Recent U.S. government-documented incidents show why NIST CSF 2.0 treats incident response as a risk-management cycle, not just containment: preparation and protection shape what happens before an incident, while detection, response, recovery, and improvement guide what happens during and after it. The cases considered here—disclosures and advisories from September 2025 through July 2026—reveal distinct gaps in credential handling, operational-technology security, and vulnerability management. They are qualitative examples, not a ranking or a statistical sample.
How NIST CSF 2.0 frames incident response
NIST finalized Special Publication 800-61 Revision 3 on April 3, 2025. Titled Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile, it supersedes Revision 2 and places incident response within the broader cybersecurity risk-management approach of the NIST Cybersecurity Framework (CSF) 2.0.
As an Amazon Associate I earn from qualifying purchases.
The framework has six Functions. Govern, Identify, and Protect help establish responsibilities, understand risk, and put safeguards in place. Detect, Respond, and Recover address finding and managing incidents and restoring operations. Improvement draws lessons across all six Functions and feeds them back into risk management. In practice, that means an incident assessment should look beyond the initial access path and ask whether the organization could see the activity, act on it, restore affected services, and strengthen controls afterward.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesThis assessment uses six questions: Were ownership and service-provider responsibilities clear? What weakness or access path was documented? What detected the activity, and when? What containment and response actions followed? What impact and recovery outcomes were reported? What changed as a result? The answers support a qualitative comparison, not a numerical CSF score.
#1 Best Overall
Three incidents, three different control problems
| Assessment area | CISA repository disclosure, July 2026 | PLC activity advisory, July 2026 | Federal agency GeoServer incident, 2025 |
|---|---|---|---|
| Documented weakness or access path | Credentials and copied CISA build and deployment code in a contractor’s personal public GitHub repository. | Attempts to reach internet-connected programmable logic controllers (PLCs), download malicious project files, and manipulate human-machine-interface and SCADA displays. | Exploitation of GeoServer vulnerability CVE-2024-36401 at a federal civilian executive branch agency. |
| Detection information reported | An investigative reporter’s inquiry prompted CISA’s internal response; the agency said its analysis found the exposed credentials had not been used outside CISA environments. | The joint advisory describes ongoing activity, but the update does not give a common detection interval for the affected organizations. | Indexed official advisory text says endpoint-detection-and-response alerts identified potential malicious activity about three weeks after exploitation. |
| Reported impact | CISA said no customer or mission data was exposed. | The advisory reports operational disruption and financial loss for affected organizations in several critical-infrastructure sectors. | The available official advisory text does not establish impact. |
| Response or improvement emphasized | Credential resets and rotations, revoked access, repository and development-environment controls, and lessons about playbooks, reporting, logging, and key management. | Strictly control network access to PLCs, validate project files, review manufacturer guidance, and inform service providers about the threat. | CISA emphasizes prompt patching, practiced incident-response plans, and centralized out-of-band log aggregation. |
CISA’s exposed repository: containment worked alongside preparation gaps
In its July 9, 2026 account, CISA said the repository belonged to a contractor’s personal GitHub account, not CISA’s official account. It contained copied agency build and deployment code as well as administrator and build credentials. CISA said it took the repository and development environment offline, preserved a copy for analysis, reset credentials, revoked the individual’s access, rotated credentials across affected environments, tightened repository controls, and restricted users’ ability to upload to public repositories.
The agency’s account also identifies weaknesses in readiness. CISA said it lacked a GitHub/cloud incident playbook and spent time creating one early in the response. Key rotation took longer than anticipated because of system complexity and interconnections. Its stated improvement areas included monitoring for exposed secrets, developer-environment guardrails, logging and visibility, clearer incident-reporting channels, and cryptographic key-management readiness. CISA attributed the disclosure to Acting Chief Information Officer Preston Werntz and Acting Chief Information Security Officer Brad Libbey; it is the agency’s retrospective account, not an independent forensic audit.
PLC targeting: protect the operational boundary and verify changes
A July 22, 2026 update by CISA, the FBI, EPA, and government partners described Iranian-affiliated activity affecting internet-connected operational technology across water and wastewater, energy, and government services and facilities. The advisory says attempts to download malicious PLC project files and manipulate HMI and SCADA displays caused operational disruption and financial loss for affected organizations.
The update recommends reviewing manufacturer guidance, strictly controlling network access to PLCs, validating project files for unauthorized changes, and informing service providers about active threats. It added guidance for detecting malicious changes in reusable Rockwell Automation PLC code modules and expanded the stated scope to observed targeting of Schneider Electric and Siemens PLCs, with possible targeting of other manufacturers. These are the advisory’s July 2026 descriptions and recommendations, not a claim that every PLC or organization was affected.
GeoServer exploitation: patching and detection timing both matter
A September 2025 CISA advisory describes an incident-response engagement at a U.S. federal civilian executive branch agency. The indexed official advisory text says threat actors exploited CVE-2024-36401 in GeoServer about three weeks before endpoint-detection-and-response alerts identified potential malicious activity. CISA’s introduction emphasizes prompt patching, practicing incident-response plans, and aggregating logs in a centralized out-of-band location.
The available advisory text does not establish attribution, total dwell time, data theft, or the incident’s impact. The reported interval is specifically the time between exploitation and the EDR alerts described in that text; it should not be treated as a complete account of how long the actors had access or when defenders first had any indication of activity.
Rank #4
What the cases indicate about CSF alignment
The repository disclosure most clearly illustrates the connection between Protect, Respond, and improvement. Credential rotation and access revocation were response measures, while public-repository controls and developer safeguards address the conditions that allowed exposure. CISA’s reported lack of a ready playbook and delays in rotating interconnected keys also show how governance, preparation, and system knowledge affect response speed.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The PLC advisory foregrounds Protect and Detect in an operational-technology setting: control who can reach a controller and check whether its project files have been altered. Its reported disruptions make recovery and operational continuity relevant as well, but the advisory does not provide enough comparable detail to grade individual organizations’ recovery capabilities.
Best Value
The GeoServer account links Identify and Protect—knowing where vulnerable software is deployed and patching it—with Detect, Respond, and logging readiness. The reported delay before EDR alerts makes detection timing a material part of the case, but the limited available text does not support conclusions about the agency’s full response or recovery.
Across the examples, CSF alignment is therefore better understood as a chain of capabilities than as a label attached to an incident. A control gap may arise before an event, a detection or response weakness may extend it, and lessons from the event should alter risk management. The cases involve different technologies, impacts, and levels of disclosed detail, so they cannot establish which incident was most severe or how prevalent any weakness is.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How organizations can apply this assessment
- Set ownership and reporting routes. Identify who can declare an incident, who owns affected systems and credentials, how employees and service providers report suspected activity, and who authorizes containment.
- Map exposed assets and access paths. Track public repositories, secrets, cloud and developer environments, internet-facing software, and operational-technology devices. Assign owners and establish how changes and vulnerabilities are reviewed.
- Make detection evidence usable. Define which alerts, logs, and integrity checks can expose credential misuse, vulnerable-system exploitation, or unauthorized controller changes. Centralize relevant logs in a location that remains useful if the affected environment is compromised.
- Practice containment and recovery. Rehearse actions such as disabling access, revoking and rotating credentials, isolating an affected system, validating trusted configurations, and restoring service. Include dependencies that could make rotation or recovery slower than expected.
- Review the outcome and update controls. Record what was known, when it became known, what actions worked or stalled, the verified impact, and unresolved uncertainty. Convert those findings into revised safeguards, playbooks, reporting channels, logging, and exercises.
For each step, distinguish confirmed facts from assumptions. An agency’s reported absence of data exposure, an advisory’s report of operational disruption, and an alert interval are different kinds of evidence; none alone is a universal measure of security or incident severity.
Recommended Free Tools
Scope and limits
“Recent” here means the selected U.S. government disclosures and advisories dated September 2025 through July 2026, assessed as of October 9, 2026. The examples are illustrative rather than representative of all incidents. They do not share a common severity scale, incident type, or independently verified forensic record. CISA’s repository account is the agency’s own retrospective; the PLC details are from a joint government advisory update; and the GeoServer discussion is limited to the available indexed official advisory text.
No aggregate statistic or cross-incident loss total is established by these cases. Their value is in showing how distinct events can be examined with consistent questions about governance, protection, detection, response, recovery, and improvement.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
