The compliance gap most state broadband offices underestimate Every BEAD subgrantee must attest to an operational cybersecurity risk management plan and a supply chain risk management plan before their grant-funded network goes live. The organizations receiving those awards — rural internet service providers, municipalities, electric cooperatives, and tribal governments — are focused on deploying broadband infrastructure.