Schools and libraries have long been attractive targets to cybercriminals, as many of these institutions lack the resources to develop and maintain a strong cybersecurity posture. A recent survey found that at least 30% of education technology leaders said their district fell victim to a breach in the past year. It's no surprise, then, that cybersecurity remains the top concern for these leaders, with nearly all survey respondents saying they are actively working to improve cybersecurity protections.

It's vital that the public and private sectors work together to help bolster cybersecurity across our nation's schools and related institutions. I recently wrote about various ways the Federal Communications Commission (FCC) could help schools and libraries better protect their IT networks from increasing cyberattacks and rising ransom demands, particularly at a time when bad actors are taking greater advantage of these institutions that lack robust defenses. As a result of the leadership of FCC Chairwoman Jessica Rosenworcel and her "Learn Without Limits" initiative, the FCC voted to establish the three-year Schools and Libraries Cybersecurity Pilot Project called "CyberPilot." This CyberPilot initiative provides$200 million in Universal Service Funding (USF) to schools and libraries to allow them to fund services and equipment to better protect their networks from cyberattacks. 

While$200 million is not enough to fund all of the ongoing cybersecurity needs of the nation's schools and libraries, the CyberPilot program is a significant step in the right direction. This initiative will help the FCC evaluate how the commission should support the cybersecurity needs of schools and libraries over a longer term, and a related study will be released toward the end of the three-year pilot to evaluate the program costs and benefits to grantees.

What Schools and Libraries Need to Know about the FCC CyberPilot Grants

With the introduction of any new program, the institutions benefitting from the initiative should understand the details of the offering and how the effort can meet each entity's unique cyber needs.

Understand Eligibility

Elementary and secondary schools, excluding for-profit schools and those with endowments exceeding$50 million, can apply for a grant. Eligible libraries include public libraries, a public elementary school or secondary school library, a tribal library, an academic library, a research library, and a private library, which the state considers a library. Consortia-any local, tribal, statewide, regional, or interstate cooperative association of schools and libraries-are eligible on behalf of some or all of its members.

Develop Your Application

Schools and libraries interested in obtaining an FCC CyberPilot grant should be aware that applications will not be accepted until the Office of Management and Budget (OMB) approves the program application form. The FCC and Universal Service Administrative Company, the third-party administrator, have prepared a draft of the application and submitted it to OMB, and they are now awaiting approval of the form. In the meantime, schools and libraries should begin to prepare their applications in the next few months to have the best application possible in what promises to be a keenly competitive process. Small and midsize applicants should seek help from established cybersecurity companies to create applications that follow the program rules closely.

Understand Grant Amounts

A grantee will receive a fixed budget per student for schools and per library for libraries, with consortia receiving funding based on student count and library sites. At a minimum, a school or school district may receive$15,000 annually for three years. For school districts with more than 1,100 students, the budget is calculated using the price of$13.60 per-student multiplier, subject to a maximum of$1.5 million.

An eligible library may receive up to$15,000 annually. Library systems with more than 11 sites are eligible for support up to$175,000. Funding for eligible school or library consortia is based on a combination of student count using the$13.60 per-student multiplier and a$1.5 million funding cap or the number of library sites using the$15,000 annual per library budget and the$175,000 funding cap. 

The FCC will allow flexible spending within the three-year budget, so the school or library can achieve its cyber goals if it needs to front-load its resources. Participants can ask for reimbursement as expenses are incurred, with a 90-day deadline to request reimbursement.

As with the existing E-Rate program, grantees must contribute a portion of costs determined by their Category One discount rate. Discount rates are tracked with the usual Category One discount matrix.

Finally, the FCC will prioritize under-resourced schools and libraries to ensure meaningful participation in the CyberPilot initiative. If applications exceed the$200 million available, the FCC will fund the highest discount applicants first. 

What Expenses Are Eligible for Reimbursement Under the Grant Program?

A variety of cybersecurity expenses are eligible for reimbursement under the CyberPilot effort. These include costs related to installing and configuring eligible cybersecurity equipment and services. This may be a one-time purchase or a recurring service, such as an ongoing service contract. Examples of eligible expenses include:

• Next-generation firewalls
• Distributed denial-of-service protection
• Firewall-as-a-Service
• Integrated intrusion prevention systems
• Internet-of-Things security
• Antispam technology
• Antivirus technology
• Endpoint detection and response
• Domain Name System (DNS)-layer security, blocking, and filtering
• Email and web security
• Training (eligible under select circumstances)

Prioritizing the Cybersecurity of Our Nation's Education Institutions

The FCC CyberPilot program is a significant milestone in prioritizing the cybersecurity of our nation's schools and libraries. I urge schools and libraries to take advantage of this rare offering to ensure the sensitive data they hold-including information about students, faculty, and patrons-is protected by best-in-class cybersecurity technologies.