US cybersecurity agency CISA had to build its incident playbook during the incident, agency reveals

The Cybersecurity and Infrastructure Security Agency is supposed to be the federal government's shield. In May it had no shield for itself. When a contractor employee dumped passwords and access keys for U.S. government systems into a public GitHub repository, CISA did not reach for a playbook. It had to write one. Staff spent the early hours of the incident building the very response framework that should have existed years ago. The agency admitted as much in a Friday postmortem, framing the lesson as a reminder to prepare playbooks for "all anticipated needs." The phrasing is bureaucratic. The reality is negligence.

Independent journalist Brian Krebs broke the story after a GitGuardian researcher found the exposed repository. The researcher tried the contractor first. Silence. Only when Krebs contacted CISA directly did the agency pull the repository offline and rotate every compromised credential. That sequence — researcher to contractor to journalist to agency — exposes a reporting chain that runs on luck, not design. CISA now says it has fixed its intake channels for security researchers. The fact that they were "not well defined" at all is the scandal.

No customer or mission data was exposed, the agency insists. That may be true. It is also beside the point. The credentials themselves were the crown jewels. Keys to federal systems in a public repo is a catastrophe averted only because a private researcher and a reporter chose to act. Had a hostile actor found them first, the postmortem would read differently. Improvising a response while the keys sit live is not response. It is gambling.

CISA has operated without a permanent director since January 2025. The Trump administration's second term opened with a leadership vacuum at the very agency tasked with critical infrastructure protection. Since then, cuts, furloughs, and layoffs have erased roughly a third of the workforce. Institutional memory walked out the door. Operational capacity followed. You cannot maintain readiness when you are disassembling the institution charged with it. The missing playbook is not an oversight. It is a symptom.

The agency's postmortem reads like a lesson learned. It should read like an indictment. A playbook is not innovation. It is the minimum viable artifact of any security operation. Fire departments do not write evacuation plans while the building burns. Hospitals do not draft triage protocols in the ambulance bay. CISA's mission is to ensure federal networks and critical infrastructure can withstand attack. Its own house had no plan for the most basic scenario: a credential leak. The agency had to invent its doctrine under fire.

Contractor risk is not new. Supply chain compromise is the defining threat vector of the decade. CISA knows this. Its parent department issues binding directives on software bill of materials, on zero trust, on incident reporting timelines. Yet the agency itself lacked a runbook for a contractor credential spill. The disconnect between policy output and operational reality is the story. Directives mean nothing when the executing body is hollowed out.

The researcher who found the repo did the right thing. The journalist who escalated did the right thing. CISA eventually did the right thing. But "eventually" is a luxury the agency cannot afford. The next leak will not wait for a playbook to be written. It will not pause while staff recall steps they should have drilled. The 30 percent workforce reduction is not a budget line. It is a capability gap measured in minutes of delay during an active incident.

Congress funds CISA to be ready. The executive branch staffs it to be ready. Neither condition is met. The agency's own admission — that it built the playbook during the incident — should trigger immediate oversight. Not a hearing next quarter. Now. The director vacancy must be filled with a leader who treats readiness as non-negotiable. The workforce cuts must be reversed where they touch incident response. The contractor oversight regime must be audited for the same gap.

CISA thanked the researcher and the reporter. Gratitude is not accountability. The agency survives this episode intact only because outsiders performed the detection and escalation functions that CISA's own structure failed to provide. That is not a successful defense. It is a successful rescue. The difference matters. The next time, the rescuer may not show up. The playbook still unwritten will stay unwritten. The credentials will turn into access. The systems will fall. The postmortem will arrive too late.