OASIS

Available (33)

Showing 1 - 12 per page



Svante Schubert

Description of Activities

A key goal of my work is to advance the digital transformation of standardisation itself. While digital processes are already common in business and administration, most standards are still developed using traditional, text-based methods with a high degree of manual effort. I aim to make standards digital, machine-readable, and easier to maintain, supported by tools that enable automated versioning, validation, and quality assurance.
I also strongly promote the use and evolution of Open Standards. Open and freely available standards encourage broader participation, faster development cycles, and more thorough expert review across the European and international community.
With the fellowship, I can expand my ongoing work on the European e-invoicing standard EN16931, turning voluntary contributions into focused development. The goal is to bridge the gap between theoretical standard specifications and practical implementation through automation and open-source collaboration.
Ultimately, this effort contributes to greater efficiency, transparency, and digital sovereignty within Europe’s standardisation ecosystem — ensuring that the standards themselves become as modern and interoperable as the digital solutions they enable.
 

Country
Germany
Impact on SMEs (9th Open Call)
My contribution has a direct positive impact on European SMEs by simplifying the implementation of the EN16931 e-invoicing standard. The automated generation of high-quality code list artefacts removes inconsistencies and reduces technical complexity, allowing SMEs to integrate compliant e-invoicing into their business software more easily and at lower cost. This helps smaller companies meet public procurement and cross-border trade requirements without relying on expensive proprietary tools. By publishing the tooling under a European FOSS license, SMEs gain free access to transparent, reliable, and reusable resources that strengthen their competitiveness and participation in the Digital Single Market.

Impact on society (9th Open Call)
My work supports several key societal impacts aligned with Europe’s digital and sustainability goals. By improving the quality and automation of EN16931 e-invoicing artefacts, it strengthens the Digital Single Market and enables more efficient, transparent, and paperless business processes across Europe. This directly contributes to administrative simplification, environmental sustainability, and cost reduction—especially for SMEs and public administrations.
Through the use of open-source tools and open standards, my work also promotes digital sovereignty, ensuring that Europe’s core interoperability infrastructure remains transparent, accessible, and under European control. By fostering collaboration between public and private actors, the project helps create a more inclusive and resilient digital ecosystem that benefits businesses, citizens, and administrations alike.
Open Call
Portrait Picture
Svante Schubert
Proposal Title (9th Open Call)
Reliable, Automated Generation of EN16931 Code List Artefacts for European e-Invoicing
Role in SDO
Standards Development Organisation
StandICT.eu Year
2026
Topic (9th Open Call)

Mateusz Zych

Description of Activities

The fellowship addressed key limitations found in version 2.0 of the OASIS Collaborative Automated Course of Action Operations (CACAO) standard. While CACAO v2.0 introduced the first machine-readable format for cybersecurity playbooks, real-world use revealed gaps that limited interoperability and automation. The most critical issues included ambiguous schema elements, unclear execution semantics, and limited support for graphical and modular representations needed to visualize and exchange playbooks. From a European standpoint, these shortcomings directly affected operations. SOCs, CSIRTs, and critical infrastructure operators faced difficulties creating executable playbooks, hindering the coordinated responses envisioned by the NIS2 Directive, the Cyber Solidarity Act, and the EU Cyber Crisis Blueprint.

The fellowship, therefore, focused on three main goals:
1. Consolidating feedback from European and international stakeholders who implemented CACAO v2.0.
2. Designing and drafting CACAO v3.0 — a major revision introducing structural schema improvements, more precise execution semantics, and modular extensibility.
3. Aligning the work with EU cybersecurity policy and operational priorities so that standardized, machine-readable playbooks can support coordinated preparedness and response.

The effort resulted in the ongoing working CACAO v3.0 Draft Specification and accompanying validation outputs, now progressing toward formal adoption within OASIS. By resolving the main technical and semantic issues, the fellowship strengthened Europe’s role in cybersecurity standardization. It established a solid, vendor-neutral foundation for automated, collaborative cyber defense across the EU.
 

Country
Norway
Impact on SMEs (9th Open Call)
The development of CACAO v3.0 directly benefits European SMEs by reducing technical and financial barriers to adopting advanced cybersecurity practices. The standard’s open and vendor-neutral design allows smaller organizations to integrate automated playbooks into their operations without relying on costly, proprietary tools. This strengthens their incident response capabilities and helps them meet the security and reporting obligations set out in the NIS2 Directive and the Cyber Solidarity Act.
Beyond SMEs, CACAO v3.0 enhances resilience across European digital infrastructure by enabling harmonized, machine-readable playbooks that support faster, coordinated responses to incidents affecting critical services such as energy, healthcare, and public administration.
Impact on society (9th Open Call)
The fellowship directly supports Europe’s goals for cyber resilience, digital sovereignty, and trust in critical infrastructure. By improving CACAO’s technical maturity and usability, the work enables more organizations—especially SMEs and public-sector entities—to adopt standardized, automated cybersecurity playbooks without reliance on proprietary technologies.

The resulting CACAO v3.0, with better schematics and semantics specification, offers easier, more coordinated responses to cyber incidents, reducing disruption to essential services such as healthcare, energy, and transport. It also reinforces cross-border cooperation and preparedness through machine-readable, reusable response procedures, enabling Member States and operators of essential services to collaborate under shared frameworks like NIS2 and the Cyber Solidarity Act.

Ultimately, this work enhances Europe’s capacity to defend against complex threats while fostering open collaboration, transparency, and interoperability—key enablers of a secure and digitally independent European society
Open Call
Organisation type
Organization
University of Oslo
Portrait Picture
Mateusz Zych
Proposal Title (9th Open Call)
CACAO v3.0: Enhancing Interoperable Cybersecurity Playbooks for EU-wide Response
Standards Development Organisation
StandICT.eu Year
2026

OASIS Common Security Advisory Framework (CSAF) TC

The OASIS CSAF Technical Committee is chartered to make a major revision to the Common Vulnerability Reporting Framework (CVRF) under a new name for the framework that reflects the primary purpose: a Common Security Advisory Framework (CSAF). TC deliverables are designed standardize existing practice in structured machine-readable vulnerability-related advisories and further refine those standards over time.

OASIS Key Management Interoperability Protocol (KMIP) TC

The OASIS KMIP TC works to define a single, comprehensive protocol for communication between encryption systems and a broad range of new and legacy enterprise applications, including email, databases, and storage devices. By removing redundant, incompatible key management processes, KMIP will provide better data security while at the same time reducing expenditures on multiple products.

OASIS Privacy Management Reference Model (PMRM) TC

The OASIS PMRM TC works to provide a standards-based framework that will help business process engineers, IT analysts, architects, and developers implement privacy and security policies in their operations. PMRM picks up where broad privacy policies leave off. Most policies describe fair information practices and principles but offer little insight into actual implementation. PMRM provides a guideline or template for developing operational solutions to privacy issues. It also serves as an analytical tool for assessing the completeness of proposed solutions and as the basis for establishing categories and groupings of privacy management controls.

OASIS Open Building Information Exchange (oBIX) TC

The purpose of oBIX (open Building Information Exchange) is to enable the mechanical and electrical control systems in buildings to communicate with enterprise applications, and to provide a platform for developing new classes of applications that integrate control systems with other enterprise functions. Enterprise functions include processes such as Human Resources, Finance, Customer Relationship Management (CRM), and Manufacturing.

OASIS Advanced Message Queuing Protocol (AMQP) TC

The OASIS AMQP TC advances a vendor-neutral and platform-agnostic protocol that offers organizations an easier, more secure approach to passing real-time data streams and business transactions. The goal of AMQP is to ensure information is safely and efficiently transported between applications, among organizations, across distributed cloud computing environments, and within mobile infrastructures. AMQP avoids proprietary technologies, offering the potential to lower the cost of enterprise middleware software integrations through open interoperability. By enabling a commoditized, multi-vendor ecosystem, AMQP seeks to create opportunities for transforming the way business is done in the Cloud and over the Internet.

OASIS Advanced Message Queuing Protocol (AMQP) Bindings and Mappings (AMQP-BINDMAP) TC

The OASIS Advanced Message Queuing Protocol (AMQP) Bindings and Mappings (AMQP-BINDMAP) Technical Committee works closely with the AMQP TC to advance a wire-level messaging protocol that offers organizations an efficient, reliable approach to passing real-time data and business transactions. AMQP provides a platform-agnostic method for ensuring information is safely transported between applications, among organizations, within mobile infrastructures, and across the Cloud.

OASIS Cross-Enterprise Security and Privacy Authorization (XSPA) TC

The OASIS XSPA TC works to standardize the way healthcare providers, hospitals, pharmacies, and insurance companies exchange privacy policies, consent directives, and authorizations within and between healthcare organizations. The OASIS Cross-Enterprise Security and Privacy Authorization (XSPA) Technical Committee will specify healthcare profiles of existing OASIS standards to support reliable, auditable methods of confirming personal identity, official authorization status, and role attributes. This work aligns with security specifications being developed within the U.S. Healthcare Information Technology Standards Panel (HITSP).

OASIS Electronic Identity Credential Trust Elevation Methods (Trust Elevation) TC

The OASIS Trust Elevation TC works to define a set of standardized protocols that service providers may use to elevate the trust in an electronic identity credential presented to them for authentication. The Trust Elevation TC is intended to respond to suggestions from the public sector, including the U.S. National Strategy for Trusted Identities in Cyberspace (NSTIC). The Trust Elevation TC promotes interoperability among multiple identity providers--and among multiple identity federations and frameworks--by facilitating clear communication about common and comparable operations to present, evaluate and apply identity [data/assertions] to sets of declared authorization levels.

N/AOASIS Advanced Message Queuing Protocol (AMQP) TC

The OASIS AMQP TC advances a vendor-neutral and platform-agnostic protocol that offers organizations an easier, more secure approach to passing real-time data streams and business transactions. The goal of AMQP is to ensure information is safely and efficiently transported between applications, among organizations, across distributed cloud computing environments, and within mobile infrastructures. AMQP avoids proprietary technologies, offering the potential to lower the cost of enterprise middleware software integrations through open interoperability. By enabling a commoditized, multi-vendor ecosystem, AMQP seeks to create opportunities for transforming the way business is done in the Cloud and over the Internet.

KMIP Additional Message Encodings v1.0

The OASIS KMIP TC works to define a single, comprehensive protocol for communication between encryption systems and a broad range of new and legacy enterprise applications, including email, databases, and storage devices. By removing redundant, incompatible key management processes, KMIP will provide better data security while at the same time reducing expenditures on multiple products.