The former analyst says supervisors were told not to put things in writing, so many of the directives came in face-to-face meetings.

The bureau’s cyber chief blamed a contractor’s failure to apply an available fix for an intrusion that may have exposed sensitive employee information.