NYC Cyber 9/12 Strategy Challenge

Q: How do I register?

A: To be considered for the competition, interested teams must submit all registration materials, including all team information, by the registration deadline of 20 September 2023 (11:59 pm ET). After all registration materials have been received, teams selected to compete will receive invitations and competition materials.

Click here to register.

Q: If my team registers, will we be allowed to compete in the competition?

A: This year's competition is capped at 28 teams. The organizers will evaluate applications on a number of criteria, including:

1) Each team’s submitted application, including their response to open questions around cyber issues;

2) A desire to maintain a strong competition by promoting diverse backgrounds, professional experiences, and educational institutions;

3) The number of teams participating from an individual school and institution.

A waitlist will be available once the 28 team cap has been reached.

Q. My team is composed of students from different schools within a university. Are we allowed to participate?

A: Due to the 28-team limit, organizers are only allowing three teams per single school within one academic institution. However, if your team is composed of students from different schools within one academic institution, you are not subject to this restriction.

For example: Only three Columbia SIPA teams or three Harvard Kennedy School (HKS) teams will be allowed, but cross-school teams such as SIPA-School of Engineering and Applied Science (SEAS) or cross-institute teams SIPA-HKS teams will still be allowed to compete.

Q. How do we decide which teams from a school will participate? What if four teams from a single school within an academic institution apply?

A: Applications will be considered on a rolling basis, with additional teams immediately being placed on a waitlist. Once registration has ended, the organizers will contact any teams that are from the same school that has exceeded the cap. If your school has an official team selection process, organizers will honor that selection process. If your school does not have an official team selection process, the organizers will evaluate using the aforementioned selection criteria and will factor in when the team’s application was submitted.

If you have questions on registration and team selection, please contact [email protected].

Q: I’ve registered, now what? How is the competition structured?

A: Several weeks before the competition, all registered teams will receive Intelligence Report I, setting the stage for the simulation. The teams are given approximately two to three weeks to prepare a policy brief and their decision document. The policy brief due date, approximately one week before the presentation, as well as submission instructions will be included in the first intelligence packet.

The two days of the competition are divided into qualifying, Semifinal, and Final Rounds. Teams advancing to the Semifinal Round will be announced at an evening reception, where they receive Intelligence Report II, further adjusting the simulation.

On the morning of the second day of the competition, Semifinalist teams present their modified policy recommendations, based on the evolved scenario. Teams advancing to the Final Round receive Intelligence Report III and are given very limited time to adjust their recommendations. In the afternoon of the second day, finalist teams present on a stage to a panel of high-profile and expert judges. The competition concludes with an awards reception.

Q: Is this competition virtual or in-person? Is hybrid allowed?

A: This year's competition will be in person. All teams and judges must participate in-person.

Q: Do teams have to attend both days of the competition?

A: Those teams that do not advance from the Qualifying Round on the first day and the Semifinal Rounds on the second day are encouraged to stay through the second day of the competition to support their fellow students in the Finals and to take advantage of the programming that will run on the second day.

Q: Is there a participant fee for the competition?

A: There is no fee associated with competing in Cyber 9/12. If you are contacted by someone claiming to be an organizer requesting a fee, please report it to [email protected].

Q. Does the competition cover teams' travel and accommodation costs?

A: No, the competition does not cover any team travel/accommodation costs. We recommend teams reach out to their academic institutions or external sponsors to request financial assistance.

Q: How is the Qualifying Round structured?

A: Before the Qualifying Round, teams are expected to submit a written cyber policy brief to organizers. This brief will be evaluated and factored into the final qualifying score.

During the Qualifying Round held on day one, teams will brief a panel of judges. For this, teams are expected to prepare a decision document based on Intelligence Report I. Teams will then deliver a ten-minute oral briefing based on a separate decision document. This will be immediately followed by a ten-minute Q&A round by the judges. Judges will provide feedback and score the students based on their performances.

The final score of the Qualifying Round will be a combination of the oral briefing score and the written brief score. Teams advancing to the Semifinal Round will be announced at the day one reception and provided with Intelligence Report II.

Q: How is the Semifinal Round structured? Is it the same as the Qualifying Round?

A: Yes, the Semifinal Round is the same as the qualifying round. Teams will be expected to prepare a new decision document based on Intelligence Report II. Teams will then deliver a ten-minute oral briefing based on a separate decision document. This will be immediately followed by a ten-minute Q&A round by the judges. Judges will provide feedback and score the students based on their performances.

The top four teams from the Semifinal will qualify for the Final Round.

Q: How is the Final Round structured?

A: Teams will have only fifteen minutes to prepare for the Final Round. Once the round starts, teams will be held in a room and transferred to when it is time (1) to review Intelligence Report III and (2) to brief the Final Round judges. Teams will deliver a ten-minute oral briefing based on the scenario and will immediately have a ten-minute Q&A round by judges.

Q: What is the difference between a written brief and a decision document?

A: There are two separate types of written products that teams will be expected to provide during the competition.

Written Cyber Policy Brief

- Teams will write a policy brief exploring the challenges faced by state, military, and industry actors related to the cyber incident described in the scenario materials. The brief must also recommend appropriate actions and policy responses for the actors involved. The page length and word count limits of the brief can be found in the “Written Brief Instructions” accompanying Intelligence Report I.

-This policy brief will be graded according to a rubric developed by competition organizers and will factor into the final score for the Qualifying Round.

- This is only required for the Qualifying Round.

Decision Document

- Teams will also be required to submit a “decision document” accompanying their oral presentation at the beginning of the competition round.

- The “decision document” will be a prepared memo, a maximum of one single-sided 8.5” by 11” page in length, outlining the team’s policy response alternatives, decision process, and recommendations.

- This is required for both the Qualifying and Semifinal Rounds

Q: Is there a required format for the oral briefing?

A: Each team must decide how to best conduct their briefing. There is no prescribed format for the structure or format of presentations. Presentations are limited to ten minutes. For tips, you can check out a webinar on "How to Brief" conducted by the Atlantic Council.

Q: Can presentation aids be used for the oral presentations?

A: No presentation or visual aids (e.g., PowerPoint, props, and posters) are permitted. Teams will not be allowed to use electronic devices such as cellular phones and computers during the competition events, when teams are presenting or answering judge questions. However, teams may use electronic devices such as cellular phones and computers during the breaks between rounds. Paper notes are highly encouraged at all times during the competition.

Q: Can teams use charts in the Written Brief?

A: No visual aids can be used in the written cyber policy brief.

Q: What sources can I use to prepare my responses? How should these sources be cited?

A: Teams can conduct secondary research to prepare for the competition, as well as engage with external experts. Sources and citations are not required for the decision document. If used, they will count toward the total page count.

Q: Can teams confer with external experts throughout the competition?

A: Before the competition, teams are encouraged to seek outside help from external experts to develop their policy briefs. Teams are expected to rely on their coaches, in particular, to help develop and revise their policy ideas for the competition.

During competition events, when teams are presenting or answering judge questions, no outside assistance is allowed for teams — including consultation with external experts. However, teams may confer with their coaches during the breaks between rounds. No consultation will be allowed in preparing for the Final Round.

Q: How are written briefs handled?

A: Written briefs will be evaluated by non-student members of the organizing team including staff at the Atlantic Council and Columbia University SIPA.

Q: How are decision documents handled?

A: During the competition, timekeepers will share the decision documents with judges and give them two minutes to review their contents. Organizers will print four black and white copies of the decision document for teams to distribute to judges.

Q: How will my team receive Intelligence Report II and Intelligence Report III?

A: Semifinalists will receive Intelligence Report II at 8pm on Day 1. They will receive it via email and can receive an in-print version at the Day 1 reception. Finalists will receive Intelligence Report III in person in-print.

Q: Will there be keynotes or any networking activity?

A: Please check back for an agenda update. The competition will feature keynotes, an evening reception, panel discussion, and networking opportunities.

We encourage competitors and judges to join the Cyber 9/12 Strategy Challenge Alumni Group on LinkedIn where we will post job vacancies and internship opportunities.

Q: Will the organizers cover the cost of hotels or flights that are canceled and non-refundable?

A: Unfortunately, no. Due to the unforeseen circumstances and development of COVID-19 and its variants, neither Columbia University or the Atlantic Council will cover or refund the cost of flights or lodging.

Q: What prizes will be awarded?

A: There will be awards for the top-performing teams based on score, as well as team awards for best written brief, best oral presentation, best teamwork, and most creative policy response alternative. Past competition winners have been awarded passes to the BlackHat Conference in Las Vegas.

The New York City Cyber 9/12 Strategy Challenge is looking for sponsors to support this year's event.

Interested sponsors should review this year's sponsorship prospectus and email us at [email protected].

The NYC Cyber 9/12 Strategy Challenge would like to thank the following organizations for their past partnership:

• Black Hat Conference
• E&Y
• McKinsey and Co
• JP Morgan
• Morgan Stanley
• PwC
• UBS Group
• Standard Chartered Bank
• NextPeak
• BlueVoyant
• New York City Cyber Command
• Bank of America
• Consumer Reports

This year's competition will be in-line with other Cyber 9/12 competition formats which take place across the world. Participants, coaches, and judges are encouraged to review the full competition rules.

Access the Full Competition Rules (Updated on 6 July 2023)

Understanding of Cyber Policy *

● [4 points] The team demonstrated a comprehensive knowledge of cyber policy issues, accurately identified key stakeholders and applicable instruments / levers

● [3 points] The team demonstrated a good knowledge of cyber policy issues, identified appropriate stakeholders, instruments/levers

● [2 points] The team demonstrated a general understanding of cyber policy but mis-identified some appropriate stakeholders, instruments/levers

● [1 point] The team demonstrated a limited knowledge of cyber policy, stakeholders and instruments levers

Identification of Key Issues *

● [4 points] The team successfully identified and fully responded to all the issues posed by the scenario

● [3 points] The team identified and responded to the main issues posed by the scenario

● [2 points] The team identified some relevant issues posed by the scenario or partially responded to main issues identified

● [1 point] The team referenced general cyber issues not relevant to the scenario or overly focused on a single issue

Policy Response Option – Analysis and Selected Option *

● [4 points] The team’s policy response options fully addressed the scenario and clearly articulated trade-offs. The optimal solution was proposed

● [3 points] The team’s policy response options addressed the main elements of the scenario and articulated some trade-offs. A good solution was proposed

● [2 point] The team’s policy response options addressed some elements of the scenario and / or there was limited articulation of trade-offs. A solution that had some value was proposed

● [1 point] The team’s suggested responses were overly narrow or only focused on one element of the scenario. The proposed solution was unlikely to be successful

Structure and Communication *

● [4 points] The team presented with a very clear, logical structure to their analysis and options, clearly communicated with the audience and were exemplary(brevity & accuracy) in their responses to questions

● [3 points] The team presented with a structure to their analysis and options, communicated relatively well with the audience and gave good answers in response to questions

● [2 points] The team presented with an occasionally unclear structure to their analysis and options, occasionally struggled to clearly communicate with the audience and / or occasionally gave unclear answers in response to questions

Originality and Creativity *

● [4 points] The team offered highly effective and innovative solutions to the scenario that go beyond existing canonical literature or best practices

● [3 points] The team offered effective, creative solutions to the scenario, grounded in current best practices and literature

● [2 points] The team offered partially effective solutions to the scenario with a degree of creativity, drawing upon some superseded best practice

● [1 point] The team offered potentially ineffective solutions to the scenario, without creativity drawing upon superseded best practice