US cyber agency CISA had to build its incident playbook during the incident, agency reveals