Archive — US — techcrunch
US cyber agency CISA had to build its incident playbook during the incident,agency reveals
The U.S. federal cybersecurity agency CISA had no prepared incident response plan during a May cybersecurity breach involving exposed sensitive keys. Staff had to create a response playbook in real time, highlighting the need for pre-established protocols. Despite the incident, no sensitive data was leaked, prompting CISA to improve its communication channels with security researchers.
Key points
- CISA lacked a pre-prepared incident response plan when alerted to the breach.
- The agency's staff built their response playbook during the early stages of the incident.
- Incident was triggered by exposed sensitive credentials uploaded by a contractor.
- A researcher notified CISA after trying to contact the contractor without success.
- CISA revoked exposed credentials and took the repository offline after being notified.
- No customer data was compromised, and CISA acknowledged communication issues.
- CISA has not had a permanent director since January 2025 and has faced workforce reductions.
Why it matters
- This incident reflects ongoing issues in cybersecurity governance and readiness.
- CISA's response highlights the critical need for federal agencies to implement IT disaster preparedness and clear communication pathways.
- The lack of a playbook during a cybersecurity incident parallels current concerns about government cybersecurity strategies amidst increasing cyber threats.
The incident underscores the necessity for federal agencies like CISA to develop robust cyber incident response plans to avoid improvisation during crises, ensuring effective protection of critical infrastructure.