II 

Calendar No. 547 

118TH CONGRESS 

2D SESSION S. 3635 

[Report No. 118–234] 

To improve the President’s Cup Cybersecurity Competitions. 

IN THE SENATE OF THE UNITED STATES 

JANUARY 22, 2024 

Mr. PETERS (for himself and Mr. BRAUN) introduced the following bill; which 

was read twice and referred to the Committee on Homeland Security and 

Governmental Affairs 

NOVEMBER 12, 2024 

Reported by Mr. PETERS, with an amendment 

[Strike out all after the enacting clause and insert the part printed in italic] 

A BILL 

To improve the President’s Cup Cybersecurity Competitions. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Industrial Control Sys5 tems Cybersecurity Competition Act’’. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
2 

•S 3635 RS

1 SEC. 2. PRESIDENT’S CUP CYBERSECURITY COMPETITIONS. 

2 Section 7121(d) of the James M. Inhofe National De3 fense Authorization Act for Fiscal Year 2023 (6 U.S.C. 

4 665m(d)) is amended— 

5 (1) by striking paragraph (3); 

6 (2) by redesignating paragraphs (1), (2), and 

7 (4) as subparagraphs (A), (B), and (C), respectively, 

8 and adjusting the margin accordingly; 

9 (3) by striking ‘‘Each competition’’ and insert10 ing the following: 

11 ‘‘(1) IN GENERAL.—Each competition’’; 

12 (4) in subparagraph (C) of paragraph (1), as so 

13 redesignated, by striking ‘‘paragraphs (1), (2), or 

14 (3)’’ and inserting ‘‘subparagraph (A) or (B)’’; and 

15 (5) by adding at the end the following: 

16 ‘‘(2) BIENNIAL REQUIREMENTS.—Not less fre17 quently than every second competition, the competi18 tion shall incorporate categories demonstrating of19 fensive and defensive cyber operations involving— 

20 ‘‘(A) information technology (as defined in 

21 section 11101 of title 40, United States Code), 

22 such as software reverse engineering and exploi23 tation, network operations, forensics, big data 

24 analysis, cyber analysis, cyber defense, cyber ex25 ploitation, secure programming, and obfuscated 

26 coding; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
3 

•S 3635 RS

1 ‘‘(B) operational technology (as defined in 

2 section 3 of the IoT Cybersecurity Improvement 

3 Act of 2020 (15 U.S.C. 278g–3a)) or industrial 

4 control systems (as defined in section 2220C of 

5 the Homeland Security Act of 2002 (6 U.S.C. 

6 665i)), such as knowledge of supervisory control 

7 and data acquisition systems and the protocols 

8 and communication methods used in these sys9 tems, detection of anomalies, and responding to 

10 and recovering after incidents involving such 

11 systems; or 

12 ‘‘(C) any other category of technological 

13 system requiring cybersecurity or information 

14 security, as determined appropriate by the Di15 rector.’’. 

16 SECTION 1. SHORT TITLE. 

17 This Act may be cited as the ‘‘Industrial Control Sys18 tems Cybersecurity Competition Act’’. 

19 SEC. 2. PRESIDENT’S CUP CYBERSECURITY COMPETITIONS. 

20 (a) IN GENERAL.—Section 7121 of the James M. 

21 Inhofe National Defense Authorization Act for Fiscal Year 

22 2023 (6 U.S.C. 665m) is amended— 

23 (1) in subsection (d)— 

24 (A) by striking paragraph (3); 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
4 

•S 3635 RS

1 (B) by redesignating paragraphs (1), (2), 

2 and (4) as subparagraphs (A), (B), and (C), re3 spectively, and adjusting the margin accord4 ingly; 

5 (C) by striking ‘‘Each competition’’ and in6 serting the following: 

7 ‘‘(1) IN GENERAL.—Each competition’’; 

8 (D) in subparagraph (C) of paragraph (1), 

9 as so redesignated, by striking ‘‘paragraphs (1), 

10 (2), or (3)’’ and inserting ‘‘subparagraph (A) or 

11 (B)’’; and 

12 (E) by adding at the end the following: 

13 ‘‘(2) BIENNIAL REQUIREMENTS.—Not less fre14 quently than every second competition, the competi15 tion shall incorporate categories demonstrating offen16 sive and defensive cyber operations involving— 

17 ‘‘(A) information technology (as defined in 

18 section 11101 of title 40, United States Code), 

19 such as software reverse engineering and exploi20 tation, network operations, forensics, big data 

21 analysis, cyber analysis, cyber defense, cyber ex22 ploitation, secure programming, and obfuscated 

23 coding; 

24 ‘‘(B) operational technology (as defined in 

25 section 3 of the IoT Cybersecurity Improvement 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
5 

•S 3635 RS

1 Act of 2020 (15 U.S.C. 278g–3a)) or industrial 

2 control systems (as defined in section 2220C of 

3 the Homeland Security Act of 2002 (6 U.S.C. 

4 665i)), such as knowledge of supervisory control 

5 and data acquisition systems and the protocols 

6 and communication methods used in such sys7 tems, detection of anomalies, exploitation of 

8 operational technology or industrial control sys9 tems, and responding to and recovering after in10 cidents involving operational technology or in11 dustrial control systems; or 

12 ‘‘(C) any other category of technological sys13 tem requiring cybersecurity or information secu14 rity, as determined appropriate by the Direc15 tor.’’; 

16 (2) in subsection (e)(1)— 

17 (A) in subparagraph (A), by inserting ‘‘, 

18 which shall not exceed 20 percent of the amounts 

19 made available for the competition during any 

20 fiscal year’’ after ‘‘the competition’’; 

21 (B) in subparagraph (B), by inserting ‘‘, 

22 which shall not exceed 20 percent of the amounts 

23 made available for the competition during any 

24 fiscal year’’ after ‘‘integrity of the competition’’; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
6 

•S 3635 RS

1 (C) in subparagraph (C), by inserting ‘‘, 

2 which shall not exceed 20 percent of the amounts 

3 made available for the competition during any 

4 fiscal year’’ after ‘‘and apparel’’; and 

5 (D) in subparagraph (D), by inserting ‘‘, 

6 which shall not exceed 20 percent of the amounts 

7 made available for the competition during any 

8 fiscal year’’ after ‘‘the uniformed services’’; and 

9 (3) by adding at the end the following: 

10 ‘‘(h) LIMITATION.—The Director may not hold an an11 nual cybersecurity competition under this section for a year 

12 until after the Director submits the report required under 

13 subsection (g) with respect to the competition held under 

14 this section during the previous year. 

15 ‘‘(i) SUNSET.—The Director may not conduct a com16 petition under the authority under this section on or after 

17 the first day of the first year that begins more than 5 years 

18 after the date of enactment of the Industrial Control Sys19 tems Cybersecurity Competition Act.’’. 

20 (b) NO NEW FUNDING.—No additional funds are au21 thorized to be appropriated for the purpose of carrying out 

22 the amendments made by this Act. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB

kjohnson on DSK7ZCZBW3PROD with $$_JOB
Calendar No. 547 

118TH CONGRESS 

2D SESSION S. 3635 

[Report No. 118–234] 

A BILL 

To improve the President’s Cup Cybersecurity 

Competitions. 

NOVEMBER 12, 2024 

Reported with an amendment 


kjohnson on DSK7ZCZBW3PROD with $$_JOB