CIRCUS Rules — 2026 Season

Competitor Eligibility

1. Competitors participating in CIRCUS must be at least part-time students of the institution they are representing. This can include any major or certificate program and does not need to be tied to any associate degree or degree for transfer. Students may be enrolled in any credit or non-credit class.
   1. Team members must not be employed full-time in any information technology or cybersecurity-related position. This is a disqualifier for eligibility.
   2. Individual competitors may participate in CIRCUS events for a maximum of three seasons. A CIRCUS season is defined as the period of time for one academic year. Participation on a team in any CIRCUS event during a given season counts as participation for that entire season. This eligibility limit follows the student across institutions (for example, two seasons at one school and one at another).
   3. A competitor in their final semester prior to graduation may compete in the spring semester for CIRCUS even if they are not enrolled in spring courses.
2. Competitors may only be a member of one team per CIRCUS season.
3. A team member may not participate in any organizational role (e.g., judge, developer) at CIRCUS events held outside the region in which their team competes during the same season.
4. Individuals who have participated in previous CIRCUS events in any role other than as a competitor must obtain eligibility approval from the director of the competition before being added to a team roster. Once approved, they remain eligible for all CIRCUS events during that season. Violations may result in suspension of the competitor for up to two years and their team for up to one year.

Team Composition

1. Each team must submit a roster of up to seven (7) competitors to the competition director of the first CIRCUS event they participate in during a given season. Rosters must be submitted at least one week prior to the start of that event. All competitors on the roster must meet all eligibility requirements. No changes to the roster are permitted after the team competes in its first CIRCUS event. The competition team is chosen from this roster.
2. Each competition team may consist of up to five (5) members selected from the roster.
3. If a member of a competition team advancing to the CIRCUS final is unable to attend, that team may substitute another student from the roster prior to the start of the final competition.
4. Once a CIRCUS event has begun, a team must complete the competition with the team that started the event. Substitutions, additions, or removals of team members are prohibited except under extreme circumstances.
5. Alternates may participate in the virtual portion of the CIRCUS event and work on the incident response report, but they cannot participate in the final in-person session.
   1. Team representatives must petition the Competition Director in writing for any change to the competition team.
   2. The Competition Director must approve any substitutions or additions before they occur.
6. Teams or team members arriving after the official start time of the competition final presentations, for reasons beyond their control, may be allowed to join the competition provided a substitution has not already been made. Event coordinators will review the reason for tardiness and make the final determination.
7. Each team will designate a Team Captain for the duration of the competition. The captain acts as the liaison between competition staff and the team before and during the event. In the captain's absence, another team member must serve in this role at all times while in the competition space.
8. An institution may field as many teams as it wishes during the virtual portion of the competition, but only one team from that institution may advance to the CIRCUS final.

Divisions

The CIRCUS competition is comprised of two (2) divisions:

• Division I: Four-year colleges and universities, or community colleges with a bachelor's degree program in information technology, computer science, cybersecurity, or a similar discipline.
• Division II: Two-year colleges and trade schools that do not offer a four-year bachelor's degree as described above.

Each division has independent judges and judging panels, and teams are scored separately.

Team Representatives

1. Each team must have at least one institutional representative present at any in-person CIRCUS event. The representative must be a faculty or staff member of the institution the team represents.
2. Once a CIRCUS event has started, representatives may not coach, assist, or advise their team until the event is complete (including overnight hours for multi-day competitions).
3. Representatives may observe their team's final presentation but may not provide advice or instructions during the event. They may coach and provide instruction during the virtual and report-writing portion.
4. Representatives must not interfere with any other competing team.
5. No outside assistance other than the representative is allowed. Non-team members, alumni, or professionals must not discuss any aspect of the competition with the team during competition hours or attempt to influence team performance.

Competition Conduct

1. Throughout the competition, Operations and White Team members may require access to a team's systems for scoring or troubleshooting. Teams must immediately grant access when requested.
2. Teams must not connect devices or peripherals to the competition network unless specifically authorized by Operations.
3. Teams may not modify the VM configurations of competition systems. They may download and use open-source tools, copy files, and download systems (VMs and containers) as instructed for analysis, and should follow good forensic and evidence-handling practices.
4. Team members are forbidden from interfering with other teams' environments. This is grounds for disqualification.
5. Teams must compete without outside assistance from non-team members (except their representative) for the duration of the event. Private communications with non-team members that provide an unfair advantage are prohibited and may result in penalties or disqualification.
6. Printed reference materials (books, checklists, etc.) are permitted. Internet resources and artificial intelligence (AI) tools may be used for research, but heavy reliance on them in reports and correspondence with organizers may result in lower scores.
7. Sponsors and observers are not competitors and may not directly assist any team. Any sponsor or observer found assisting a team may be removed from the competition area, and the team may receive penalties.
8. Teams may examine their own systems, but offensive activity against any system outside their assigned network(s)—including systems belonging to other teams—will not be tolerated and is grounds for immediate disqualification. If in doubt about whether an action could be considered offensive, teams must consult the Operations Team before proceeding. Remember that CIRCUS is a forensics/IR competition, not a penetration-testing event.
9. All team members must wear badges identifying their team affiliation at all times during competition hours.

Permitted Materials

1. Teams may upload and download software, applications, and files as needed from the competition space. Teams are strongly encouraged to follow sound evidence-gathering and documentation practices.
2. Teams may use any open-source software or commercially available trial software (e.g., Autopsy, CAINE). Fully licensed commercial forensics tools that require paid licenses (such as FTK) are not permitted.
3. Printed reference materials (books, magazines, checklists) are permitted in competition areas and may be brought by teams for reference.

Competition Phases

Phase 1 — Virtual Competition

The first phase of the competition is held virtually. Teams sign up at the beginning of the CIRCUS season. At a specified date, they receive a statement of work from their "client" with instructions and download locations for "backed up" images of the client's systems.

Teams have one to two weeks (as defined for that season) to analyze the images for forensic artifacts, compile an incident report, and submit their findings according to the statement of work. Specific instructions may change from year to year.

Phase 2 — In-Person Final

The second phase is held in person. Organizers will notify the top five teams from each division of their advancement to the finals (number may vary by season). Organizers will make every effort to provide sufficient notice for travel arrangements. At the time of this writing, finals are planned for Pasadena, CA at the SCALE conference.

The final competition consists of a 45- to 60-minute session where teams present their report findings to a simulated audience such as legal counsel, law enforcement, or a mock grand jury. This presentation is scored and factored into final placement.

Competition Execution and Scoring

Competition scoring is based on:

• Artifact Discovery (~25%): Teams identify and interpret artifacts relevant to the investigation (e.g., logs, files, indicators of compromise). Different artifacts may carry different point values depending on importance.
• Findings Report (~50%): Each team produces a comprehensive findings report describing artifacts discovered, handling procedures, and the overall narrative of the breach. Reports are evaluated for sound forensic practices and quality of documentation.
• Final Presentation (~25%): The top five teams from each division (limited to one per school) advance to a one-hour mock deposition, where all five team members provide testimony on their findings and report. Scoring considers professionalism, mastery of the report contents, and clarity in explaining their methods and conclusions.