Why the FCC is asking 450 carriers to resubmit cybersecurity plans they already filed?

The paperwork behind the broadband build

A notice appeared in the Federal Register on September 4, 2026. It does not announce a new rule. It asks the public to comment on extending an existing paperwork requirement. The requirement itself took effect January 1, 2024. Carriers receiving Enhanced A-CAM support must file operational cybersecurity and supply chain risk management plans with the Universal Service Administrative Company. They had until February 12, 2024 to do so. Miss the deadline and 25 percent of monthly support gets withheld until compliance.

The collection carries OMB control number 3060-1319. The current approval expires. The FCC wants it renewed for another three years. That is what this notice is about. The comment window closes October 5, 2026.

Who files and what it costs

Four hundred fifty respondents. Nine hundred responses. Each response takes between 10 and 50 hours. The math yields 27,000 total burden hours per year. The FCC lists total annual cost as zero. That means no filing fees. The cost is time. Staff hours. Legal review. Technical documentation. For a carrier with fewer than 25 employees, the Small Business Paperwork Relief Act of 2002 requires the FCC to ask specifically how to reduce that burden further. The notice invites those comments too.

The plans are not one-and-done. A substantive modification triggers a 30-day resubmission clock. The frequency line in the notice reads: "One-time and on occasion reporting requirements." That phrase covers both the initial filing and every update thereafter.

Why the plans exist in the first place

July 24, 2023. The Commission released the Enhanced A-CAM Order. It created a voluntary path for carriers already receiving Alternative Connect America Cost Model support. The goal: deploy 100/20 Mbps broadband across rural areas by the end of 2028. The order extended support terms by 10 years beyond the remaining five. Fifteen years total. The budget ceiling: $1.27 billion annually. Up to $1.33 billion if certain conditions are met.

Other federal broadband programs — BEAD, ReConnect, Tribal Broadband — already required cybersecurity and supply chain plans. The Commission did not want Enhanced A-CAM areas to fall behind. So it imposed the same requirement. Carriers certify compliance to USAC. USAC administers the Universal Service Fund. The fund pays the support. The plans are the condition.

What the notice does not say

The document does not say how many carriers have already filed. It does not say how many have had support withheld. It does not describe what a "substantive modification" looks like in practice. It does not break down the 10-to-50-hour range by carrier size or plan complexity. It does not say whether the 27,000-hour estimate assumes every carrier updates its plan every year. The notice is a procedural step. The substantive requirements live in the 2023 order. This filing keeps the paperwork authority alive.

Where to comment

Comments go to www.reginfo.gov/public/do/PRAMain. Select "Currently under 30-day Review — Open for Public Comments." Search for OMB 3060-1319. A copy must also be emailed to PRA@fcc.gov and Nicole.Ongele@fcc.gov. Nicole Ongele is the FCC contact. Phone: (202) 418-2991. The docket number is WC Docket No. 10-90 et al. The FCC will review every submission before asking OMB for final approval.