CACAO: Collaborative Automated Course of Operations for Cyber Security
Already a member?
Access the CACAO community workspace here
Defining the standard for implementing course of action playbooks for cybersecurity operations.
The CACAO TC is developing a standard to implement the course of action playbook model for cybersecurity operations.
In order to defend against cyber threats, organizations must manually identify, create, and document the prevention, mitigation, and remediation steps that, together, form a course of action playbook. However, today, there is no standardized way to document and share these playbooks across organizational boundaries and technology solutions.
CACAO addresses this problem by defining a sequence of cyber defense actions that can be executed for each type of playbook.
It will specifically enable organizations to:
· create course of action playbooks in a structured machine-readable format,
· digitally sign course of action playbooks,
· securely share course of action playbooks across organizational boundaries and technological solutions, and
· document processing instructions for course of action playbooks in a machine readable format.
CACAO Sponsors
TC Leadership
Chairs:
Bret Jordan, Afero
Vasileios Mavroeidis, University of Oslo
Secretary:
Mateusz Zych, University of Oslo
“The creation, development, and now approval of CACAO v2.0 as a Committee Specification is a testament to the hard work and collaboration of so many different individuals and organizations from around the world to help solve one of the biggest problems in cyber defense: the orchestration of response in cyber relevant time. This standardized approach to orchestrated cyber defense gives organizations the ability to navigate the evolving threat landscape with confidence, armed with the tools needed to orchestrate and automate responses effectively.”
Bret Jordan, co-chair of the CACAO TC
“OSIM represents an important effort to address the need for greater structure and comprehensibility of software supply chains. By establishing standardized information models we can enhance transparency, interoperability, and resilience in end-to-end operations — ultimately aiding cyber risk management and protecting critical infrastructure.”
Isaac Hepworth
Google, OSIM co-chair
“OSIM’s approach not only drives a universal taxonomy of thought, it also brings clarity and ease to how we implement standards and frameworks to support multiple industry software supply chain security needs. OSIM facilitates the identification of similarities and differences across specifications, enhancing interoperability and simplifying processes. The current cybersecurity landscape can no longer be defended in a silo.”
Jay White
Microsoft, OSIM co-chair
Frequently Asked Questions
CACAO (Collaborative Automated Course of Action Operations) for Cyber Security is essential for improving cybersecurity response in the face of increasingly complex threats. By defining the standard for implementing course of action playbooks, CACAO enables organizations to automate and orchestrate their responses, reducing the risk of delays, inconsistencies, and human error. These standardized, predefined playbooks provide a clear framework for timely, coordinated actions across systems and teams, empowering organizations to respond effectively to evolving threats. With CACAO, organizations can enhance their cyber defense capabilities, ensuring rapid and confident responses while maintaining operational efficiency and resilience.
The CACAO TC is open to a wide range of professionals and organizations involved in cybersecurity operations. By joining, these stakeholders can help shape a standardized framework that improves collaboration, automation, and response across the cybersecurity landscape.:
Security Vendors: Organizations that develop and provide security solutions can contribute by ensuring CACAO’s compatibility with industry tools and technologies.
Incident Responders: Professionals involved in managing and responding to cyber incidents can help shape the playbook structure and functionality for effective incident handling.
Security Operation Centers (SOCs): SOC teams that monitor and respond to security events will benefit from CACAO’s ability to streamline response actions and improve operational workflows.
Cyber Defense Centers: Organizations dedicated to defending against cyber threats can participate to ensure CACAO meets the needs of proactive defense strategies.
Threat Intelligence Analysts: Analysts who generate and assess threat intelligence will be instrumental in ensuring CACAO’s integration with threat intelligence standards like STIX, enabling more effective threat responses.
Large Enterprises: Corporations with complex security infrastructures can benefit from CACAO’s standardized playbook framework, making it easier to manage security across multiple teams and systems.
Governments: Government agencies involved in national cybersecurity defense and coordination can help ensure CACAO supports cross-agency collaboration and is aligned with public sector needs.
CACAO stands out by offering a standardized, modular framework for creating and sharing cybersecurity playbooks across organizational and technological boundaries. It integrates seamlessly with existing tools and processes, allowing security teams to automate and orchestrate responses to threats without overhauling their current systems. By enabling cross-boundary collaboration and flexibility in playbook design, CACAO enhances the efficiency and adaptability of cybersecurity operations, helping organizations respond more effectively to evolving cyber threats.
Organizations often struggle with the complexity of integrating and automating cyber defense processes across diverse IT environments. These challenges include inconsistent response protocols, manual workflows, and difficulty in maintaining security policies across different systems. The CACAO standard helps by providing a flexible framework for automating cyber defense operations. It enables organizations to define, execute, and share automated response actions, improving efficiency, consistency, and effectiveness in threat response. By standardizing these processes, CACAO helps organizations adapt quickly to evolving cyber threats, ensuring a more agile and coordinated defense strategy.
Archives of the mailing list used by CACAO members to conduct Committee work are available here. TC membership is required to post to this list. TC members are automatically subscribed.
New Members Welcome
Whether you want to actively contribute in decision-making or just observe progress from the inside, you will need to be an OASIS member.
If your employer is already on our current member list, submit this request form to be added to the TC Roster. If not, find out how to join OASIS.
Non-members may monitor the mailing list archives online, view approved documents, and provide feedback to our comments list. Contact Us for more information.