6 U.S.C. § 665m — President’s Cup Cybersecurity Competition

(a) The Director^* of the Cybersecurity and Infrastructure Security Agency^* may hold an annual competition called the “Department^* of Homeland^* Security Cybersecurity and Infrastructure Security Agency’s President’s Cup Cybersecurity Competition.” It is for identifying, challenging, and competitively awarding prizes, including cash, to the Federal Government’s best offensive- and defensive-cybersecurity practitioners and teams.

(b) An individual is eligible only if the individual is a Federal civilian employee or a member of the uniformed services, as that term is defined in 5 U.S.C. § 2101(3), and follows the Director’s competition rules.

(c) The Director may use a grant, contract, cooperative agreement, or other agreement with a private for-profit or nonprofit entity or a State^* or local government^* agency to administer the competition.

(d) Every competition must include: (1) skills from the National Initiative for Cybersecurity Education Framework or a successor; (2) individual and team events; (3) offensive and defensive categories, such as software reverse engineering and exploitation, network operations, forensics, big-data analysis, cyber analysis, cyber defense, cyber exploitation, secure programming, obfuscated coding, and cyber-physical systems; and (4) other related elements the Director considers necessary.

(e) To advance the competition’s goals, the Director may use available competition funds for reasonable costs of advertising and promotion; meals for participants and organizers when attending is necessary to protect the competition’s integrity; promotional merchandise and clothing; necessary honorary recognition expenses consistent with 5 U.S.C. § 4503; and monetary and nonmonetary participant awards, subject to subsection (f). This subsection applies to money appropriated on or after December 23, 2022.

(f) The Director may make one or more awards per competition, but each may not exceed $10,000. The Homeland Security Secretary^* may make one or more awards per competition, but each may not exceed $25,000. A monetary award is in addition to the recipient’s regular pay. The total value of awards under this Act in one fiscal year may not exceed $100,000.

(g) Each year the Director must report to the two committees about each competition held in the prior year, including available amounts, authorized spending, participation, lessons learned, and how those lessons could improve CISA cybersecurity operations and recruitment.