[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[S. 3635 Reported in Senate (RS)]
<DOC>
Calendar No. 547
118th CONGRESS
2d Session
S. 3635
[Report No. 118-234]
To improve the President's Cup Cybersecurity Competitions.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
January 22, 2024
Mr. Peters (for himself and Mr. Braun) introduced the following bill;
which was read twice and referred to the Committee on Homeland Security
and Governmental Affairs
November 12, 2024
Reported by Mr. Peters, with an amendment
[Strike out all after the enacting clause and insert the part printed
in italic]
_______________________________________________________________________
A BILL
To improve the President's Cup Cybersecurity Competitions.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
<DELETED>SECTION 1. SHORT TITLE.</DELETED>
<DELETED> This Act may be cited as the ``Industrial Control Systems
Cybersecurity Competition Act''.</DELETED>
<DELETED>SEC. 2. PRESIDENT'S CUP CYBERSECURITY COMPETITIONS.</DELETED>
<DELETED> Section 7121(d) of the James M. Inhofe National Defense
Authorization Act for Fiscal Year 2023 (6 U.S.C. 665m(d)) is amended--
</DELETED>
<DELETED> (1) by striking paragraph (3);</DELETED>
<DELETED> (2) by redesignating paragraphs (1), (2), and (4)
as subparagraphs (A), (B), and (C), respectively, and adjusting
the margin accordingly;</DELETED>
<DELETED> (3) by striking ``Each competition'' and inserting
the following:</DELETED>
<DELETED> ``(1) In general.--Each competition'';</DELETED>
<DELETED> (4) in subparagraph (C) of paragraph (1), as so
redesignated, by striking ``paragraphs (1), (2), or (3)'' and
inserting ``subparagraph (A) or (B)''; and</DELETED>
<DELETED> (5) by adding at the end the following:</DELETED>
<DELETED> ``(2) Biennial requirements.--Not less frequently
than every second competition, the competition shall
incorporate categories demonstrating offensive and defensive
cyber operations involving--</DELETED>
<DELETED> ``(A) information technology (as defined
in section 11101 of title 40, United States Code), such
as software reverse engineering and exploitation,
network operations, forensics, big data analysis, cyber
analysis, cyber defense, cyber exploitation, secure
programming, and obfuscated coding;</DELETED>
<DELETED> ``(B) operational technology (as defined
in section 3 of the IoT Cybersecurity Improvement Act
of 2020 (15 U.S.C. 278g-3a)) or industrial control
systems (as defined in section 2220C of the Homeland
Security Act of 2002 (6 U.S.C. 665i)), such as
knowledge of supervisory control and data acquisition
systems and the protocols and communication methods
used in these systems, detection of anomalies, and
responding to and recovering after incidents involving
such systems; or</DELETED>
<DELETED> ``(C) any other category of technological
system requiring cybersecurity or information security,
as determined appropriate by the Director.''.</DELETED>
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Industrial Control Systems
Cybersecurity Competition Act''.
SEC. 2. PRESIDENT'S CUP CYBERSECURITY COMPETITIONS.
(a) In General.--Section 7121 of the James M. Inhofe National
Defense Authorization Act for Fiscal Year 2023 (6 U.S.C. 665m) is
amended--
(1) in subsection (d)--
(A) by striking paragraph (3);
(B) by redesignating paragraphs (1), (2), and (4)
as subparagraphs (A), (B), and (C), respectively, and
adjusting the margin accordingly;
(C) by striking ``Each competition'' and inserting
the following:
``(1) In general.--Each competition'';
(D) in subparagraph (C) of paragraph (1), as so
redesignated, by striking ``paragraphs (1), (2), or
(3)'' and inserting ``subparagraph (A) or (B)''; and
(E) by adding at the end the following:
``(2) Biennial requirements.--Not less frequently than
every second competition, the competition shall incorporate
categories demonstrating offensive and defensive cyber
operations involving--
``(A) information technology (as defined in section
11101 of title 40, United States Code), such as
software reverse engineering and exploitation, network
operations, forensics, big data analysis, cyber
analysis, cyber defense, cyber exploitation, secure
programming, and obfuscated coding;
``(B) operational technology (as defined in section
3 of the IoT Cybersecurity Improvement Act of 2020 (15
U.S.C. 278g-3a)) or industrial control systems (as
defined in section 2220C of the Homeland Security Act
of 2002 (6 U.S.C. 665i)), such as knowledge of
supervisory control and data acquisition systems and
the protocols and communication methods used in such
systems, detection of anomalies, exploitation of
operational technology or industrial control systems,
and responding to and recovering after incidents
involving operational technology or industrial control
systems; or
``(C) any other category of technological system
requiring cybersecurity or information security, as
determined appropriate by the Director.'';
(2) in subsection (e)(1)--
(A) in subparagraph (A), by inserting ``, which
shall not exceed 20 percent of the amounts made
available for the competition during any fiscal year''
after ``the competition'';
(B) in subparagraph (B), by inserting ``, which
shall not exceed 20 percent of the amounts made
available for the competition during any fiscal year''
after ``integrity of the competition'';
(C) in subparagraph (C), by inserting ``, which
shall not exceed 20 percent of the amounts made
available for the competition during any fiscal year''
after ``and apparel''; and
(D) in subparagraph (D), by inserting ``, which
shall not exceed 20 percent of the amounts made
available for the competition during any fiscal year''
after ``the uniformed services''; and
(3) by adding at the end the following:
``(h) Limitation.--The Director may not hold an annual
cybersecurity competition under this section for a year until after the
Director submits the report required under subsection (g) with respect
to the competition held under this section during the previous year.
``(i) Sunset.--The Director may not conduct a competition under the
authority under this section on or after the first day of the first
year that begins more than 5 years after the date of enactment of the
Industrial Control Systems Cybersecurity Competition Act.''.
(b) No New Funding.--No additional funds are authorized to be
appropriated for the purpose of carrying out the amendments made by
this Act.
Calendar No. 547
118th CONGRESS
2d Session
S. 3635
[Report No. 118-234]
_______________________________________________________________________
A BILL
To improve the President's Cup Cybersecurity Competitions.
_______________________________________________________________________
November 12, 2024
Reported with an amendment