Broadband public interest obligations for recipients of high-cost support

(ii) Capped locations. Capped locations are those locations in census blocks for which A-CAM calculates an average cost per location above the funding cap. Carriers are required to offer broadband speeds to locations that are receiving capped support, as specified by public notice at the time of authorization, as follows:

(A) Carriers with a state-level density of more than 10 housing units per square mile, as specified by public notice at the time of election, are required to offer broadband speeds of at least 4 Mbps downstream/1 Mbps upstream to 50 percent of all capped locations in the state by the end of the ten-year period.

(B) Carriers with a state-level density of 10 or fewer housing units per square mile, as specified by public notice at the time of election, are required to offer broadband speeds of at least 4 Mbps downstream/1 Mbps upstream to 25 percent of capped locations in the state by the end of the ten-year period.

(C) Carriers shall provide to all other capped locations, upon reasonable request, broadband at actual speeds of at least 4 Mbps downstream/1 Mbps upstream.

(iii) Revised A-CAM I carriers, as defined by § 54.311(a)(2), must offer the following broadband speeds to locations that are fully funded, as specified by public notice at the time of the authorizations, as follows:

(A) Revised A-CAM I carriers with a state-level density of more than 10 housing units per square mile, as specified by public notice at the time of election, are required to offer broadband speeds of at least 25 Mbps downstream/3 Mbps upstream to 85 percent of all fully funded locations in the state by the end of the term.

(B) Revised A-CAM I carriers with a state-level density of 10 or fewer, but more than five, housing units per square mile, as specified by public notice at the time of election, are required to offer broadband speeds of at least 25 Mbps downstream/3 Mbps upstream to 65 percent of fully funded locations in the state by the end of the term.

(C) Revised A-CAM I carriers with a state-level density of five or fewer housing units per square mile, as specified by public notice at the time of election, are required to offer broadband speeds of at least 25 Mbps downstream/3 Mbps upstream to 50 percent of fully funded locations in the state by the end of the term.

(iv) A-CAM II carriers, as defined by § 54.311(a)(3), must offer broadband speeds of at least 25 Mbps downstream/3 Mbps upstream to 100 percent of fully funded locations in the state by the end of the term, and therefore have no additional 10/1 Mbps obligation.

(v) After December 31, 2023, to the extent that an Enhanced A-CAM carrier was previously subject to the foregoing deployment obligations pursuant to A-CAM I, Revised A-CAM I, or A-CAM II, the Enhanced A-CAM carrier will instead be subject to § 54.308(a)(3).

(2) Rate-of-return recipients of Connect America Fund Broadband Loop Support (CAF BLS) shall be required to offer broadband service at actual speeds of at least 25 Mbps downstream/3 Mbps upstream, over a five-year period, to a defined number of unserved locations as specified by public notice, as determined by the following methodology:

(i) Percentage of CAF BLS. Each rate-of-return carrier is required to target a defined percentage of its five-year forecasted CAF BLS support to the deployment of broadband service to locations that are unserved with 25 Mbps downstream/3 Mbps upstream broadband service as follows:

(A) Rate-of-return carriers with less than 20 percent deployment of 25/3 Mbps broadband service in their study areas, as determined by the Bureau, will be required to use 35 percent of their five-year forecasted CAF BLS support to extend broadband service where it is currently lacking.

(B) Rate-of-return carriers with more than 20 percent but less than 40 percent deployment of 25/3 Mbps broadband service in their study areas, as determined by the Bureau, will be required to use 25 percent of their five-year forecasted CAF BLS support to extend broadband service where it is currently lacking.

(C) Rate-of-return carriers with more than 40 percent deployment of 25/3 Mbps broadband service in their study areas, as determined by the Bureau, will be required to use 20 percent of their five-year forecasted CAF BLS support to extend broadband service where it is currently lacking.

(ii) Cost per location. The deployment obligation shall be determined by dividing the amount of support set forth in paragraph (a)(2)(i) of this section by a cost per location figure based on one of two methodologies, at the carrier's election:

(A) The higher of:

(1) The weighted average unseparated cost per loop for carriers of similar density that offer 25/3 Mbps or better broadband service to at least 95 percent of locations, based on the most current FCC Form 477 data as determined by the Bureau, but excluding carriers subject to the current per-line per-month cap set forth in § 54.302 and carriers subject to limitations on operating expenses set forth in § 54.303; or

(2) 150% of the weighted average of the cost per loop for carriers of similar density, but excluding carriers subject to the per line per month cap set forth in § 54.302 and carriers subject to limitations on operating expenses set forth in § 54.303, with a similar level of deployment of 25/3 Mbps or better broadband based on the most current FCC Form 477 data, as determined by Bureau; or

(B) The average cost per location for census blocks lacking 25/3 Mbps broadband service in the carrier's study area as determined by the A-CAM.

(iii) Restrictions on deployment obligations. No rate-of-return carrier shall deploy terrestrial wireline technology in any census block if doing so would result in total support per line in the study area to exceed the per-line per-month cap in § 54.302.

(iv) Future deployment obligations. Prior to publishing the deployment obligations for subsequent five-year periods, the Administrator shall update the unseparated average cost per loop amounts for carriers with 95 percent or greater deployment of the then-current standard, based on the then-current NECA cost data, and the Wireline Competition Bureau shall examine the density groupings and make any necessary adjustments based on then-current U.S. Census data.

(3) An Enhanced A-CAM carrier, as defined by § 54.311(a)(4), must offer broadband speeds of at least 100 Mbps downstream/20 Mbps upstream to 100 percent of locations in its study areas within the state by the end of 2028.

(i) Enhanced A-CAM required locations are those locations identified in the National Broadband Map within the carrier's service area where voice and terrestrial broadband services of speeds 100 Mbps downstream/20 Mbps upstream or faster are not yet available or lack an enforceable commitment for deployment of such broadband service. In the context of Enhanced A-CAM, an enforceable commitment exists where a carrier commits to deploying broadband service as a condition of any federal or state grants or other funding. The Wireline Competition Bureau shall provide a list of Enhanced A-CAM required locations for each carrier concurrently with the Enhanced A-CAM offer pursuant to § 54.311(a), and will update such list to reflect any additional information related locations, broadband coverage, or enforceable commitments determined to have existed at the time of the offer.

(ii) An Enhanced A-CAM carrier that has reported deployment of 100 Mbps downstream/20 Mbps upstream or faster service to particular locations in its Enhanced A-CAM study area(s) in the National Broadband Map or the Universal Service Administrative Company's High Cost Universal Broadband Portal must maintain the same or faster service at those locations through the end of the Enhanced A-CAM term.

(b) Rate-of-return carrier recipients of high-cost support are required upon reasonable request to bid on category one telecommunications and Internet access services in response to a posted FCC Form 470 seeking broadband service that meets the connectivity targets for the schools and libraries universal service support program for eligible schools and libraries (as described in § 54.501) within that carrier's service area. Such bids must be at rates reasonably comparable to rates charged to eligible schools and libraries in urban areas for comparable offerings.

(c) Alaska Plan recipients. Alaskan rate-of-return carriers receiving support from the Alaska Plan pursuant to § 54.306 are exempt from paragraph (a) of this section and are instead required to offer voice and broadband service with latency suitable for real-time applications, including Voice over internet Protocol, and usage capacity that is reasonably comparable to comparable offerings in urban areas, at rates that are reasonably comparable to rates for comparable offerings in urban areas, subject to any limitations in access to backhaul as described in § 54.313(g). Alaska Plan recipients' specific broadband deployment and speed obligations shall be governed by the terms of their approved performance plans as described in § 54.306(b). Alaska Plan recipients must also comply with paragraph (b) of this section.

(d) Mobile carriers that are receiving support from the Alaska Plan pursuant to § 54.317(e) shall certify in their annual compliance filings that their rates are reasonably comparable to rates for comparable offerings in urban areas. The mobile carrier must also demonstrate compliance at the end of the five-year milestone and 10-year milestone and may do this by showing that its required stand-alone voice plan, and one service plan that offers broadband data services, if it offers such plans, are:

(1) Substantially similar to a service plan offered by at least one mobile wireless service provider in the cellular market area (CMA) for Anchorage, Alaska, and

(2) Offered for the same or a lower rate than the matching plan in the CMA for Anchorage.

(e) Minimum provision of service. Mobile providers receiving support from the Alaska Connect Fund must provide service at the same minimum service levels as required under the Alaska Plan and may not provide less coverage or provide service using a less advanced technology than the provider committed to under the Alaska Plan.

(1) This includes continuing to provide voice service, maintaining at least the level of data service the mobile provider offered to its previous coverage area as of the end of the Alaska Plan, and improving service consistent with the mobile provider's approved performance plan through the end of Alaska Connect Fund.

(2) The Wireless Telecommunications Bureau in coordination with the Office of Economics and Analytics have authority to compare Broadband Data Collection availability data as of December 31, 2026, with subsequent Broadband Data Collection availability data to ensure that mobile voice and mobile broadband service levels and coverage are maintained or improved in all previously served areas.

(f) Reasonably comparable services and rates. A mobile provider that is receiving support from the Alaska Connect Fund pursuant to § 54.318 shall certify in its annual compliance filings that its rates are reasonably comparable to rates for comparable offerings in the Cellular Market Area (CMA) for Anchorage, Alaska. An Alaska Connect Fund mobile provider must also demonstrate compliance in duplicate-support areas by December 31, 2029, and in single support areas by December 31, 2029, December 31, 2031, and December 31, 2034, by showing that it publishes, on its publicly accessible website at least one mobile broadband plan and at least one stand-alone voice plan that meets the following requirements:

(1) Is substantially similar to a service plan offered by at least one different mobile provider in the CMA for Anchorage, Alaska, and

(2) Is offered for the same or a lower rate than the matching plan in the CMA for Anchorage.

(3) This demonstration must include usage allowances for the comparable plans in Anchorage.

(4) The Wireless Telecommunications Bureau may employ alternative benchmarks or dates appropriate for specific competitive Eligible Telecommunications Carriers in assessing carrier offerings.

(g) Enhanced A-CAM Cybersecurity and Supply Chain Risk Management Requirements. (1) An Enhanced A-CAM carrier shall implement operational cybersecurity and supply chain risk management plans meeting the requirements of this section by January 1, 2024.

(2) An Enhanced A-CAM carrier shall certify that it has implemented plans required under paragraph (e)(1) of this section and submit the plans to the Administrator by January 2, 2024 or within 30 days of approval under the Paperwork Reduction Act, whichever is later.

(3) Enhanced A-CAM carriers that fail to comply with Enhanced A-CAM cybersecurity and supply chain risk management requirements are subject to the following non-compliance measures:

(i) The Wireline Competition Bureau shall direct the Administrator to withhold 25 percent of the Enhanced A-CAM carrier's monthly support for failure to comply with paragraph (e)(2) of this section until the carrier makes the required certification and submits the required plans.

(ii) At any time during the support term, if an Enhanced A-CAM carrier does not have in place operational cybersecurity and supply chain risk management plans meeting the requirements of this section, Wireline Competition Bureau shall direct the Administrator to withhold 25 percent of the carrier's monthly support.

(iii) Once the carrier comes into compliance, the Administrator shall stop withholding support, and the carrier will receive all of the support that had been withheld pursuant to this section.

(4) An Enhanced A-CAM carrier's cybersecurity risk management plans shall reflect the latest version of the National Institute of Standards and Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity, and shall reflect an established set of cybersecurity best practices, such as the standards and controls set forth in the Cybersecurity & Infrastructure Security Agency (CISA) Cybersecurity Cross-sector Performance Goals and Objectives or the Center for Internet Security Critical Security Controls.

(5) An Enhanced A-CAM carrier's supply chain risk management plans shall incorporate the key practices discussed in NISTIR 8276, Key Practices in Cyber Supply Chain Risk Management: Observations from Industry, and related supply chain risk management guidance from NIST 800-161.

(6) If an Enhanced A-CAM carrier makes a substantive modification to its plans under this section, the carrier shall file an updated plan with the Administrator within 30 days of making the modification. A modification to a plan under this section is substantive if at least one of the following conditions apply:

(i) There is a change in the plan's scope, including any addition, removal, or significant alternation to the types of risks covered by the plan (e.g., expanding a plan to cover new areas such as supply chain risks to Internet of Things devices or cloud security could be a substantive change);

(ii) There is a change in the plan's risk mitigation strategies (e.g., implementing a new encryption protocol or deploying a different firewall architecture);

(iii) There is a shift in organizational structure (e.g., creating a new information technology department or hiring a Chief Information Security Officer);

(iv) There is a shift in the threat landscape prompting the organization to recognize that emergence of new threats or vulnerabilities that weren't previously accounted for in the plan;

(v) Any updates made to comply with new cybersecurity regulations, standards, or laws;

(vi) Significant changes in the supply chain, including offboarding major suppliers or vendors, or shifts in procurement strategies that may impact the security of the supply chain; or

(vii) Any large-scale technological changes, including the adoption of new systems or technologies, migrating to a new information technology infrastructure, or significantly changing the information technology architecture.

(h) Alaska Connect Fund mobile provider cybersecurity and supply chain risk management requirements. (1) An Alaska Connect Fund mobile support recipient must implement operational cybersecurity and supply chain risk management plans meeting the requirements of this section as a condition of receiving Alaska Connect Fund support. All mobile provider recipients must implement their cybersecurity and supply chain risk management plans by December 31, 2029.

(2) An Alaska Connect Fund mobile support recipient must certify that it has implemented the plans required under paragraph (h)(1) of this section and must submit the plans to the Administrator by December 31, 2029, or within 30 days of approval under the Paperwork Reduction Act, whichever is later.

(3) An Alaska Connect Fund mobile support recipient that fails to comply with any Alaska Connect Fund cybersecurity or supply chain risk management requirement is subject to the following non-compliance measures:

(i) The Wireless Telecommunications Bureau shall direct the Administrator to withhold 25 percent of the Alaska Connect Fund support recipient's monthly support for failure to comply with paragraphs (h)(1) and (2) of this section until the support recipient comes into compliance.

(ii) At any time during the support term, if an Alaska Connect Fund mobile support recipient does not have in place operational cybersecurity and supply chain risk management plans meeting the requirements of this section, the Wireless Telecommunications Bureau shall direct the Administrator to withhold 25 percent of the support recipient's monthly support.

(iii) Once the Alaska Connect Fund mobile support recipient comes into compliance, the Administrator shall stop withholding support, and the support recipient will receive all of the support that had been withheld pursuant to this section.

(4) An Alaska Connect Fund mobile support recipient's cybersecurity risk management plan must reflect at least the National Institute of Standards and Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity v.1.1 (2018) (NIST Framework) or any successor version of the NIST Framework, that may be adopted by the Wireline Competition Bureau, the Wireless Telecommunications Bureau, and the Public Safety and Homeland Security Bureau after notice and comment, and must reflect established cybersecurity best practices that address each of the Core Functions described in the NIST Framework, such as the standards and controls set forth in the Cybersecurity & Infrastructure Security Agency (CISA) Cybersecurity Cross-sector Performance Goals and Objectives or the Center for internet Security Critical Security Controls.

(5) An Alaska Connect Fund mobile support recipient's supply chain risk management plan must reflect the key practices discussed in NISTIR 8276, Key Practices in Cyber Supply Chain Risk Management: Observations from Industry, and related supply chain risk management guidance from NIST 800-161.

(6) If an Alaska Connect Fund mobile support recipient makes a substantive modification to a plan under this section, the provider must file an updated plan with the Administrator within 30 days of making the modification. A modification to a plan under this section is substantive if at least one of the following conditions apply:

(i) There is a change in the plan's scope, including any addition, removal, or significant alteration to the types of risks covered by the plan (e.g., expanding a plan to cover new areas, such as supply chain risks to Internet of Things devices or cloud security, could be a substantive change);

(ii) There is a change in the plan's risk mitigation strategies (e.g., implementing a new encryption protocol or deploying a different firewall architecture);

(iii) There is a shift in organizational structure (e.g., creating a new information technology department or hiring a Chief Information Security Officer);

(iv) There is a shift in the threat landscape prompting the organization to recognize that emergence of new threats or vulnerabilities that were not previously accounted for in the plan;

(v) Updates are made to comply with new cybersecurity regulations, standards, or laws;

(vi) Significant changes are made in the supply chain, including offboarding major suppliers or vendors, or shifts in procurement strategies that may impact the security of the supply chain; or

(vii) A large-scale technological change is made, including the adoption of new systems or technologies, migrating to a new information technology infrastructure, or significantly changing the information technology architecture.