CISA lacked cybersecurity incident playbook during critical event
US cybersecurity agency had to build response procedures mid-incident, report reveals
1Caught unprepared during incident
The US Cybersecurity and Infrastructure Security Agency (CISA) admitted being unprepared for a cybersecurity incident. When sensitive keys and credentials uploaded by a contractor to a public GitHub repository were exposed in May 2026, the agency lacked a prepared response plan.
2Journalist alert triggers action
Independent cybersecurity journalist Brian Krebs discovered the issue after being alerted by a researcher from GitGuardian. Unable to reach the contractor, the researcher informed CISA through Krebs. However, the agency's incident response processes weren't well-defined.
3Building response procedures on the fly
CISA staff had to create an incident response playbook from scratch during the early stages of the event. The agency's postmortem report emphasized the importance of preparing for all anticipated needs in advance.
4Credentials revoked and replaced
Following Krebs' alert, CISA took down the GitHub repository and revoked all exposed credentials, replacing them with new ones. The agency confirmed no customer or mission data was compromised and thanked the researcher and journalist.
5Improved communication channels
CISA announced it has established better-defined channels for security researchers to report potential incidents. The agency improved processes to enable faster and easier communication with researchers.
6Leadership vacuum and staff reductions
CISA has operated without a permanent director since January 2025. Budget cuts and layoffs under the Trump administration affected about one-third of its workforce, potentially impacting the agency's preparedness capacity.