CIPA readiness check for schools, districts and libraries
Answer nine short questions about your filter, your internet safety policy, your public meeting, your records and your CIPA form. You get a readiness summary, a gap list with next steps, and a page to print for your E-Rate file.
1 Who is this check for?
A few CIPA requirements differ for schools and libraries, so the questions follow your answer.
2 Answer the questions
Answer for the funding year you are preparing. Choose "Not sure" if you would need to ask someone.
Your result
Your gap list
In place
This is a self-assessment. It is not legal advice and not a USAC determination.
Three next steps
CIPA audit evidence checklist
A free 3-page PDF of what to keep on file for each funding year, and where to find each item.
Download the checklist (PDF)Internet safety policy template
An editable Word policy that covers the topics CIPA lists, with a school section on monitoring and online safety education and a section on adult disabling.
Download the template (Word)A hosted CIPA filter
We run the filter for you from $99 a month per site: one DNS setting, a CIPA preset, a staff PIN for adult research and reports for your files.
One library or school: build your plan Several sites: get a quoteWhat CIPA requires
The Children's Internet Protection Act sets the conditions a school or library must meet to get E-Rate discounts on internet access and internal connections. The law is in 47 U.S.C. 254(h) and (l). The FCC's rule is 47 CFR 54.520. USAC, which runs E-Rate, groups the conditions into three requirements.
1. A technology protection measure
This is a specific technology that blocks or filters internet access. It must protect against access by adults and minors to visual depictions that are obscene or child pornography. When minors use the computers, it must also protect against visual depictions that are harmful to minors. You must enforce it while your computers with internet access are in use.
2. An internet safety policy
The policy must address access by minors to inappropriate matter on the internet; the safety and security of minors in email, chat rooms and other direct electronic communications; unauthorized access, including hacking, and other unlawful activities by minors online; unauthorized disclosure, use and dissemination of personal information about minors; and measures that restrict minors' access to materials harmful to minors.
3. Public notice and a hearing or meeting
You must give reasonable public notice and hold at least one public hearing or meeting to address the proposed policy. USAC says that for private schools, public notice means notice to their appropriate constituent group. A later change to the policy does not need a new meeting unless state or local rules, or the policy itself, require one.
What is different for schools
A school's internet safety policy must also include monitoring the online activities of minors. Since July 1, 2012, it must also provide for educating minors about appropriate online behavior, including interacting with other individuals on social networking websites and in chat rooms, and cyberbullying awareness and response. The education item comes from the Protecting Children in the 21st Century Act of 2008. The FCC added it to its rules in 2011, in order FCC 11-125. The FCC said schools did not need a new public notice and hearing to update their policies for it, and that the policy itself does not have to contain the teaching materials.
What is different for libraries
Libraries certify the same filter, policy and meeting, without the monitoring and education items. The law lets an administrator, supervisor or other person authorized by the certifying authority disable the filter during use by an adult, to enable access for bona fide research or other lawful purpose. Schools have the same permission, but it matters most at a library desk. The FCC chose not to set a method or to define bona fide research. It left both to local communities. USAC gives one example: a sign-in page where an adult affirms that they will use the computer for bona fide research or other lawful purposes.
Terms the law defines
A minor is anyone who has not reached the age of 17. Obscene and child pornography take their meaning from federal criminal law, 18 U.S.C. 1460 and 18 U.S.C. 2256. Harmful to minors has its own three-part definition in the statute. It covers any picture, image or other visual depiction that, taken as a whole and with respect to minors, appeals to a prurient interest in nudity, sex or excretion; depicts, describes or represents sexual acts, sexual contact or a lewd exhibition of the genitals in a way that is patently offensive for minors; and, taken as a whole, lacks serious literary, artistic, political or scientific value as to minors.
Anything else your community finds inappropriate for minors is a local decision. The school board, local educational agency, library or other local authority makes it, and no federal agency may set criteria for it.
Who must comply, and who signs
CIPA applies to schools and libraries that receive E-Rate discounts for internet access or internal connections. USAC describes this as Category One internet access and all Category Two services: internal connections, managed internal broadband services and basic maintenance of internal connections. A school or library that receives discounts only for telecommunications services is not subject to CIPA, but it still certifies that this is the case.
The certification comes from the Administrative Authority. For a school, that may be the school, school board, school district, local educational agency or other authority that runs the school. For a library, it may be the library, the library board or another authority that runs the library. The certification is made every funding year.
Form 486, Form 479 and the change in funding year 2028
If the Administrative Authority is also the Billed Entity, it certifies on FCC Form 486. If it is not, for example when a consortium lead applies, the Administrative Authority completes FCC Form 479 and gives it to the Billed Entity. The Billed Entity then certifies on Form 486 that it has collected the Forms 479.
This is about to change. In its order FCC 26-30, adopted April 30, 2026, the FCC removed Form 486 starting with funding year 2028 and moved the CIPA certifications to the Form 471 funding application. Consortium members keep using Form 479, and consortium leads will need to collect those forms before they certify on Form 471. Under 47 CFR 54.520(g), Form 486 stays in use through funding year 2027.
First-time applicants
In the first funding year in which a school or library applies for these services, it may certify that it is undertaking actions to comply by the next funding year. USAC lists documents that show such actions, such as a board agenda with CIPA as a topic, a quote for a filter or a draft request for proposals. The actions must take place before services start, and the records must be kept for audits.
How to use your result
Your result sorts each item into one of three groups. A yes means you say it is in place and can show it. A no is a gap. Not sure means you need to ask someone before you certify. The gap list follows the order of the questions: the filter first, then the policy, the meeting, the records and the form.
Close the gaps
Each gap is a requirement you cannot show today. Many take one board item or one filter setting to fix. USAC says a school that complied in practice but left a required item out of its written policy can correct the policy.
Answer every "Not sure"
Ask the person who would know: the business office for the forms, the board clerk for notices and minutes, IT for the filter. If nobody can find the record, treat the item as a gap.
Print it and file it
Add your school or library name, print the summary and keep it with this year's CIPA records. Run the check again before each certification and after a change of filter, network or key staff.
What auditors ask for
USAC publishes the list of documents it will request to show CIPA compliance during an audit. Keep a set for each funding year in which you certify CIPA.
- A copy of the internet safety policy.
- Proof of public notice and of the hearing or meeting. For example, a website announcement of an open board meeting where the policy was discussed, or a newspaper notice, plus the minutes with the date.
- Proof that the policy was adopted, such as approval in the minutes or a documented board vote.
- A description of the filter.
- A report or other record of the filter in use, showing that it was installed and working during the funding year. USAC's examples include a sample of reports of blocked sites, provider bills that show the filter was running, or logs of the hours the filter was on.
- Copies of FCC Form 479 and/or Form 486, as applicable.
How long to keep them
Under 47 CFR 54.516(a), schools, libraries and consortia must keep E-Rate documents for at least 10 years after the later of the last day of the funding year or the service delivery deadline for the funding request. USAC's CIPA guidance gives the same period for CIPA records. The FCC's 2011 order cited five years. The current rule is 10.
Since 2011, you have been required to keep at least some record of when the public notice was given and when the hearing or meeting took place, such as the agenda or a newspaper notice. If you cannot find any record of a meeting held after August 2004, USAC says you can correct this by giving notice and holding a new meeting. The FCC may also ask to see your internet safety policy, so keep each version you relied on.
What CIPA does not require
Over-blocking and extra paperwork often come from reading more into the law than it says. Four points worth knowing:
Blocking more than the law names
CIPA names three kinds of visual depictions. Games, social media, streaming and other categories are local choices, made by your board or library.
Treating social networking as harmful
In FCC 11-125 the FCC said that declaring social networking sites categorically harmful to minors would be inconsistent with the law's focus on teaching appropriate online behavior.
A new meeting for every change
Additional meetings are not needed when you amend the policy, unless state or local rules or the policy itself require them.
A set way to unblock for adults
The FCC declined to mandate a method for disabling the filter or to define bona fide research. Each school or library decides how.
If the gaps are on the filter side
We run a hosted CIPA filter for libraries and schools. You set one DNS address on your router or firewall, and nothing is installed on computers. It starts from a CIPA preset. Staff can enter a PIN to unblock adult research for 15, 30 or 60 minutes, and the filter switches back on by itself. Activity reports and a policy record are ready to print for your files. It costs $99 a month per site.
CIPA readiness check: common questions
Is the CIPA readiness check free?
Yes. It is free and needs no sign-up. It runs in your browser, so you can use it as often as you like, for example once for each school or branch.
Are my answers sent to you or saved?
No. The check runs in plain JavaScript in your browser. Nothing you enter is sent to our server or stored. When you close or reload the page, the answers are gone, so print the summary first if you want to keep it.
Does a result with no gaps mean we are CIPA compliant?
No. The result reflects only your own answers. It is not legal advice and not a USAC determination. Compliance depends on what you actually do and what you can document for each funding year.
How long do we have to keep CIPA records?
At least 10 years after the later of the last day of the funding year or the service delivery deadline for the funding request. This is the E-Rate record rule in 47 CFR 54.516(a), and USAC applies the same period to CIPA documents.
Do we need a new public hearing when we change our internet safety policy?
No, unless state or local rules or your policy require one. USAC says additional meetings are not necessary, even if the policy is amended.
Who decides what is inappropriate for minors beyond what the law names?
Your school board, local educational agency, library or other local authority. The FCC rule says no federal agency may set criteria for that decision or review it.
Can a library turn the filter off for an adult?
Yes. An administrator, supervisor or other person authorized by the certifying authority may disable the filter during use by an adult, to enable access for bona fide research or other lawful purpose. The FCC left the method to each library.
Is Form 486 still used for the CIPA certification?
Yes, through funding year 2027. From funding year 2028, the FCC moved the CIPA certifications to the Form 471 funding application (FCC 26-30). Consortium members still certify to their consortium lead on Form 479.
Does CIPA require us to block social media?
No. CIPA names visual depictions that are obscene, child pornography or harmful to minors. In 2011 the FCC said that declaring social networking sites categorically harmful to minors would be inconsistent with the law's focus on educating minors about appropriate online behavior.
Official sources used for this check
Each question and statement on this page was checked against these sources on November 2, 2026.
- 47 U.S.C. 254(h) and (l), Children's Internet Protection Act: law.cornell.edu/uscode/text/47/254
- 47 CFR 54.520, CIPA certifications: ecfr.gov, 47 CFR 54.520
- 47 CFR 54.516(a), record keeping: ecfr.gov, 47 CFR 54.516
- USAC, E-Rate CIPA requirements and audit documentation: usac.org, CIPA
- FCC 11-125, Report and Order on the Protecting Children in the 21st Century Act (2011): docs.fcc.gov, FCC-11-125A1.pdf
- FCC 26-30, Report and Order removing Form 486 from funding year 2028 (2026): docs.fcc.gov, FCC-26-30A1.pdf
More guides: What is CIPA? · CIPA compliance checklist · CIPA audit: what USAC asks for · CIPA internet safety policy