Cybersecurity Merit Badge

Keep the list you make in 4(f)

Requirement 4(f) is the only step on this badge that produces an artifact. Everything else is explained, described, defined or discussed. 4(f) asks you to write out your cyber attack surface: the accounts, apps, devices and networks through which somebody could reach your personal information.

Now look at what requirement 5 offers, one requirement later:

Those two are the second half of 4(f). The list tells you what to protect; these tell you to protect it. The badge does not connect them, and this plan does not draw an arrow where the badge states none, but a reader who keeps the 4(f) list has already done most of the thinking for both.

Write it somewhere you will still have it: a note file, not the back of a meeting handout.

Requirement 5(c): nine options, three needed, and some are the same evening

This is the largest menu on the badge. Picked carelessly it is three separate projects. Picked well it is one sitting.

The remaining three stand alone: 5(c)(2) multi-factor authentication, 5(c)(4) a virus scan, 5(c)(7) backing up a mobile device.

The whole of 5(c) needs your parent or guardian's permission before you start, and that covers all three of whatever you choose.

The one option with a legal edge

5(c)(9) Identify one or more other vulnerabilities on your home computer or network, or another computer or network you have permission to use, and discuss with your counselor. With permission from the system owner, take the necessary actions to fix it.

Permission is stated twice in one requirement, and that is not an accident. Everything else on this badge is done to your own devices or in a browser. This one sends you looking for weaknesses.

Scanning, probing or "testing" a network you do not own is not a grey area. It does not become acceptable because the intent was educational, because nothing broke, or because you meant to tell them afterwards. School networks, a friend's home network, a library and a coffee shop are all somebody else's systems.

If you want this option, the clean version is your own home network, with the person who pays for the internet connection told in advance what you are doing and what you propose to change. Requirement 2 is where the badge explains why this matters, and it is worth reading 2(b) again before choosing this option rather than after.

Cryptography: two of these four need another person

The badge prints all four as equal members of one list. 6(c)(4) is not equal. It needs software installed, a key pair generated, a keyring populated with other people's keys, and at least one other person who has done the same. If nobody in your troop already uses PGP, that option is a project rather than an evening.

6(c)(3) is the quiet one worth choosing, because the person who changes your file needs to do nothing but change it, and your counselor can do that in the meeting where you show it.

Requirement 7 is twelve answers, and it looks like one

Describe to your counselor four electronic devices you encounter that could be connected to the internet, why this connectivity can be useful, what risks are posed by the connectivity, and how they could be protected.

No letters. No sub-parts. One sentence, four devices, and three questions about each of them. That is twelve answers, and it is the shortest-looking requirement on the page.

Prepare it as a table rather than as a paragraph, and the shape of it stops being a trap.

Three permissions and one video that is not only this badge's

Five merit badges require the same Personal Safety Awareness "Digital Safety" video. On four of them, including this one, it is a lettered or numbered requirement in identical words: Cybersecurity 1(a), Programming 1(a), Digital Technology 1 and Photography 1(b). On Competitive Gaming it appears as a note inside requirement 2 rather than as a step of its own. Whether viewing it once can satisfy more than one badge is a question for your counselor and not one this page will answer, but it is worth raising rather than discovering.

What has no second source

Almost every badge can be read twice: the page, and then the printed requirements book or the badge pamphlet. This badge has neither. It has no pamphlet at all, and the 2025 printed requirements book does not contain it. The word cybersecurity does not appear in that book once.

That is not a problem to solve, it is a fact to record. It means the page is the only authority, so the date it was read matters more here than usual, and it is printed on this plan. Before you rely on any of this, open the official requirements and check they still say what this page says they say.

The Cybersecurity merit badge, drawn so the list you make early is still useful later. It is not a copy of the requirements: each step is a short label with a link to the official requirements, which are what actually governs and which change from year to year.