# CISA lacked cybersecurity incident playbook during critical event US cybersecurity agency had to build response procedures mid-incident, report reveals - **Source:** [cybersecurity | TechCrunch](https://brifing.si/source/73fbb25c-5e90-44c9-9a24-7906dc3436cd) - **Published:** 2026-07-11 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/ad456cb9-8ba3-4771-b7d3-96ab629939c3 ## Caught unprepared during incident The US Cybersecurity and Infrastructure Security Agency (CISA) admitted being unprepared for a cybersecurity incident. When sensitive keys and credentials uploaded by a contractor to a public GitHub repository were exposed in May 2026, the agency lacked a prepared response plan. ## Journalist alert triggers action Independent cybersecurity journalist Brian Krebs discovered the issue after being alerted by a researcher from GitGuardian. Unable to reach the contractor, the researcher informed CISA through Krebs. However, the agency's incident response processes weren't well-defined. ## Building response procedures on the fly CISA staff had to create an incident response playbook from scratch during the early stages of the event. The agency's postmortem report emphasized the importance of preparing for all anticipated needs in advance. ## Credentials revoked and replaced Following Krebs' alert, CISA took down the GitHub repository and revoked all exposed credentials, replacing them with new ones. The agency confirmed no customer or mission data was compromised and thanked the researcher and journalist. ## Improved communication channels CISA announced it has established better-defined channels for security researchers to report potential incidents. The agency improved processes to enable faster and easier communication with researchers. ## Leadership vacuum and staff reductions CISA has operated without a permanent director since January 2025. Budget cuts and layoffs under the Trump administration affected about one-third of its workforce, potentially impacting the agency's preparedness capacity. ## Sources covering this story - https://techcrunch.com/2026/07/10/us-cyber-agency-cisa-had-to-build-its-incident-playbook-during-the-incident-agency-reveals/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._