6 U.S.C. § 665m: President’s Cup Cybersecurity…

Summary

The Director of the Cybersecurity and Infrastructure Security Agency may run an annual President’s Cup Cybersecurity Competition to find, test, and award the best federal cybersecurity workers and teams, with cash and other prizes. To enter, a person must be a federal civilian employee or a member of the uniformed services and follow the Director’s rules. The Director can hire private companies or state or local agencies to run the event. Each contest must cover skills from the National Initiative for Cybersecurity Education framework (or its successor), include both individual and team events, and show offensive and defensive cyber work (for example, reverse engineering, network work, forensics, secure coding, cyber-physical systems, and data analysis). Competition funds may pay for advertising, necessary meals, promotional items, honorary recognition, and awards. Director awards may be up to $10,000 each, the Secretary may award up to $25,000 each, awards are extra pay, and total awards per year cannot exceed $100,000. The Director must send an annual report to two Congressional committees listing available funds, spending, participation, and lessons learned. Funds rules apply to money appropriated on or after December 23, 2022.

Title 6, §665m

Domestic Security, Source: USLM XML via OLRC

(a)In general

The Director of the Cybersecurity and Infrastructure Security Agency (in this section referred to as the “Director”) of the Department of Homeland Security is authorized to hold an annual cybersecurity competition to be known as the “Department of Homeland Security Cybersecurity and Infrastructure Security Agency’s President’s Cup Cybersecurity Competition” (in this section referred to as the “competition”) for the purpose of identifying, challenging, and competitively awarding prizes, including cash prizes, to the United States Government’s best cybersecurity practitioners and teams across offensive and defensive cybersecurity disciplines.

(b)Eligibility

To be eligible to participate in the competition, an individual shall be a Federal civilian employee or member of the uniformed services (as such term is defined in section 2101(3) of title 5) and shall comply with any rules promulgated by the Director regarding the competition.

(c)Competition administration

The Director may enter into a grant, contract, cooperative agreement, or other agreement with a private sector for-profit or nonprofit entity or State or local government agency to administer the competition.

(d)Competition parameters

Each competition shall incorporate the following elements:

(1)Cybersecurity skills outlined in the National Initiative for Cybersecurity Education Framework, or any successor framework.

(2)Individual and team events.

(3)Categories demonstrating offensive and defensive cyber operations, such as software reverse engineering and exploitation, network operations, forensics, big data analysis, cyber analysis, cyber defense, cyber exploitation, secure programming, obfuscated coding, or cyber-physical systems.

(4)Any other elements related to paragraphs (1), (2), or (3), as determined necessary by the Director.

(e)Use of funds

(1)In general

In order to further the goals and objectives of the competition, the Director may use amounts made available to the Director for the competition for reasonable expenses for the following:

(A)Advertising, marketing, and promoting the competition.

(B)Meals for participants and organizers of the competition if attendance at the meal during the competition is necessary to maintain the integrity of the competition.

(C)Promotional items, including merchandise and apparel.

(D)Consistent with section 4503 of title 5, necessary expenses for the honorary recognition of competition participants, including members of the uniformed services.

(E)Monetary and nonmonetary awards for competition participants, including members of the uniformed services, subject to subsection (f).

(2)Application

This subsection shall apply to amounts appropriated on or after December 23, 2022.

(f)Prize limitation

(1)Awards by the Director (2) Awards by the Secretary of Homeland Security

The Director may make one or more awards per competition, except that the amount or value of each shall not exceed $10,000.

(3)Regular pay

A monetary award under this section shall be in addition to the regular pay of the recipient.

(4)Overall yearly award limit

The total amount or value of awards made under this Act during a fiscal year may not exceed $100,000.

(g)Reporting requirements

The Director shall annually provide to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a report that includes the following with respect to each competition conducted in the preceding year:

(1)A description of available amounts.

(2)A description of authorized expenditures.

(3)Information relating to participation.

(4)Information relating to lessons learned, and how such lessons may be applied to improve cybersecurity operations and recruitment of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security.

Notes & Related Subsidiaries

Editorial Notes

References in Text

This Act, referred to in subsec. (f)(4), is Pub. L. 117–263, Dec. 23, 2022, 136 Stat. 2395, known as the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023, but probably means H.R. 6824, 117th Cong., 2d Sess. (as reported to the Senate), known as the President’s Cup Cybersecurity Competition Act, which consisted only of the section containing the

Short Title

and this section. The reference to “this Act” from the original was not updated when the text of H.R. 6824 was incorporated into Pub. L. 117–263. Codification Section was enacted as part of the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023, and not as part of the Homeland Security Act of 2002 which comprises this chapter.

§665m President’s Cup Cybersecurity Competition