The U.S. Cybersecurity and Infrastructure Security Agency (CISA) admitted it lacked a pre-established response plan for addressing a cybersecurity event earlier this year. This came to light after a journalist informed the agency that a contractor had inadvertently made sensitive access keys publicly available, which could compromise U.S. government systems.
In a report released on Friday, CISA disclosed that, during the initial response to this incident, its team had to create an operational guide from scratch. The agency emphasized the necessity of formulating playbooks for “all anticipated needs” to ensure organizations can effectively respond to security breaches, rather than trying to create solutions on the fly.
CISA did not disclose how much the absence of a playbook hindered its response time. A spokesperson did not immediately provide comments regarding the matter.
Cybersecurity journalist Brian Krebs noted that a security researcher from GitGuardian alerted him in May to a significant amount of exposed passwords that were available in a public GitHub repository. This repository was uploaded by an employee of a CISA contractor.
According to Krebs, the researcher attempted to notify the contractor, but received no response. It wasn’t until Krebs reached out to CISA that the agency acted to remove the repository and invalidate the compromised credentials to alleviate any risk of misuse.
CISA has confirmed that no customer or operational data was leaked during this incident and expressed gratitude to both the researcher and journalist for their assistance. The agency acknowledged that its procedures for security researchers to report possible incidents “were not well defined” and stated it is taking steps to improve communication channels to facilitate quicker reporting.
Since the beginning of President Donald Trump’s second term in January 2025, CISA has not had a permanent director. The agency has faced budget cuts and significant workforce reductions, affecting around one-third of its personnel since Trump took office.
