US cyber agency CISA had to build its incident playbook during the incident, agency reveals

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has revealed that it was unprepared to handle a significant cybersecurity incident that occurred in May. This revelation came after an investigative journalist alerted the agency about a contractor who had inadvertently exposed sensitive credentials, crucial for accessing U.S. government systems, to the public. In a recent post-mortem report, CISA admitted that its team had to construct a response playbook during the initial phases of the incident rather than having a pre-established plan ready. The agency emphasized the necessity of having comprehensive playbooks tailored for various anticipated scenarios to ensure a swift and organized response in the event of a cyber threat, rather than having to create one on the fly. While CISA did not disclose the duration of the delay caused by the absence of a response plan, they acknowledged the importance of preparedness. The incident was brought to light when Brian Krebs, an independent cybersecurity journalist, reported that a researcher from GitGuardian had discovered numerous exposed passwords in a publicly accessible GitHub repository, uploaded by a CISA contractor's employee. The researcher attempted to notify the contractor but received no response. It was only after Krebs reached out to CISA that the agency acted by taking down the repository and revoking the compromised credentials to mitigate any risk of misuse. Fortunately, CISA confirmed that no sensitive customer or mission data was compromised during this incident. In their statement, CISA expressed gratitude to both the researcher and the journalist for their assistance. The agency also acknowledged that its processes for allowing security researchers to report potential threats were inadequately defined, prompting them to implement changes to streamline communication with researchers. Furthermore, CISA has been operating without a permanent director since January 2025, following the start of President Donald Trump’s second term, and has faced significant workforce reductions, including cuts, furloughs, and layoffs affecting approximately one-third of its staff since the administration began.