- Published on
US cybersecurity agency CISA had to build its incident playbook during the incident, agency reveals
- Authors
- Name
- DeepHorus
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) revealed that it had to build an incident response playbook during a cybersecurity incident in May, after an investigative reporter notified the agency that a contractor had exposed sensitive credentials online. The revelation came in a postmortem report released Friday, highlighting significant preparedness gaps within the federal agency tasked with defending U.S. government networks and critical infrastructure. CISA acknowledged that its staff 'had to spend time building [a playbook] during the early stages of the incident,' underscoring the lack of pre-existing procedures for handling such breaches.
The incident began when independent cybersecurity journalist Brian Krebs reported in May that a security researcher from cyber firm GitGuardian discovered reams of exposed passwords stored in a publicly accessible GitHub repository. The repository belonged to an employee of a CISA contractor, and the researcher had attempted to alert the contractor directly but received no response. Only after Krebs contacted CISA did the agency take the repository offline and revoke all exposed credentials to prevent potential abuse.
CISA stated that no customer or mission data was compromised in the incident, and it thanked both the researcher and Krebs for their assistance. However, the agency admitted that its channels for receiving vulnerability reports from security researchers 'were not well defined.' In response, CISA has implemented changes to streamline the reporting process, making it easier and faster for researchers to contact the agency in the future.
The lack of a pre-existing playbook delayed CISA's response, though the agency did not specify the exact duration. A CISA spokesperson did not immediately respond to requests for comment. This incident raises concerns about the agency's operational readiness, especially as it faces leadership and staffing challenges.
CISA has been without a permanent director since the start of President Donald Trump's second term in January 2025. Since then, the agency has experienced workforce cuts, including furloughs and layoffs affecting approximately one-third of its staff. These reductions may have exacerbated the preparedness issues highlighted by the May incident.
Cybersecurity experts warn that such gaps could leave federal systems vulnerable to more serious attacks. The postmortem underscores the importance of proactive planning, with CISA itself recommending that organizations prepare playbooks for 'all anticipated needs' to avoid improvising during a crisis. As CISA works to fortify its defenses, the incident serves as a cautionary tale for other government agencies and contractors handling sensitive data.
