```

[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[S. 3635 Reported in Senate (RS)]

<DOC>

                                                       Calendar No. 547
118th CONGRESS
  2d Session
                                S. 3635

                          [Report No. 118-234]

       To improve the President's Cup Cybersecurity Competitions.

_______________________________________________________________________

                   IN THE SENATE OF THE UNITED STATES

                            January 22, 2024

 Mr. Peters (for himself and Mr. Braun) introduced the following bill; 
which was read twice and referred to the Committee on Homeland Security 
                        and Governmental Affairs

                           November 12, 2024

               Reported by Mr. Peters, with an amendment
 [Strike out all after the enacting clause and insert the part printed 
                               in italic]

_______________________________________________________________________

                                 A BILL

 
       To improve the President's Cup Cybersecurity Competitions.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

<DELETED>SECTION 1. SHORT TITLE.</DELETED>

<DELETED>    This Act may be cited as the ``Industrial Control Systems 
Cybersecurity Competition Act''.</DELETED>

<DELETED>SEC. 2. PRESIDENT'S CUP CYBERSECURITY COMPETITIONS.</DELETED>

<DELETED>    Section 7121(d) of the James M. Inhofe National Defense 
Authorization Act for Fiscal Year 2023 (6 U.S.C. 665m(d)) is amended--
</DELETED>
        <DELETED>    (1) by striking paragraph (3);</DELETED>
        <DELETED>    (2) by redesignating paragraphs (1), (2), and (4) 
        as subparagraphs (A), (B), and (C), respectively, and adjusting 
        the margin accordingly;</DELETED>
        <DELETED>    (3) by striking ``Each competition'' and inserting 
        the following:</DELETED>
        <DELETED>    ``(1) In general.--Each competition'';</DELETED>
        <DELETED>    (4) in subparagraph (C) of paragraph (1), as so 
        redesignated, by striking ``paragraphs (1), (2), or (3)'' and 
        inserting ``subparagraph (A) or (B)''; and</DELETED>
        <DELETED>    (5) by adding at the end the following:</DELETED>
        <DELETED>    ``(2) Biennial requirements.--Not less frequently 
        than every second competition, the competition shall 
        incorporate categories demonstrating offensive and defensive 
        cyber operations involving--</DELETED>
                <DELETED>    ``(A) information technology (as defined 
                in section 11101 of title 40, United States Code), such 
                as software reverse engineering and exploitation, 
                network operations, forensics, big data analysis, cyber 
                analysis, cyber defense, cyber exploitation, secure 
                programming, and obfuscated coding;</DELETED>
                <DELETED>    ``(B) operational technology (as defined 
                in section 3 of the IoT Cybersecurity Improvement Act 
                of 2020 (15 U.S.C. 278g-3a)) or industrial control 
                systems (as defined in section 2220C of the Homeland 
                Security Act of 2002 (6 U.S.C. 665i)), such as 
                knowledge of supervisory control and data acquisition 
                systems and the protocols and communication methods 
                used in these systems, detection of anomalies, and 
                responding to and recovering after incidents involving 
                such systems; or</DELETED>
                <DELETED>    ``(C) any other category of technological 
                system requiring cybersecurity or information security, 
                as determined appropriate by the Director.''.</DELETED>

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Industrial Control Systems 
Cybersecurity Competition Act''.

SEC. 2. PRESIDENT'S CUP CYBERSECURITY COMPETITIONS.

    (a) In General.--Section 7121 of the James M. Inhofe National 
Defense Authorization Act for Fiscal Year 2023 (6 U.S.C. 665m) is 
amended--
            (1) in subsection (d)--
                    (A) by striking paragraph (3);
                    (B) by redesignating paragraphs (1), (2), and (4) 
                as subparagraphs (A), (B), and (C), respectively, and 
                adjusting the margin accordingly;
                    (C) by striking ``Each competition'' and inserting 
                the following:
            ``(1) In general.--Each competition'';
                    (D) in subparagraph (C) of paragraph (1), as so 
                redesignated, by striking ``paragraphs (1), (2), or 
                (3)'' and inserting ``subparagraph (A) or (B)''; and
                    (E) by adding at the end the following:
            ``(2) Biennial requirements.--Not less frequently than 
        every second competition, the competition shall incorporate 
        categories demonstrating offensive and defensive cyber 
        operations involving--
                    ``(A) information technology (as defined in section 
                11101 of title 40, United States Code), such as 
                software reverse engineering and exploitation, network 
                operations, forensics, big data analysis, cyber 
                analysis, cyber defense, cyber exploitation, secure 
                programming, and obfuscated coding;
                    ``(B) operational technology (as defined in section 
                3 of the IoT Cybersecurity Improvement Act of 2020 (15 
                U.S.C. 278g-3a)) or industrial control systems (as 
                defined in section 2220C of the Homeland Security Act 
                of 2002 (6 U.S.C. 665i)), such as knowledge of 
                supervisory control and data acquisition systems and 
                the protocols and communication methods used in such 
                systems, detection of anomalies, exploitation of 
                operational technology or industrial control systems, 
                and responding to and recovering after incidents 
                involving operational technology or industrial control 
                systems; or
                    ``(C) any other category of technological system 
                requiring cybersecurity or information security, as 
                determined appropriate by the Director.'';
            (2) in subsection (e)(1)--
                    (A) in subparagraph (A), by inserting ``, which 
                shall not exceed 20 percent of the amounts made 
                available for the competition during any fiscal year'' 
                after ``the competition'';
                    (B) in subparagraph (B), by inserting ``, which 
                shall not exceed 20 percent of the amounts made 
                available for the competition during any fiscal year'' 
                after ``integrity of the competition'';
                    (C) in subparagraph (C), by inserting ``, which 
                shall not exceed 20 percent of the amounts made 
                available for the competition during any fiscal year'' 
                after ``and apparel''; and
                    (D) in subparagraph (D), by inserting ``, which 
                shall not exceed 20 percent of the amounts made 
                available for the competition during any fiscal year'' 
                after ``the uniformed services''; and
            (3) by adding at the end the following:
    ``(h) Limitation.--The Director may not hold an annual 
cybersecurity competition under this section for a year until after the 
Director submits the report required under subsection (g) with respect 
to the competition held under this section during the previous year.
    ``(i) Sunset.--The Director may not conduct a competition under the 
authority under this section on or after the first day of the first 
year that begins more than 5 years after the date of enactment of the 
Industrial Control Systems Cybersecurity Competition Act.''.
    (b) No New Funding.--No additional funds are authorized to be 
appropriated for the purpose of carrying out the amendments made by 
this Act.
                                                       Calendar No. 547

118th CONGRESS

  2d Session

                                S. 3635

                          [Report No. 118-234]

_______________________________________________________________________

                                 A BILL

       To improve the President's Cup Cybersecurity Competitions.

_______________________________________________________________________

                           November 12, 2024

                       Reported with an amendment
```