OMB M-26-14: risk-based federal logging rules replace M-21-31, with a maturity model

In two minutes

• The memo rescinds OMB M-21-31 effective immediately, saying some of its requirements, such as retaining vast quantities of logs without clear use, were neither feasible nor cost-effective for most agencies (p. 1).
• Agencies must prioritize two objectives: Continuous Event Monitoring (real-time detection, usually in a SOC) and THIRF, which covers threat hunting, response and forensics after a known or suspected compromise (p. 2).
• CISA, with OMB and the CISO Council, must publish a logging reference architecture within 90 days of the memo. Agencies must then submit an Agency Logging Plan within 90 days of its publication (pp. 2-4).
• Appendix B sets the minimum baseline: logs searchable for 6 months and retrievable for a year, logs available to the top-level SOC, accurate synchronized timestamps, and eleven categories of required log content (pp. 6-7).
• Appendix C is a five-level maturity model covering inventory visibility, collection coverage, collection operations, data retention and log management. Overall maturity is set by the lowest element (p. 8).
• Agencies must reach Level 1 within 120 days of the architecture's release, Level 2 within 180 days and Level 3 within 320 days. After later architecture updates the windows shrink (p. 4).
• After a known or suspected compromise, agencies must give logs to CISA and the FBI on request, in agreed formats and, as far as practicable, within requested timeframes (p. 3).
• The memo excludes national security systems and certain Department of Defense and Intelligence Community systems (p. 1, footnote 2).

Key numbers

• 90 days: Time for CISA to publish the logging reference architecture, counted from the memo date (p. 2).
• 90 days: Time for agencies to submit the Agency Logging Plan, counted from publication of the architecture (p. 3).
• 120 / 180 / 320 days: Deadlines after the architecture's release to reach Level 1, Level 2 and Level 3 across all maturity elements (p. 4).
• 30 / 60 / 120 days: After a CISA update notice: update the plan, reach Intermediate, reach Advanced (p. 4).
• 6 months searchable, 1 year retrievable: Minimum retention baseline for logs (p. 6).
• 70% / 80% / 90% / 95%: Share of IT/OT/IoT assets in a centralized HWAM/SWAM inventory required at Levels 1 to 4 (p. 8).
• 50% / 80% / 90% / 95%: Share of inventoried assets with required logs searchable and retrievable at Levels 1 to 4 (p. 8).
• 5 business days: Time for CISA to notify agencies of published updates to the architecture (p. 3).

What to do with it

• Map your logging program to the two objectives, monitoring and THIRF, and decide which systems and logs serve each (p. 2).
• Check retention against the Appendix B baseline of 6 months searchable and 12 months retrievable, and keep other records-schedule duties in view (p. 6).
• Use CDM, HWAM and SWAM data to test whether log coverage includes all IT, IoT and OT, and measure inventory against the percentage thresholds in Appendix C (pp. 6, 8).
• Confirm logs reach the top-level SOC, through central storage, forwarding, federated access or a hybrid, and that time is synchronized to a traceable source (p. 6).
• Compare current logging against the eleven required log purposes in Appendix B and the alerting thresholds in the maturity model (pp. 7-8).
• Plan the Agency Logging Plan and maturity milestones around the dates counted from CISA's release of the architecture, and set up a process for log requests from CISA and the FBI (pp. 3-4).

Read the full document if

• you run security at a federal agency or at a contractor operating systems on an agency's behalf.
• you need the exact retention, timestamp and log-content baselines in Appendices B and C.
• you want the deadline structure and the maturity-level thresholds before the CISA architecture appears.

What it relies on

The text is an OMB memorandum to heads of executive departments and agencies, signed by the OMB Director and dated May 22, 2026. The desk recorded CISA as publisher, but the text itself is from OMB; CISA is assigned the job of writing the reference architecture. It rests on policy authority, not on data. It cites the President's Management Agenda, M-21-31, M-19-03, FIPS 199 and the CISA Zero Trust Maturity Model. It gives no sample, study or method. The reference architecture itself is not in this text.

Our read

Useful as the primary source for what federal agencies must do on logging and by when. It is a policy memo, so it sets targets and leaves technical detail to the CISA architecture. Appendix C holds the measurable thresholds. Retention figures differ by place: Appendix B asks for 6 months searchable, while the Level 3 row says 3 months.