Rules of Conduct

Last Updated August 2026

Ethics Statement

The NCL aspires to communicate and promote an honor code, ethical values, and behaviors that are essential elements of the information security workforce. We are not here to help people learn to be Blackhats. Rather, we hope to help develop players to become IT and security professionals who can make a difference in our 21st century information, knowledge, and innovation economies.

Spirit of the NCL Games

The spirit of the NCL is to foster excitement and eagerness for learning through friendly competition and we have developed the Rules of Conduct to support this spirit. These rules are designed to maintain fairness in the competition and safeguard the community from behavior that negatively affects the experience of others. Based on this spirit, we have developed these core principles to guide our decision-making process in both the design of the Games and the implementation of our Rules of Conduct

1. A player’s performance in the game should reflect their own personal ability and not what resources they have at their disposal
2. The player’s learning experience should take priority over the competitive aspects of the game
3. The game should attempt to match aspects of real-world work; except in instances where that would negatively impact the fairness of the competition or the learning process

Simplified Rules of Conduct

1. The Individual Game is an individual event - you must participate in this event by yourself. You may NOT collaborate with anyone else.
2. During the Team Game, you may collaborate with anyone on your team (per the Team Roster on cyberskyline.com) without restriction. This does NOT apply to anyone outside of your team, including others from your school who are on different teams.
3. Coaches may NOT assist Players during Individual Game and Team Game (Coaches may assist students in the Gymnasium and in the Practice Game).
4. You may discuss all challenges from each game after they have ended with Coaches & fellow Players; however, you may NOT post questions or answers online at any point (even after the games have ended).
5. Behave in a professional manner, including on NCL social media channels, the NCL Discord, and when interacting with NCL and Cyber Skyline representatives.
6. Follow all rules of engagement against live designated targets on the cityinthe.cloud domain.
7. Do not attack the competition platform (cyberskyline.com).
8. Do not sabotage any game elements, including online resources (e.g. modifying another Player’s competition environment or editing a Wikipedia page to provide false information).
9. Do not modify any unique IDs assigned to you by the competition platform and do not access competition resources using another competitor’s unique ID. Do not misrepresent yourself or use multiple personas.
10. Do not violate any local, state, federal, or international laws.

Complete Rules of Conduct

1. Eligibility Requirements

1. The NCL competition is open to individuals aged 13 or older who are located within the United States or Canada and international students of academic institutions located within the United States or Canada. We are currently unable to support users from outside of the United States or Canada.
2. To be eligible as a Faculty Coach, an individual must be a faculty member or other affiliated individual from an academic institution who is authorized to represent the institution and its students
3. There are two types of players within the NCL competition - Student Players and Industry Players.
• Individuals are categorized as a Student Player, if you are enrolled as a part-time or full-time student in a US or Canadian high school, collegiate institution, apprenticeship, or academic boot camp at the time that you register. If your student status changes during the NCL season, you will still maintain your Student Player classification for the remainder of the season.
• Individuals who do not meet the criteria as a Student Player are categorized as an Industry Player. This includes recent graduates, transition military veterans, or any other individuals looking to develop their skills outside of a formal educational program. Industry players must register through a Cyber Skyline Professional Annual Subscription.
• Student Players and Industry Players will have access to the same content within the NCL season and are subject to the same Rules of Conduct.
• Please note that as part of the NCL’s nonprofit mission, the effective price of Student Player registration is discounted for academic purposes. NCL will have sole discretion to void the registration of any individual deemed to be registered with the incorrect categorization.

4. During registration, Student Players will be given the option to indicate if they self-identify as a “cybersecurity student” or as an “experienced cybersecurity student”. Students who identify as an “experienced cybersecurity student” will be placed in a separate “Experienced Students” leaderboard to maintain fair comparisons between students and align with the NCL’s core mission of helping students enter the cybersecurity industry. The following guidance is provided to help students make their selection:
• I am a cybersecurity student
• Not yet in a cybersecurity role or hold extremely limited experience in any technical NICE cybersecurity work roles
• Enrolled in an undergraduate cybersecurity or undergraduate computer science program
• Want to compete with students who are beginners or have limited experience
• I am an experienced cybersecurity student
• Have experience working in a technical NICE cybersecurity work role for 3 or more years
• Enrolled in a graduate cybersecurity or graduate computer science program or advanced certificate program
• Want to compete with students who have more experience
5. Please note that the “Experienced” Student Player categorization is based on your degree or work experience and not years of experience playing in the NCL. NCL will have sole discretion to reclassify players based on their experience background to keep accurate representations of a player's skill background and to maintain a fair comparison between players.

2. Professional Conduct

1. All NCL participants, including players and coaches, are to behave in a manner befitting professional cybersecurity practitioners during all NCL activity including Games, practice and preparation, meetings, etc. Professional conduct is expected throughout all communications with the NCL community of players, coaches, and members of the NCL management team. This includes all Game responses, choice of handles, images, email, voice, chat, surveys, and social media.
2. Policies and regulations for the NCL Platform Provider – Cyber Skyline, and other host sites apply throughout the Games and must be respected by all NCL participants.
3. Activities such as alcohol and drug use, swearing, disrespectful or unruly behavior (including online, e.g. communications on Discord ), sexual harassment, improper physical contact, violence, or willful physical damage have no place at NCL events and will not be tolerated.
4. Challenges may intentionally or unintentionally reference real organizations or individuals. You may not call, email, contact, or harass the referenced individuals in any way.
5. Intentional or malicious violations of the rules, as determined by NCL representatives, may be deemed unprofessional conduct and subject the violators to disciplinary actions.
6. Players behaving unprofessionally may receive a warning from the NCL representatives for their first offense. Players may have a penalty assessed against their individual/team score, be disqualified, and/or expelled from the NCL Game/Season for egregious rule violations or for subsequent violations following a warning. Players expelled for unprofessional conduct will be banned from future NCL Games for no less than 12 months from the date of expulsion.
7. NCL representatives observing spectators, and individuals other than players, behaving in an unprofessional manner may warn against such behavior or ask those misbehaving to leave the physical and/or virtual space entirely.
8. All players are expected to answer truthfully when questioned by NCL about their conduct during the games, including their use of AI tools, collaboration, or any other aspects of their participation. This obligation is independent of whether the underlying conduct being asked about was itself a rule violation. A player found to have made a false or misleading statement to NCL representatives - regardless of the topic - may be removed from the leaderboard and denied a Scouting Report, and/or subject to the other remediations described in Section 10.3, at NCL’s sole discretion.
9. Conduct not explicitly described in these rules, but which we determine to undermine the spirit of the competition may serve as grounds for a penalty, disqualification or removal from the leaderboard at NCL’s discretion.

3. Individual Game Conduct

1. Players are forbidden from accessing or attempting to access another player’s machine, or account.
2. Players participating in the NCL Individual Game must do so without assistance from anyone, including other players and coaches, from the start of the Game to the end of the Game. All private and public forms of communication (including but not limited to, phone calls, emails, chat, texting, directed emails, forum postings, verbal and non-verbal conversations, requests for assistance, social engineering, etc.) with anyone other than the player themselves, that would help the player gain an unfair advantage, capture a flag or solve any of the puzzles, are not allowed and are grounds for disqualification and/or a penalty assigned to the appropriate player.
3. Players must abide by the restrictions on Internet, Software, Hardware, and AI usage as outlined in sections 6 and 7.
4. Players are free to examine any target systems. Attacks or other offensive activity against any other player’s systems or the NCL systems is forbidden and will not be tolerated. Any player performing offensive activity against other players’, or the NCL’s systems, will be immediately disqualified and expelled from the Game.
5. If there are any questions or concerns during the Game about whether or not specific actions can be considered offensive in nature, contact the NCL representatives before performing those actions.
6. You DO hereby have express permission to attack any asset designated as an NCL Game "target," so long as you abide by the Game rules and terms of this rules document.
7. The designated NCL Game targets are hosted by Cyber Skyline, expressly on the domain and subdomains of cityinthe.cloud. No other domains or assets of any variety should be attacked.
8. For the Individual Game, players may not hoard flags by intentionally delaying the submission of a flag after solving a challenge. This restriction does not apply to the Team Game, where players may reasonably delay submission to coordinate with their teammates before submitting a flag.

4. Team Game Conduct

1. Players on the same team may and are encouraged to help one another during the Team Game. They may engage in all forms of communication and collaboration. This does not apply to players on different teams, even from the same institution or organization. Otherwise, the Individual Game rules apply.

5. School Representatives

1. Each Student Player team should have at least one coach available throughout the duration of the NCL season to help organize and assist the players. The coach should be a faculty or staff member of the institution the team is representing. In those instances when the team meets in a virtual environment, the coach must also be virtually available in that environment.
2. Industry Players will not have a school representative.
3. Once the NCL Individual Game and NCL Team Game has started, coaches may not coach, assist, or advise an individual or their team until the completion of that Game.
4. Coaches must not interfere with any other individual or team.
5. The coach, or any non-team member, must not discuss any aspect of the NCL Game, specifically Game tasks, configurations, operations, or individual/team performance, and must not attempt to influence an individual or team’s performance in any way.
6. School representatives are assigned through the process of coach pairing within the Cyber Skyline platform. Coach pairing must be completed during the registration period. To maintain the integrity of the NCL events, a player’s failure to associate with a coach on the Cyber Skyline platform will result in the forfeiture of that player’s ability to submit an appeal should any incidents arise.
7. We reserve the right to contact Coaches to confirm if a Student Player followed the rules during the game, and take action based on the Coach’s response.

6. Internet, Software, and Hardware Resources

1. During Individual and Team Games, Players may use any Internet resources of software they choose provided there is no fee required to access those resources and access to those resources is not restricted in any way that would prevent another player from accessing the same resource. The exception to this requirement is for AI software, which is governed by Section 7. These restrictions do not apply to the Practice Game or Gymnasium.
2. Resources that require a .edu email address are NOT considered freely available since a .edu email address is not required to participate in NCL.
3. Use of Internet resources such as FAQs, how-to's, pre-existing forums and responses, and publicly accessible company websites, are permitted for Game use. However, during the Individual and Team Game, players are still subject to all restrictions on obtaining or receiving assistance from other individuals.
4. Players may only use generally available consumer hardware with their participation in the NCL games.
5. If there are any questions or concerns if a specific resource is allowed during the Game, please open a support ticket to get confirmation before using the resource.

7. AI Usage

1. Players are allowed to use artificial intelligence (AI) tools to assist them, with the following limitations.
2. Players may NOT use AI agents to directly interact with the competition platform on their behalf AT ANY TIME (i.e., connecting to any terminals in the platform and submitting commands, or connecting directly to web instances on the cyberskyline.com platform or hosted on cityinthe.cloud domains to test for vulnerabilities/submit answers). This applies to the Practice Game and Gymnasium.
3. Players may only use AI models that are generally available to all individual consumers. Models that are only available to enterprises or invite-only programs are prohibited.
4. Total monthly spend for AI services may NOT exceed $50/month per player. This limit may be satisfied through a subscription or usage-based pricing, or a combination of both. All tools beyond this budget must be free or open-source. NCL is not liable for any token costs, overages, or subscription charges players incur.
5. For self-hosted or locally run models, total VRAM used is not to exceed 32GB (by combined model weights and context). On unified-memory systems, this refers to memory actually consumed by the model, not total system RAM. This limit also applies to cloud-rented GPU compute.
6. Use of institutional compute clusters or servers for AI use during the games is prohibited.
7. Players are strongly encouraged to be responsible in their usage of these tools so that AI tools are not replacing their learning of relevant concepts.
8. NCL representatives will not be able to provide assistance in troubleshooting issues that may arise from results produced by AI and any associated hallucinations.

8. Site Usage

1. Where allowed, public Internet activity and access will be monitored, and any player caught viewing inappropriate or unauthorized content will be subject to disqualification and/or a penalty assigned to the appropriate individual/team. For the purposes of the NCL Games, inappropriate content includes pornography or explicit materials, pirated media files, sites containing key generators and pirated software, etc.
2. The Game network is publicly accessible, not a protected, isolated environment; as such, NCL representatives are not responsible for the security of any information, including login credentials, which players place on the Game network. It is suggested that competitors NOT use credentials in the NCL environment that are mirrored from any other system.
3. Any local on-site mechanisms that interfere with Game system access or the accuracy or functionality of the scoring engine or manual scoring checks are exclusively the responsibility of the player/team. This includes but is not limited to Internet connectivity, firewall rule, Intrusion Detection/Prevention Systems, Network Access Controls, and other player-side defensive actions.

9. Scoring System Attacks

1. DO NOT, under any circumstance, attack the NCL Game or scoring systems. This includes, but is not limited to, launching automated scans or tools targeted towards the scoring system, attempting injections, altering targets, or attempting to manipulate data stored within the scoring system. Players found manipulating, or attempting to manipulate, the scoring system will be immediately disqualified from the current and future NCL events.
2. If you are ever unsure if your actions will result in an attack against the scoring system, open a support ticket with the NCL platform provider, Cyber Skyline.

10. Disabling or Altering Challenges or Puzzles

1. DO NOT under any circumstance purposely disable, alter, or damage a challenge/puzzle and/or target in a manner that will disrupt the solution or structure of the puzzle or gameplay for other players or teams. This includes, but is not limited to, changing core system configurations (passwords, firewall rules, services, etc.), manipulating any network settings, and/or altering, introducing, or removing vulnerabilities on the system. Altering public Internet resources related to puzzles is not permitted.
2. Puzzles and targets may break, but do not purposefully attempt to limit or disable another player's ability to complete a challenge.
3. Some challenges require you to make changes to a system (adding files, executing commands, exploiting vulnerabilities, etc.). Players should limit their interaction to the scope of the puzzle - don't change the way the challenge works.
4. Players found manipulating the puzzles and targets may be disqualified from playing in current and/or future NCL events and/or have their scores altered.

11. Challenge Artifacts

1. Challenges may include associated data or computer resources necessary for the solving of a challenge (such as images, text log files, network traffic data, code snippets, web servers, computer programs, raw binary data, etc.). In some instances, artifacts may be made available for download. In others, artifacts may be provided directly within the Cyber Skyline platform.
2. Some artifacts may resemble malware or contain information mimicking real cyber-attacks. While these artifacts have been designed to be as inert as possible, artifacts may affect a player’s computer environment and may trigger an antivirus response. It is the responsibility of the player to take the proper precautions to interact with challenge artifacts in a safe manner. NCL and its affiliates are not responsible for any damages arising from player’s use of challenge artifacts.
3. When artifacts are provided directly within the Cyber Skyline platform, it is the responsibility of the player to interact with these artifacts in a non-damaging way. Artifacts modified or damaged by the player may or may not be reset at the NCL/Cyber Skyline operation team’s discretion.
4. In some instances, publicly shared artifacts will be automatically reset to ensure that everyone has an equal opportunity to access the artifacts.

12. Collusion or Flag Sharing Violation Repercussions and Actions

1. DO NOT provide any other player with answers to challenges and DO NOT accept answers to challenges from any player, coach, or other source during a Game. Questions or artifacts should not be posted during or after a Game.
2. A proprietary algorithm and method for determining flag sharing may be employed by the NCL. Participants agree to accept the judgment and findings of the Commissioner as to whether flag sharing has occurred. These findings will become final and binding after the available appeals process has been exhausted.
3. If a player is identified as sharing flags or for rule violations, post-Game adjustments will be made. This may result in one or more of the following:
1. Point deductions for the player or team in question
2. Removal of the player or team from the leaderboard and disqualification for any prizes, Scouting Report, or Certificate of Participation
3. A ban from participating in the NCL
4. Again, during the NCL Team Game, players from the same team are encouraged to work together to solve the challenges.

13. Laws

1. DO follow the laws in your area and the United States.
2. DO NOT under any circumstance violate any laws or the terms you've agreed to in this Rules document.
3. Violations of local, state or national laws will be reported to law enforcement.
4. DO follow all institutional policies, including your institution’s honor code.

14. Intellectual Property

1. All text, graphics, user interfaces, visual interfaces, photographs, trademarks, logos, sounds, music, artwork, computer code, challenges, and artifacts used within the NCL season are owned or licensed by the NCL and are protected by copyright, patent, and trademark laws. You may not copy, reproduce, alter, modify, resell, mirror, or create derivative works of the materials used within the NCL season. You may not use any materials within the NCL season to train, retrain, test, or otherwise develop any artificial intelligence, machine learning, deep learning, or large language models, or similar algorithmic or neural network systems.
2. Documents containing our challenges or associated artifacts, commonly referred to as "writeups" or “solution guides” may not be published or distributed without our written permission.
1. Participants are allowed to use NCL intellectual property for non-commercial, personal use where the intellectual property is not distributed to the public (e.g. saving challenges for private practice, sharing a writeup with an employer during the hiring process)
3. All participants agree to grant NCL and its agents a royalty-free, worldwide, transferable, sub-licensable, irrevocable and perpetual license to incorporate or otherwise use any suggestions, enhancement requests, recommendations or other feedback.
4. All participants own their own content and intellectual property generated from their participation in the NCL Games. We do not represent any ownership or claim any intellectual property rights over the information that you provide or that is provided to us.

15. Scoring

1. Scores will be maintained by the NCL representatives and will be shared as soon as possible after the Game. The NCL will do its best to periodically update a leaderboard with running totals provided during the Game. Any (individual or team) action that interrupts the scoring system is exclusively the responsibility of that individual/team and will result in point penalties/disqualification. Should any question arise about scoring, the scoring engine, or how they function, the School Representative should contact NCL representatives. Leaderboard scores are subject to change after the end of the competition based on analysis of results.
2. In the spirit of learning for the NCL competition, players and teams should use critical thinking and independent research to solve the challenges. Players and teams may not brute force the answers as a scoring strategy. Players and teams found to be brute forcing answers or otherwise attempting to circumvent the NCL Rules of Conduct may be deemed as unprofessional and unsportsmanlike conduct and may be subject to a penalty or a point deduction at the sole discretion of the NCL. If you have any questions about a particular conduct, you are welcome to open a support ticket for clarification.
3. If a player believes their answer for a challenge was incorrectly scored, they may open a support ticket to request a review from the NCL Team. Should the answer be accepted, all players that submitted the same answer for that challenge will be credited for that answer submission and any of their subsequent answer submissions for that challenge will be removed. Requests for an answer review MUST be submitted prior to the end of the Game. It is not possible to request an answer review after a Game has ended.

16. Questions

1. Prior to the Games, Players and Coaches are encouraged to work with NCL officials to resolve any questions before the Game begins or before any other deadlines to allow time for resolution steps. Questions regarding the active Game challenges must be raised before the Game ends. All questions can be submitted as a Support Ticket within the Cyber Skyline platform.
2. During the Games, players may not conduct social engineering attempts against NCL officials or support staff. Players may ask clarification questions in which a clarification may be provided at the sole discretion of NCL officials or support staff. To ensure a fair competition environment, players asking questions in a form that utilizes the support system as a mechanism to pre-check answers will constitute a social engineering attempt. Players will be provided a warning notice (without penalty) if an NCL official believes that a social engineering attempt was made by a player. Further violations of this rule after the warning notice may be subject to a penalty or a point deduction.

17. Nondisclosure

1. The NCL management team strives to make being part of the NCL community an enriching experience. All members of the NCL management team are open to feedback, suggestions for improvement, and conveying areas of concern or dissatisfaction.
2. Participants are forbidden from publishing, posting on the Internet, or publicly communicating details of the competition. This includes the disclosure of puzzles and their respective artifacts and solutions for both individual and team play as well as the gym.
3. Institutions may publish, post on the Internet, or publicly communicate news stories of a general nature about the NCL, and may also enumerate participating individuals, teams and winners.

18. Appeals Process

1. The appeals process is only available to eligible Student Players and teams represented by a Faculty Coach. Industry Players are not eligible to submit or participate in the appeals process.
2. To process an appeal, Student Players, individual(s)/teams(s) must have a coach from the beginning of the season. Otherwise, the right of appeal is forfeited.

Appeals by any individual(s)/team(s) must be presented by the Faculty Coach via video conferencing. Faculty Coaches must book a time with the NCL Team and present their appeal within 72 hours of notification.

1. It is possible that an appeal during an event could have some initial solution that might prevent or allow continued play by a player or team.
2. If a player or team is allowed to continue after an appeal, any further violations will accumulate and may result in a point penalty and/or disqualification.
3. The NCL will act on the appeals within three (3) days of initial individual/team appeal.
4. Individuals/teams might appeal:
1. Accuracy of a ruling.
2. Introduction of new information about the case. The appealing party must provide data to support their contention.
5. NCL representatives will be the final arbitrators for any appeals or questions arising before, during, or after the Game. Rulings by the NCL representatives and Game results are final after the appeals process has been exhausted.
6. In the event of an individual(s)/team(s) disqualification, the player(s)/team(s) must leave the Game environment immediately and will be barred from re-entry.
7. Disqualified individuals/teams are ineligible for individual/team awards, certificates of participation, Scouting Reports, scholarships, etc., as defined by the NCL.
8. Appeals may be addressed to appeals@nationalcyberleague.org.

Sanctioned Schools Policy

The Sanctioned Schools Policy is NCL’s last resort in dealing with schools with repeated major Rules of Conduct violations. A school may avoid becoming sanctioned if their faculty refers the major Rules of Conduct violations to their student honor enforcement office. The outcome determined by the honor enforcement office will have no bearing on the NCL Sanctioned School Policy. Sanctioned schools will have their players unranked during the NCL Games for the duration of their sanction.

Sanctioned Schools are schools with repeated, problematic Rules of Conduct violations. The purpose of school sanctions is to maintain the integrity of the NCL competition when proper discipline is not being enforced at a school. School sanctions are a last resort after discussions with faculty at a school fail to curb Rules of Conduct violations.

A sanctioned school will have the following restrictions imposed:

1. The sanctioned school will not be included in the Cyber Power Rankings.
2. Students from the sanctioned school will be unranked.
3. Students from the sanctioned school will not qualify for a Scouting Report, Certificate of Participation, or any prizes.

A school will become sanctioned if one or more of the following conditions are met:

1. Students from the school have Rules of Conduct violations in two or more seasons in the past two years AND there is no responsible coach for the school. An effort will be made to attempt to identify a responsible coach during the first Rules of Conduct violation.
2. There have been Severe Rules of Conduct violations in two or more seasons in the past three years with coaches being informed of the violations.
1. If school representatives are cooperative with NCL and the students involved in the Rules of Conduct violations are referred to the school’s honor enforcement office, then the violation will be exempted from counting towards this sanction condition. The outcome of the honor enforcement office will NOT have any bearing on the exemption.
2. There is no exemption if a coach has a Rules of Conduct violation
3. There has been a Severe Rules of Conduct violation from a school whose sanction ended in the past two years.

Severe Rules of Conduct violations are violations where one of the following occurs:

1. Someone posts NCL content online or asks questions on how to solve a challenge online.
2. Someone sabotages the game (e.g. edits a Wikipedia page, intentionally posts or provides false information to confuse other players).
3. Members of a team provide or receive unauthorized assistance and they place in the overall top 20% of the Team Game.
4. A group of two or more students collaborate together in violation of the Rules of Conduct and any of them place in the overall top 20% of the Individual Game.
5. A group of five or more students collaborate together in violation of the Rules of Conduct.
6. A Coach has a Rules of Conduct violation.

When a school meets the condition to be sanctioned, the school will be sanctioned between one to three years depending on the severity of the infraction and the level of cooperation from faculty at the school.

NCL will attempt to take steps to prevent a school from being sanctioned, such as:

1. The first Rules of Conduct violation of any type will result in a notification to the coach.
2. The second Rules of Conduct violation or the first Severe Rules of Conduct violation can result in a meeting with the coach, their supervisor, and an academic affairs representative from the school.
3. Any Rules of Conduct violation from a coach will result in a meeting with the coach, their supervisor, and an academic affairs representative from the school.