CACAO v2.0 empowers organisations to orchestrate, collaborate, and share cybersecurity playbooks. In the ongoing battle against threat actors, organizations must identify, create, document, and test various steps to detect, investigate, mitigate, and remedy potential threats. The culmination of these steps results in a cybersecurity playbook designed to secure organizational systems, networks, data, and users. This standard was published in November 2023.
In October 2026, this standard is revised for CACAO v3. This version is expected to make incident-response procedures easier to exchange, automate and reuse across tools and organisations. Clearer execution semantics can reduce inconsistent implementations and integration effort. For European SMEs, an open, vendor-neutral specification can lower development and market-entry barriers, enable reusable products and integrations, and reduce dependence on proprietary platforms. Wider adoption should help SOCs and CSIRTs coordinate responses more efficiently, strengthening the resilience of businesses and essential services and reducing the societal disruption caused by cyber incidents.
