  As cyber systems become increasingly complex and cybersecurity threats become
more prominent, defenders must prepare, coordinate, automate, document, and
share their response methodologies to the extent possible. The CACAO standard
was developed to satisfy the above requirements, providing a common
machine-readable framework and schema for documenting cybersecurity operations
processes, including defensive tradecraft and tactics, techniques, and
procedures. Although this approach is compelling, a remaining limitation is
that CACAO provides no native modeling notation for graphically representing
playbooks, which is crucial for simplifying their creation, modification, and
understanding. In contrast, the industry is familiar with BPMN, a
standards-based modeling notation for business processes that has also found
its place in representing cybersecurity processes. This research examines BPMN
and CACAO and explores the feasibility of using the BPMN modeling notation to
represent CACAO security playbooks graphically. The results indicate that
mapping CACAO and BPMN is attainable at an abstract level; however, conversion
from one encoding to another introduces a degree of complexity due to the
multiple ways CACAO constructs can be represented in BPMN and the extensions
required in BPMN to support CACAO fully.
