The US cyber security agency CISA had to create a playbook for dealing with the incident during the incident, the agency announced

The U.S. federal cybersecurity agency CISA said it did not have a response plan in place for how to handle a cybersecurity incident in May after an investigative reporter alerted the agency that a contractor had disclosed sensitive keys and credentials to access U.S. government systems.

CISA, the Homeland Security division tasked with defending federal networks and helping protect critical infrastructure, announced Friday in the postmortem report His staff said they should have “taken time to create (a playbook) in the early stages of the incident.” The agency said it’s important to develop playbooks for “all anticipated needs” to ensure organizations are ready to respond in the event of a security incident rather than improvising in real time.

The agency did not say how long the missing playbook delayed CISA’s response, and a spokesperson did not immediately respond to TechCrunch’s request for comment.

Freelance cybersecurity journalist Brian Krebs reported in May with a security researcher Cyber ​​firm GitGuardian alerted him to exposed passwords stored in a publicly available GitHub repository uploaded by a CISA contractor employee.

Krebs said the researcher tried to alert the contractor but did not hear back. Only after Krebs contacted CISA did the agency take the repository offline and revoke and replace all exposed credentials to prevent any potential misuse in the future.

CISA said no client or mission information was exposed in the incident and thanked the researcher and reporter for their help. The agency said its channels for security researchers to notify CISA of potential incidents were “not well defined” and that it was making changes to make it easier and faster for researchers to contact the agency.

CISA has been without a permanent director since the start of President Donald Trump’s second term in January 2025. The agency has also been affected by layoffs, furloughs and layoffs of approximately. constitutes one third of the workforce Since Trump took office.