118 S3635 RS: Industrial Control Systems Cybersecurity Competition Act U.S. Senate 2024-11-12 text/xml EN Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain.
IICalendar No. 547118th CONGRESS2d SessionS. 3635[Report No. 118–234]IN THE SENATE OF THE UNITED STATESJanuary 22, 2024Mr. Peters (for himself and Mr. Braun) introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental AffairsNovember 12, 2024Reported by Mr. Peters, with an amendmentStrike out all after the enacting clause and insert the part printed in italicA BILLTo improve the President's Cup Cybersecurity Competitions.
1.
Short title
This Act may be cited as the Industrial Control Systems Cybersecurity Competition Act.
2.
President's Cup Cybersecurity Competitions
Section 7121(d) of the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023 (6 U.S.C. 665m(d)) is amended—(1)by striking paragraph (3); (2)by redesignating paragraphs (1), (2), and (4) as subparagraphs (A), (B), and (C), respectively, and adjusting the margin accordingly; (3)by striking Each competition and inserting the following:(1)
In general
Each competition;(4)in subparagraph (C) of paragraph (1), as so redesignated, by striking paragraphs (1), (2), or (3) and inserting subparagraph (A) or (B); and(5)by adding at the end the following:(2)
Biennial requirements
Not less frequently than every second competition, the competition shall incorporate categories demonstrating offensive and defensive cyber operations involving—(A)information technology (as defined in section 11101 of title 40, United States Code), such as software reverse engineering and exploitation, network operations, forensics, big data analysis, cyber analysis, cyber defense, cyber exploitation, secure programming, and obfuscated coding;(B)operational technology (as defined in section 3 of the IoT Cybersecurity Improvement Act of 2020 (15 U.S.C. 278g–3a)) or industrial control systems (as defined in section 2220C of the Homeland Security Act of 2002 (6 U.S.C. 665i)), such as knowledge of supervisory control and data acquisition systems and the protocols and communication methods used in these systems, detection of anomalies, and responding to and recovering after incidents involving such systems; or(C)any other category of technological system requiring cybersecurity or information security, as determined appropriate by the Director..
1.
Short title
This Act may be cited as the Industrial Control Systems Cybersecurity Competition Act.
2.
President's Cup Cybersecurity Competitions
(a)
In general
Section 7121 of the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023 (6 U.S.C. 665m) is amended—(1)in subsection (d)—(A)by striking paragraph (3); (B)by redesignating paragraphs (1), (2), and (4) as subparagraphs (A), (B), and (C), respectively, and adjusting the margin accordingly; (C)by striking Each competition and inserting the following:(1)
In general
Each competition;(D)in subparagraph (C) of paragraph (1), as so redesignated, by striking paragraphs (1), (2), or (3) and inserting subparagraph (A) or (B); and(E)by adding at the end the following:(2)
Biennial requirements
Not less frequently than every second competition, the competition shall incorporate categories demonstrating offensive and defensive cyber operations involving—(A)information technology (as defined in section 11101 of title 40, United States Code), such as software reverse engineering and exploitation, network operations, forensics, big data analysis, cyber analysis, cyber defense, cyber exploitation, secure programming, and obfuscated coding;(B)operational technology (as defined in section 3 of the IoT Cybersecurity Improvement Act of 2020 (15 U.S.C. 278g–3a)) or industrial control systems (as defined in section 2220C of the Homeland Security Act of 2002 (6 U.S.C. 665i)), such as knowledge of supervisory control and data acquisition systems and the protocols and communication methods used in such systems, detection of anomalies, exploitation of operational technology or industrial control systems, and responding to and recovering after incidents involving operational technology or industrial control systems; or (C)any other category of technological system requiring cybersecurity or information security, as determined appropriate by the Director.; (2)in subsection (e)(1)—(A)in subparagraph (A), by inserting , which shall not exceed 20 percent of the amounts made available for the competition during any fiscal year after the competition;(B)in subparagraph (B), by inserting , which shall not exceed 20 percent of the amounts made available for the competition during any fiscal year after integrity of the competition; (C)in subparagraph (C), by inserting , which shall not exceed 20 percent of the amounts made available for the competition during any fiscal year after and apparel; and(D)in subparagraph (D), by inserting , which shall not exceed 20 percent of the amounts made available for the competition during any fiscal year after the uniformed services; and(3)by adding at the end the following:(h)
Limitation
The Director may not hold an annual cybersecurity competition under this section for a year until after the Director submits the report required under subsection (g) with respect to the competition held under this section during the previous year.(i)
Sunset
The Director may not conduct a competition under the authority under this section on or after the first day of the first year that begins more than 5 years after the date of enactment of the Industrial Control Systems Cybersecurity Competition Act..(b)
No new funding
No additional funds are authorized to be appropriated for the purpose of carrying out the amendments made by this Act.
November 12, 2024Reported with an amendment