Q: If I am selected to participate in the Pilot Program, do I need to remain in it for all three years?

A: Yes, we expect applicants selected to participate in the Pilot Program will be committed to participating for the entire three-year term of the Pilot. In doing so, we expect it will help participants maximize their benefits and ensure the Commission is able to gather the data it needs to fully evaluate the Pilot. Additionally, we hope participants will be mindful of the opportunity to participate in the program and recognize the many others who, if selected, would be eager to participate for the entire three-year term. Choosing to participate in the Pilot but failing to satisfy Program requirements (such as reporting obligations) by withdrawing early from the Pilot may result in a referral of a participant to the Enforcement Bureau, a hold on future disbursements, a rescission of committed funds, and/or recovery of disbursed funds.

* 5.12 Q: Does our willingness to share data affect our chance of being selected?

A: Yes. Given the underlying purposes of the Pilot and the importance of the performance goals and data reporting to the Pilot Program, the FCC will consider an applicant’s willingness to provide data when selecting Pilot participants. Specific data reporting requirements will be established in forthcoming Public Notice(s). See FAQ 8.1.

* 5.13 Q: Will I improve my chances at being selected if I only ask for funding to support basic cybersecurity needs or should I opt for a more comprehensive solution?

A: There is no “right” or “wrong” answer to any of the questions regarding an applicant’s experience, needs, or resources. Applicants should answer truthfully and thoughtfully about what solutions best fit their needs, given resource and other considerations. One of our goals is to ensure the Pilot contains a diverse cross-section of applicants with differing cybersecurity postures and experiences.

* 5.14 Q: Will I improve my chance of being selected for participation in the Pilot if my project will be “self-sustaining” at the conclusion of the Pilot Program? What does it mean to be “self-sustaining”?

A: There is no “right” or “wrong” answer to the question regarding whether an applicant’s Pilot project will be self-sustaining at the conclusion of the Pilot Program. Applicants should answer truthfully and thoughtfully, based on their best estimate regarding resources that will be available at the conclusion of the Pilot Program. A project is considered “self-sustaining” if it can remain operational (i.e., the applicant has the ability to continue the service or maintain the equipment) without additional Pilot funds at the end of the program. Applicants will be requested to identify what funding source, if any, they expect to utilize, including federal, state, local, Tribal, or other funding sources.

* 5.15 Q: Can I modify the proposed Pilot project I submitted with the FCC Form 484 Part 1 after I am selected to participate in the Pilot Program?

A: Yes, Pilot participants may modify their Pilot project after they submit their FCC Form 484 Part 1. However, once the FCC has issued a Funding Commitment Decision Letter approving a participant’s requested cybersecurity services and equipment, any subsequent changes would require approval consistent with the Pilot Program rules.

* 5.16 Q: What are the consequences if an individual school or library applies as both an individual and consortium (i.e., submits duplicative applications)?

A: Individual and consortia applicants should make every effort to ensure that an individual school or library is applying only once to participate in the Pilot Program. An applicant should contact USAC as soon as it becomes aware of any duplicative applications. If an applicant inadvertently applies both individually and as part of a consortium, it will need to decide which application it wants to be included on and which application USAC should remove it from. If the applicant decides to pursue an individual application and asks USAC to remove it from a consortium application, the applicant should notify the Consortium Leader that it no longer wants to be listed on the consortium application so that the consortium may modify its application accordingly. Failure to correct the duplicative applications could result in the applicant and/or the consortium being removed from the Pilot Program.

* 7.3 Q: What are the requirements to be a service provider?

A: USAC’s website lays out the process and requirements for becoming a service provider. Consistent with E-Rate program requirements, all service providers will be required to file an FCC Form 498 and obtain a service provider identification number (SPIN) if they do not already have one to be able to participate in the Pilot Program. Note that a prospective service provider does not need a SPIN in order to submit a bid but will need a SPIN to provide the eligible services/equipment and receive funding through the Pilot Program through either the Billed Entity Applicant Reimbursement (BEAR) or the Service Provider Invoice (SPI) invoicing methods.

Additional Resources:                                                                                                                

Please let me know what unanswered questions you have as you review the Form 484.  If I don’t know the answers, I’ll seek clarification from USAC/FCC.    

— Julie

Julie Tritt Schell
Pennsylvania E-rate Coordinator
717-730-7133 – o
jtschell@comcast.net
www.e-ratepa.org    

Site designed and maintained by Silver Penny Studio