Governance, risk & compliance

Children's Internet Protection Act (CIPA), E-rate certifications 47 U.S.C. 254(h), (l); 47 CFR 54.520, eCFR read 24 Oct 2026

CIPA (Public Law 106-554, Title XVII; 47 U.

S. C.

254(h) and (l)) conditions federal E-rate discounts and some library funding on internet safety measures. It applies to a school or library that receives E-rate discounts for internet access or internal connections; a school that receives discounts only for telecommunications services is not subject to it but must say so on the certification (47 CFR 54.

520(b)). Each funding year the billed entity certifies that an internet safety policy is being enforced (s.

54. 520(c)).

The policy must include a technology protection measure that blocks or filters visual depictions that are obscene or child pornography, and, for use by minors, harmful to minors; the measure may be disabled for an adult for bona fide research or another lawful purpose. A 'minor' here is anyone under 17.

For schools the policy must also provide for monitoring the online activities of minors and, since 1 July 2012, for educating minors about appropriate online behaviour, including social networking sites, chat rooms and cyberbullying awareness and response. It must address access by minors to inappropriate matter, the safety and security of minors using email, chat and other direct communications, unauthorized access and hacking by minors, unauthorized disclosure of minors' personal information, and measures to restrict access to harmful material.

The school must give reasonable public notice and hold at least one public hearing or meeting on the proposed policy (s. 54.

520(h)). What counts as inappropriate matter is decided locally; no federal body may set the criteria (s.

54. 520(c)(4)).

A school that knowingly fails to certify is ineligible for discounts; one that knowingly fails to enforce must reimburse discounts for the period (s. 54.

520(d) and (e)). Records are kept 10 years after the last day of the funding year or service delivery deadline (s.

54. 516).

The FCC adopted a notice of proposed rulemaking on E-rate on 25 June 2026 that asks, among other things, whether its reading of CIPA should change, including whether filtering should reach devices other than school-owned computers. It is a proposal only; the rule above is the one in force when this was written.

Service providers do not certify, but schools rely on them for the filter, the logs and the evidence. General information, not legal advice.

How Lavawall® helps you get to Children's Internet Protection Act (CIPA), E-rate certifications compliance

Most of Children's Internet Protection Act (CIPA), E-rate certifications comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Children's Internet Protection Act (CIPA), E-rate certifications, and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Children's Internet Protection Act (CIPA), E-rate certifications in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Children's Internet Protection Act (CIPA), E-rate certifications as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.