(a) Intended use of support. Carriers receiving Alaska Connect Fund Fixed (Fixed ACF) support, as discussed in FCC 24-116, shall use the support to operate and maintain a network providing voice and broadband internet access service to all locations for which it is authorized to receive support consistent with the public interest obligations under paragraph (j) of this section;

(b) Term of support. Fixed ACF support shall be provided from January 1, 2029, through December 31, 2034.

(c) Eligible carriers. Fixed ACF support shall be available only to eligible telecommunications carriers in Alaska that have received or been awarded Federal or state government infrastructure support to deploy networks capable of providing voice service and broadband internet access service meeting the public interest obligations as described in paragraph (i) of this section but such eligible telecommunications carrier are not entitled to receive such support. The Wireline Competition Bureau shall determine carriers eligible to receive Fixed ACF support but may not authorize any carrier for Fixed ACF support that is not an eligible telecommunications carrier. The Wireline Competition Bureau shall use the Broadband Funding Map to assist in determining eligible carriers. The Wireline Competition Bureau shall determine, after opportunity for public notice and comment, whether additional financial or other requirements for participants in Fixed ACF are in the public interest.

(d) Eligible location. The Wireline Competition Bureau shall determine locations eligible for ACF Fixed support. In determining eligible locations, the Wireline Competition Bureau shall:

(i) Consider allocating Fixed ACF support based on the categories of locations as provided by the Alaska State Broadband Office for the purposes of the Broadband Equity, Access, and Deployment (BEAD) Program, authorized by the Infrastructure Investment and Jobs Act of 2021, Division F, Title I, section 60102, Public Law 117-58, 135 Stat. 429 (November 15, 2021); and

(ii) Not authorize Fixed ACF support for more than one carrier for any eligible location.

(e) Support amounts. The Wireline Competition Bureau shall determine an amount of annual support available for each eligible location.

(f) Budget. The total annual amount of support authorized may not exceed $107,600,000, the annual budget adopted by the Commission in FCC 24-116, or a budget adopted by the Wireline Competition Bureau pursuant to delegated authority. Any budget adopted pursuant to delegated authority may not exceed 15% above $107,600,000 per year.

(g) Election of support. The Wireline Competition Bureau shall adopt rules and provide guidance for the offer and election of Fixed ACF support no later than twelve months prior to the start of the Fixed ACF support term.

(h) Disbursement of Fixed ACF support. The Wireline Competition Bureau shall announce in a public notice when an eligible telecommunications carrier is authorized to receive Fixed ACF support. The public notice shall detail how disbursements will be made.

(i) Public interest obligations. The Wireline Competition Bureau shall adopt public interest obligations requiring the provision of voice service and broadband internet access service, requiring broadband speed of 100 Mbps download and 20 Mbps upload, with a round-trip latency of 100 ms or less, and usage capacity and rates that are reasonably comparable to comparable offerings in urban areas. The Wireline Competition Bureau may adopt public service obligations requiring broadband speeds below 100 Mbps download and 20 Mbps upload and/or round-trip latency greater than 100 ms to accommodate circumstances of specific locations. For purposes of determining reasonable comparable usage capacity, recipients are presumed to meet this requirement if they meet or exceed the usage level announced by public notice issued by the Wireline Competition Bureau and/or Office of Economics and Analytics. For purposes of determining reasonable comparability of rates, recipients are presumed to meet this requirement if they offer rates at or below the applicable benchmark to be announced annually by public notice issued by the Wireline Competition Bureau and/or the Office of Economics and Analytics, or no more than the non-promotional prices charged for a comparable fixed wireline service in urban areas in Alaska.

(j) Reporting obligations, compliance, and recordkeeping. (1) Recipients of Fixed ACF support shall be subject to the reporting obligations set forth in §§ 54.9, 54.10, 54.11, 54.313, and 54.314.

(2) Recipients of Fixed ACF support shall be subject to the reporting obligations set forth in § 54.316, to the extent the recipient has defined broadband deployment obligations.

(3) Recipients of Fixed ACF support shall comply with methodologies and non-compliance measures adopted pursuant to § 54.313(a)(6), as of the date the Alaska Connect Fund Order, FCC 24-116 was adopted, unless and until the Wireline Competition Bureau adopts network performance testing methodologies and non-compliance measures that account for unique aspects of Alaska.

(4) Recipients of Fixed ACF support shall be subject to the compliance measures, recordkeeping requirements, and audit requirements set forth in § 54.320(a) through (c).

(5) Recipients of Fixed ACF support shall be subject to the non-compliance measures set forth in § 54.320(d).

(k) Cybersecurity and supply chain risk management requirements. (1) A Fixed ACF carrier shall implement operational cybersecurity and supply chain risk management plans meeting the requirements of this section by January 1, 2029.

(2) A Fixed ACF carrier shall certify that it has implemented plans required under paragraph (k)(1) of this section and submit the plans to the Administrator by January 2, 2029, or within 30 days of approval under the Paperwork Reduction Act, whichever is later.

(3) Fixed ACF carriers that fail to comply with the requirements set forth in paragraphs (k)(1) and (2) are subject to the following non-compliance measures:

(i) The Wireline Competition Bureau shall direct the Administrator to withhold 25 percent of the Fixed ACF carrier's monthly support for failure to comply with paragraph (k)(2) of this section until the carrier makes the required certification and submits the required plans.

(ii) At any time during the support term, if a Fixed ACF carrier does not have in place operational cybersecurity and supply chain risk management plans meeting the requirements of this section, the Wireline Competition Bureau shall direct the Administrator to withhold 25 percent of the carrier's monthly support.

(iii) Once the carrier comes into compliance, the Administrator shall stop withholding support, and the carrier will receive all of the support that had been withheld pursuant to this section.

(4) A Fixed ACF carrier's cybersecurity risk management plans shall reflect at least the National Institute of Standards and Technology's Framework for Improving Critical Infrastructure Cybersecurity v.1.1 (2018) (NIST Framework), or any successor version of the NIST Framework, and must reflect established cybersecurity best practices that address each of the Core Functions described in the NIST Framework, such as the standards and controls set forth in the Cybersecurity & Infrastructure Security Agency (CISA) Cybersecurity Cross-sector Performance Goals and Objectives (CISA CPGs) or the Center for internet Security Critical Security Controls (CIS Controls).

(5) A Fixed ACF carrier's supply chain risk management plans shall reflect the key practices discussed in NISTIR 8276, Key Practices in Cyber Supply Chain Risk Management: Observations from Industry, and related supply chain risk management guidance from NIST 800-161.

(6) If a Fixed ACF carrier makes a substantive modification to its plans under this section, the carrier shall file an updated plan with the Administrator within 30 days of making the modification. A modification to a plan under this section is substantive if at least one of the following conditions apply:

(i) There is a change in the plan's scope, including any addition, removal, or significant alternation to the types of risks covered by the plan (e.g., expanding a plan to cover new areas such as supply chain risks to Internet of Things devices or cloud security could be a substantive change);

(ii) There is a change in the plan's risk mitigation strategies (e.g., implementing a new encryption protocol or deploying a different firewall architecture);

(iii) There is a shift in organizational structure (e.g., creating a new information technology department or hiring a Chief Information Security Officer);

(iv) There is a shift in the threat landscape prompting the organization to recognize the emergence of new threats or vulnerabilities that weren't previously accounted for in the plan;

(v) Any updates are made to comply with new cybersecurity regulations, standards, or laws;

(vi) Significant changes are made in the supply chain, including offboarding major suppliers or vendors, or shifts in procurement strategies that may impact the security of the supply chain; or

(vii) Any large-scale technological change is made, including the adoption of new systems or technologies, migrating to a new information technology infrastructure, or significantly changing the information technology architecture.