- CACAO v3.0: Enhancing Interoperable Cybersecurity Playbooks for EU-wide Response
Cybersecurity/Network and Information security
The development of CACAO v3.0 directly benefits European SMEs by reducing technical and financial barriers to adopting advanced cybersecurity practices. The standard’s open and vendor-neutral design allows smaller organizations to integrate automated playbooks into their operations without relying on costly, proprietary tools. This strengthens their incident response capabilities and helps them meet the security and reporting obligations set out in the NIS2 Directive and the Cyber Solidarity Act. Beyond SMEs, CACAO v3.0 enhances resilience across European digital infrastructure by enabling harmonized, machine-readable playbooks that support faster, coordinated responses to incidents affecting critical services such as energy, healthcare, and public administration.
The fellowship directly supports Europe’s goals for cyber resilience, digital sovereignty, and trust in critical infrastructure. By improving CACAO’s technical maturity and usability, the work enables more organizations—especially SMEs and public-sector entities—to adopt standardized, automated cybersecurity playbooks without reliance on proprietary technologies. The resulting CACAO v3.0, with better schematics and semantics specification, offers easier, more coordinated responses to cyber incidents, reducing disruption to essential services such as healthcare, energy, and transport. It also reinforces cross-border cooperation and preparedness through machine-readable, reusable response procedures, enabling Member States and operators of essential services to collaborate under shared frameworks like NIS2 and the Cyber Solidarity Act. Ultimately, this work enhances Europe’s capacity to defend against complex threats while fostering open collaboration, transparency, and interoperability—key enablers of a secure and digitally independent European society
- Revision of existing work items
- Update of existing work items
- Finalisation and Adoption of CACAO v3 for Cybersecurity Automation
Cybersecurity/Network and Information security
CACAO v3 is expected to make incident-response procedures easier to exchange, automate and reuse across tools and organisations. Clearer execution semantics can reduce inconsistent implementations and integration effort. For European SMEs, an open, vendor-neutral specification can lower development and market-entry barriers, enable reusable products and integrations, and reduce dependence on proprietary platforms. Wider adoption should help SOCs and CSIRTs coordinate responses more efficiently, strengthening the resilience of businesses and essential services and reducing the societal disruption caused by cyber incidents. The fellowship strengthened European input into this international specification and supported knowledge transfer through project activities and technical dissemination. These benefits should grow as v3-compatible tooling, migration support and operational adoption mature.
- Revision of existing work items
-
The activity contributes to the revision and finalisation of the OASIS Collaborative Automated Course of Action Operations (CACAO) specification, specifically CACAO Security Playbooks Version 3.0. The affected body is the OASIS CACAO Technical Committee, where I serve as Secretary.
Value of Research
The fellowship addressed key limitations found in version 2.0 of the OASIS Collaborative Automated Course of Action Operations (CACAO) standard. While CACAO v2.0 introduced the first machine-readable format for cybersecurity playbooks, real-world use revealed gaps that limited interoperability and automation. The most critical issues included ambiguous schema elements, unclear execution semantics, and limited support for graphical and modular representations needed to visualize and exchange playbooks. From a European standpoint, these shortcomings directly affected operations.
Read more
