I will observe, however, that your site was not broken into at the time.
CERT is principally an aid to sites that have already been broken into.
Even that isn't completely fair, because they do have some documents and classes to help novices get a better handle on general security. We should not continue the discussion here. I'm going to talk about how to do a better job. It is not always the case that vulnerabilities and bugs are known to all the bad guys prior to announcement, and response team members have no way of knowing for sure for a particular case. Really expert users will not be happy with any level of detail, no matter how much is given.