Cybersecurity/Network and Information security

The fellowship addressed key limitations found in version 2.0 of the OASIS Collaborative Automated Course of Action Operations (CACAO) standard. While CACAO v2.0 introduced the first machine-readable format for cybersecurity playbooks, real-world use revealed gaps that limited interoperability and automation. The most critical issues included ambiguous schema elements, unclear execution semantics, and limited support for graphical and modular representations needed to visualize and exchange playbooks. From a European standpoint, these shortcomings directly affected operations. SOCs, CSIRTs, and critical infrastructure operators faced difficulties creating executable playbooks, hindering the coordinated responses envisioned by the NIS2 Directive, the Cyber Solidarity Act, and the EU Cyber Crisis Blueprint.

The fellowship, therefore, focused on three main goals:
1. Consolidating feedback from European and international stakeholders who implemented CACAO v2.0.
2. Designing and drafting CACAO v3.0 — a major revision introducing structural schema improvements, more precise execution semantics, and modular extensibility.
3. Aligning the work with EU cybersecurity policy and operational priorities so that standardized, machine-readable playbooks can support coordinated preparedness and response.

The effort resulted in the ongoing working CACAO v3.0 Draft Specification and accompanying validation outputs, now progressing toward formal adoption within OASIS. By resolving the main technical and semantic issues, the fellowship strengthened Europe’s role in cybersecurity standardization. It established a solid, vendor-neutral foundation for automated, collaborative cyber defense across the EU.
 

This was a one-shot contribution to provide travel support for participation to the Internet Engineering Task Force (IETF), and specifically participation at the July 2025 plenary meeting in Madrid. I attended this meeting as an Internet Transport expert contributing work and progressing standards to support the evolution of the Internet and its support for enhanced resilience, authentication and privacy. An in-person attendance at the technical sessions also allowed me to progress the work for which I am an editor: Qlog draft-ietf-tsvwg-careful-resume-qlog, a transport specification based on the “qlog” specification being developed by the IETF QUIC; and a recent work item in the IETF Congestion Control working group, “Increase of the Congestion Window when the Sender Is Rate-Limited” (draft-ietf-ccwg-ratelimited-increase). In-person participation at this meeting is particularly important in my current role as an Area Director of the WIT Area, where I will help organise and oversee the meeting as a whole and specifically support the WIT area WG chairs in organising WG sessions and supporting cross area review of emerging specifications.