US Cyber Agency CISA Built Incident Playbook During Ongoing Incident

The U.S. federal cybersecurity agency CISA did not have a prepared response plan for handling a cybersecurity incident in May, after an investigative reporter notified the agency that a contractor had publicly exposed sensitive keys and credentials for accessing U.S. government systems.

CISA, the Homeland Security unit tasked with defending federal networks and helping to safeguard critical infrastructure, revealed Friday in a post-mortem report that its staff "had to spend time building [a playbook] during the early stages of the incident." The agency said it needs to prepare playbooks for "all anticipated needs" to ensure that organizations are ready to respond in the event of a security incident rather than scrambling to improvise one in real time. The agency did not say how long the missing playbook delayed CISA's response, and a spokesperson did not immediately respond to TechCrunch's request for comment. Independent cybersecurity journalist Brian Krebs reported in May that a security researcher with cyber firm GitGuardian alerted him to reams of exposed passwords stored in a publicly accessible GitHub repository, which an employee of a CISA contractor had uploaded.

According to Krebs, the researcher tried to alert the contractor but didn't hear back. Only after Krebs contacted CISA did the agency take the repository offline and revoke and replace all of the exposed credentials to prevent any potential future abuse. CISA said that no customer or mission data was exposed in the incident and thanked the researcher and reporter for their help.

The agency said that its channels for allowing security researchers to notify CISA of potential incidents "were not well defined," and that it has made changes to make it easier and faster for researchers to contact the agency. CISA has been without a permanent director since the start of President Donald Trump's second term in January 2025. The agency has also been affected by cuts, furloughs, and layoffs affecting about a third of its workforce since Trump took office.

The incident highlights the challenges CISA faces in responding to cybersecurity threats. Without a permanent director and with a reduced workforce, the agency must adapt to emerging threats while prioritizing incident response. The lack of a prepared playbook in this instance forced CISA to improvise, potentially delaying its response.

As CISA continues to evolve its incident response processes, it must balance the need for effective communication with security researchers and the public with the imperative to protect sensitive information. The agency's efforts to improve its channels for reporting potential incidents are a step in the right direction, but more work remains to ensure that CISA is equipped to handle the complex cybersecurity challenges it faces.