Web filtering for school finance and procurement teams
Filtering is a small line in the technology budget with a large job: it protects the district's E-Rate discounts. This guide covers the funding facts, the full cost, the contract terms that matter and the records your office should keep.
Where finance and procurement fit
IT defines what the filter must do. Finance and procurement make sure the district pays a fair price, buys it lawfully and can prove both later.
Budget owner
Plans the annual cost across several years, including renewals and staff time, so the filter never lapses for lack of funds mid-year.
Procurement lead
Runs a compliant purchase under state and local rules, and under E-Rate competitive bidding rules where an E-Rate request is involved.
Records keeper
Holds bids, evaluations, contracts and invoices in a way an auditor can follow years later.
| Handoff | From | To | What changes hands |
|---|---|---|---|
| Requirements | IT director | Procurement | Must-have features, device and user counts, coverage needs |
| Privacy terms | Privacy or legal lead | Procurement | The district's student data privacy agreement and retention rules |
| Cost allocation | E-Rate coordinator | Finance | Which charges must be removed from eligible requests |
| Budget approval | Finance | Superintendent and board | Multi-year cost, risks and the decision requested |
| Contract file | Procurement | Records | Bids, scoring, contract, privacy agreement and invoices |
The IT side of these handoffs is covered in web filtering for school IT directors. The executive view is in web filtering for superintendents.
A filter priced by schools and devices, with nothing to host
The hosted CIPA filter is a DNS filter run for you, so there is no appliance or software to budget for beyond the service. A quote reaches you within one business day and depends on the number of schools and devices.
- Ask for the quote to be based on schools and devices, so you can compare like for like.
- Reports, the policy record and the log export are what a procurement file needs.
- Nothing is installed on computers, so there is no per-device deployment cost.
E-Rate eligibility facts for web filtering
These points come up in every budget conversation about filtering. Eligibility rules are set each funding year, so confirm details against the current Eligible Services List with your E-Rate consultant.
CIPA is a condition of E-Rate
Schools receiving E-Rate discounts for internet access or internal connections must certify CIPA compliance. Schools and libraries do this on FCC Form 486; consortium members use Form 479.
Content filtering itself
Content filtering has generally not been an eligible E-Rate service. The district usually pays for the filter from its own budget, even though E-Rate requires one.
Bundled filtering features
When an eligible product includes filtering as a separately charged feature, that cost is normally subtracted from the funding request. Ask vendors to itemize it.
Built-in filtering with no itemized cost
Some internet access services include basic filtering as part of the standard product with no separate price. USAC has treated that as ancillary, needing no allocation.
Basic firewalls
Basic firewall service has been eligible, while the FCC has declined to make advanced or next-generation firewall features eligible. Filtering features on a firewall fall on the ineligible side.
Form 470 and the 28-day wait
For E-Rate requests, the district posts FCC Form 470 and waits at least 28 days before choosing a provider or signing. Filtering bought outside E-Rate follows your state and local rules instead.
Cybersecurity pilot
The FCC has run a separate three-year cybersecurity pilot for selected schools and libraries. It is not part of regular E-Rate, so check its current status before planning around it.
Long retention
E-Rate applicants must keep program records for a long period, currently stated as 10 years after the last date of service. Store filter records with them.
For the funding side in more depth, read E-Rate and CIPA funding and the Form 486 CIPA certification guide. This page is not legal or E-Rate advice.
Spending categories that get questioned in a budget meeting
A finance team often asks what a rule really blocks. These real entries show the categories behind sites a board member may name.
| Website | Categories in our data | Why it comes up |
|---|---|---|
| netflix.com | Streaming Media | Bandwidth and attention |
| spotify.com | Podcasts, Streaming Media | Bandwidth use |
| amazon.com | Shopping, Marketplaces / Classifieds / Auctions | Shopping on school devices |
| ebay.com | Marketplaces / Classifieds / Auctions, Shopping | Shopping on school devices |
| gofundme.com | Financial Services | Fundraising requests |
| steampowered.com | Gaming | Gaming downloads |
Total cost of ownership: every line, not just the quote
The quote is usually less than half of what filtering costs the district. Build the full picture across the contract term before comparing offers.
Per student, per device, per site or flat. Know which count drives the price.
Appliances, refresh cycles, or cloud capacity if traffic is routed through a service.
Work to deploy device certificates or agents to every managed device.
Policy build, directory sync, testing and moving off the old system.
Unblock requests, reviews, reports and troubleshooting, every week of the year.
For IT, librarians, teachers and office staff who field questions.
Time to produce exports and reports for audits and the board.
Data export, overlap months and a second migration at the end.
| Cost driver | Lower-effort pattern | Higher-effort pattern | Finance question to ask |
|---|---|---|---|
| Unblock workload | Accurate, multi-label categories; staff can look up sites | Frequent wrong blocks handled by hand | How many requests per month do similar districts log? |
| Off-campus coverage | Included and managed centrally | Separate product or manual device work | Is home coverage in the base price? |
| HTTPS inspection | Only where policy needs it | Everywhere, with certificate upkeep | What staff time does inspection add each year? |
| Reporting | Scheduled reports mapped to CIPA | Manual exports each time | Are audit-style reports included? |
| Hardware refresh | Hosted or cloud service | On-site appliances on a refresh cycle | When is the next refresh due and what will it cost? |
Our guide to how much a school web filter costs compares pricing models. For the question of whether a no-cost tool is enough, see free vs paid web filtering for schools.
Evidence you can keep for the auditor
Activity reports, a policy record and a log export build the file that supports a CIPA or E-Rate review. One console with separate settings per school keeps each building's record apart.
Contract terms that protect the district
Most filtering disputes are about renewals, counts and data. Settle them in the contract, not in a renewal email.
| Term | Why it matters | What good looks like |
|---|---|---|
| Term length and renewals | Long terms lock price but reduce leverage | One to three years with optional renewals the district controls |
| Renewal price cap | Prevents sharp increases at year two or three | A stated maximum percentage per renewal |
| Count method and true-up | Enrolment and device counts change each year | One defined count date and a fair adjustment both ways |
| Automatic renewal notice | Missed windows trap budgets | Reminder from the vendor and a clear cancellation window |
| Non-appropriation clause | Public bodies cannot spend money not yet budgeted | Right to end the contract if funds are not appropriated |
| Student data privacy agreement | Browsing records relate to students | Signed agreement meeting state law and district policy |
| Data location and retention | Controls exposure and supports deletion requests | District sets retention; data location stated |
| Deletion at exit | Old logs should not survive the contract | Export then certified deletion within a stated period |
| Service levels | An outage can leave students unfiltered or offline | Uptime target, support hours and escalation route |
| Change of terms | Category or feature changes mid-contract | Advance notice of material changes |
| Liability and insurance | A data breach at the vendor affects the district | Cyber insurance and breach notice duties named |
Good signs in a proposal
- Itemized pricing that separates filtering from other services
- All required features in the base price
- Clear count method
- Privacy agreement offered without pushback
- Plain exit terms
Points to examine closely
- Introductory pricing with no renewal cap
- Off-campus coverage priced as an add-on
- Reporting tiers that hold back audit reports
- Long terms with automatic renewal
- Vague data retention language
The questions finance and procurement get asked
Having answers ready avoids delays when the budget meets the board or an auditor.
From the board or superintendent
- Why can E-Rate not pay for this?
- What happens if we cut this line?
- Why did the price go up at renewal?
- Can we use a cheaper or no-cost option?
- Are we paying for features nobody uses?
From principals and department heads
- Can our school buy its own filter for one program?
- Who pays for filtering on loaned hotspots?
- Is the filter cost charged back to school budgets?
- Why do staff need training time on this?
From auditors and consultants
- Show the bids received and how they were scored.
- Show that filtering costs were allocated out of the E-Rate request.
- Show the contract in force during the funding year.
- Show invoices match the contract.
- Show the 28-day wait was respected where E-Rate applied.
If you are preparing the budget slide, the guide to presenting web filtering to the school board covers how to frame cost alongside risk.
What to ask a vendor before you sign
These are the commercial questions. Pair them with IT's technical questions in one evaluation.
- What exactly drives the price: students, devices, staff, sites or bandwidth?
- Which features are in the base price and which cost extra?
- What is the maximum increase at each renewal?
- How are counts measured, and on what date?
- Will you itemize filtering separately from any eligible service?
- Will you sign our student data privacy agreement as written?
- How long do you keep our data, and can we set it shorter?
- What does exit look like: export format, overlap and deletion?
- What service levels do you commit to, and what happens if you miss them?
- Do you hold a cooperative purchasing contract our state allows us to use?
- Which reports for CIPA evidence are included?
- Who are our contacts for billing, support and escalation?
Use the school web filter RFP checklist to score answers, and the buyer's guide to choosing a school web filter for the wider evaluation.
A budget and buying calendar
Fiscal years and E-Rate windows rarely line up neatly. Mapping both on one calendar avoids a lapse between contracts.
Review the current contract end date and renewal window. Collect next year's counts and IT's requirements.
Post Form 470 where an E-Rate request is involved, or start your local process. Respect the 28-day wait.
Evaluate, score and award. Check the privacy agreement is signed before any data flows.
Deploy and test before students return. File contracts, scoring and invoices with E-Rate records.
E-Rate window dates change each year. Confirm the current dates with USAC's published schedule or your consultant.
Never let the old contract end before the new filter is tested on every device group. A short overlap costs far less than weeks of students browsing without the required filtering in place.
The procurement file: evidence to keep
If someone asks in five or eight years how the filter was bought, this file answers without anyone needing to remember.
| Record | Why keep it | Owner |
|---|---|---|
| Requirements document or RFP | Shows what the district asked for | Procurement with IT |
| Form 470 and posting dates, where used | Proves the competitive process and wait period | E-Rate coordinator |
| All bids received, winning and losing | Auditors may ask for every response | Procurement |
| Evaluation matrix and scores | Shows price was weighed correctly | Evaluation team |
| Signed contract and amendments | Defines what was bought and when | Procurement |
| Cost allocation worksheet | Shows filtering was removed from eligible requests | E-Rate coordinator |
| Invoices and payment records | Match spending to the contract | Finance |
| Privacy agreement | Shows student data was protected | Privacy or legal lead |
Comparing offers on a like-for-like basis
Proposals rarely price the same things. Normalize them before scoring, or the cheapest headline price wins by leaving costs out.
- Convert every offer to the same unit, such as cost per enrolled student per year, using the same count date.
- Add any add-ons IT says are required, such as off-campus coverage or audit reports, to each offer that charges for them.
- Spread one-time costs like hardware and set-up across the full contract term.
- Apply each offer's renewal cap to estimate years two and three, not just year one.
- Estimate staff hours from IT's evaluation results and price them at your loaded hourly rate.
- Add an exit allowance for overlap months and migration at the end of the term.
| Line | Offer A | Offer B | Note |
|---|---|---|---|
| Base subscription | Included | Included | Same count date applied |
| Off-campus coverage | Included | Add-on | Add B's add-on to its total |
| Audit-style reports | Add-on | Included | Add A's add-on to its total |
| Hardware | None, hosted | Appliance | Spread B's appliance across the term |
| Renewal cap | Stated | Not stated | Ask B for a cap before scoring |
| Estimated staff hours | From IT test | From IT test | Use the same hourly rate |
Saving money without weakening compliance
Some savings are real and some move cost somewhere else. These are the ones that tend to hold up.
Savings that usually hold
- Joining a cooperative contract your state allows, which can shorten the process
- Buying for the whole district rather than school by school
- Dropping duplicate tools that overlap with the filter
- Choosing hosted service when an appliance refresh is due
- Reducing staff time through better category accuracy and staff self-service lookups
Savings that often backfire
- Leaving off-campus devices uncovered to cut the count
- Skipping reporting tiers needed for audit evidence
- Long terms with no renewal cap for a low first year
- A no-cost tool that cannot group students by grade
- Cutting the hours IT spends reviewing requests
The one saving never worth making is a gap in coverage. Lost E-Rate discounts after an adverse audit would cost far more than any filtering contract.
Budget planning for AI tools and new categories
New categories create new work, and new work has a cost. Plan for it rather than discovering it in March.
AI tools coverage
Our AI tools set holds 11,800+ AI-tool domains in 18 categories and 165 subcategories, updated daily. Ask whether coverage like this is included or extra.
Policy time
Deciding which AI tools to allow takes staff and board time. See AI tools policy for schools.
Hosted options
A hosted CIPA filter can replace appliance refresh costs with a predictable subscription.
Comparing filter offers on a like-for-like basis
Use these lines when a procurement file needs a clear side by side.
| Line item | Typical on-premises approach | Hosted CIPA filter |
|---|---|---|
| Hardware or software to buy | Appliances or agents | None, the filter is run for you |
| Pricing basis | Varies by vendor | Number of schools and devices |
| Time to quote | Weeks of calls | Within one business day |
| Rollout effort | Per device | One DNS setting on the router or firewall |
| Compliance records | Assembled by staff | Reports, policy record and log export |
| Trying before committing | Often not possible | A pilot on one site |
School finance and procurement FAQ
Can E-Rate pay for a school web filter?
Content filtering has generally not been eligible. Itemized filtering in an eligible product is usually allocated out. Check the current Eligible Services List.
If E-Rate does not pay for filtering, why does it matter to finance?
CIPA compliance is a condition of E-Rate discounts. The filter protects that funding, so gaps put discounts at risk.
What is included in the total cost of a school web filter?
Fees, hardware or capacity, deployment, staff time, training, reporting, renewals and the cost of switching at the end.
How long should a web filtering contract be?
Many districts choose one to three years with renewal options. Cap renewal increases and set a clear notice period.
What contract terms protect a school district?
Renewal caps, a fair true-up, a signed privacy agreement, deletion at exit, service levels, non-appropriation and a renewal notice period.
How long should procurement records be kept?
E-Rate rules currently state 10 years after the last date of service. Keep filtering records with them and check USAC's current list.
Related guides
We quote by the number of schools and devices and reply within one business day. A pilot on one site shows the blocks and reports before you commit, which makes it easier to justify the line in the budget.
Talk to us about your district
Tell us your student and device counts, your contract dates and what your E-Rate consultant needs itemized. We will set out what a category-based filter covers and how it is priced for your district.
Talk to us about your district See the hosted CIPA filter