US cybersecurity agency CISA had to build its incident playbook during the incident, agency reveals

CISA revealed that it had to build parts of its incident response playbook during an actual security incident. The case stemmed from exposed passwords uploaded to a public GitHub repository by an employee of a CISA contractor, first reported by Brian Krebs after a GitGuardian researcher found the data.

The episode highlights how even top cybersecurity agencies can face operational gaps in incident readiness. It also underscores growing supply-chain risk, where contractors’ handling of credentials can create exposure for government systems.