OMB M-26-14 Deadlines: Logging Plans Due November 18, 2026, Then Three Maturity Marks

M-26-14 replaces M-21-31's EL0 to EL3 tiers with a new maturity model and tells agencies to prioritize two objectives: continuous event monitoring (CEM) and threat hunting, investigation, response and forensics (THIRF). Agencies must submit a logging plan, meet a minimum logging baseline, climb a new maturity model and give logs to CISA and the FBI on request after a known or suspected compromise.

CEM covers the logs and infrastructure that let a Security Operations Center (SOC) watch activity in real time and respond. THIRF covers what an agency needs after the fact, and the memo says agencies "must maintain sufficient hot and cold storage" and be able to pull logs from multiple sources together to map attack patterns.

Scope is wide. The objectives apply to "all information systems owned or operated by the agency or by third parties on the agency's behalf," including Internet of Things (IoT) devices and operational technology (OT) that are part of an information system. National security systems and the Defense Department and Intelligence Community systems described in 44 U.S.C. 3553(e) are excluded.

The memo dates almost everything from the release of CISA's Logging Reference Architecture (LRA), not from the memo itself. CISA was to publish the LRA within 90 days of May 22, 2026. It did so in August (ExecutiveGov's August 24 article says CISA announced it the previous Thursday, August 20), and both Federal News Network and ExecutiveGov report that CISA set November 18, 2026 as the date logging plans are due.

The last three dates are our arithmetic, counting from the same start date that puts the plan at November 18. CISA and OMB haven't published them in the sources we found, so treat them as planning targets and confirm with your agency's CISO office.

A second, shorter clock runs after each LRA update. When CISA notifies agencies of an updated LRA, they have 30 days to update the plan, 60 days to reach Intermediate and 120 days to reach Advanced. The memo says the LRA will be re-evaluated at least once a year, so an update before July 2027 could set an earlier Advanced date than the 320-day mark.

The required retention is shorter. M-21-31's technical table set 12 months in active storage plus 18 months in cold storage for most log types, and 72 hours for full packet capture. M-26-14's Appendix B sets the minimum at 6 months "actively searchable" and one year "retrievable," and both windows run from the log's creation, so they overlap rather than add up.

The definitions matter for storage design. "Searchable" means detections and analytics can run on the data with no preparation. "Retrievable" means the data can be used after intermediary steps, such as moving it from an archive or "thawing" it from cold storage. The memo adds that meeting these minimums does not relieve an agency of records schedules, which may require keeping some logs longer.

Here's where the appendices diverge. Appendix C's Data Retention row asks for 6 months retrievable at Level 1 and 12 months retrievable at Level 2, with no searchable period at either. Level 3 (Advanced) adds 3 months searchable, and only Level 4 (Optimal) matches Appendix B's 6 months searchable and 12 months retrievable. The deadlines ask for Levels 1 to 3. The memo doesn't reconcile the two, so ask OMB's Office of the Federal Chief Information Officer ([email protected]) or CISA which figure your plan is measured against before sizing storage.

Appendix B lists 11 activities the logs must support. They include determining which identity performed an operation, source and destination addresses with protocols and ports, access to or changes in data, changes to privilege levels, and changes to IT, OT and IoT infrastructure. They also cover alerts from security tools, known indicators of compromise, anomalous user or system activity, the amount and type of data affected in an incident, and the attack vector, including initial access and lateral movement. The last item is automated alerts for all of the above.

Two plumbing requirements sit beside the list. Logs need an accurate timestamp, with network time synchronized to a traceable source the agency designates; the memo encourages sources traceable to the U.S. Naval Observatory or NIST. Storage can be decentralized, but logs must be readily available to the agency's top-level SOC. The memo also tells agencies to use Continuous Diagnostics and Mitigation (CDM), hardware asset management (HWAM) and software asset management (SWAM) data to check that log coverage reaches every asset.

Appendix C scores each information system, not the agency as a whole, on five elements: Inventory Visibility, Collection Coverage, Collection Operations, Data Retention and Log Management. Each runs from Level 0 (Ineffective) to Level 4 (Optimal). A footnote says overall maturity "is calculated based on the lowest watermark," so the weakest element sets the score.

That makes the asset inventory the gate. Inventory Visibility requires that at least 70 percent of a system's IT, OT and IoT assets be in a centralized HWAM/SWAM inventory at Level 1, rising to 80 percent at Level 2 and 90 percent at Level 3, with daily updates from Level 2 up. Collection Coverage is measured against that inventory, so assets missing from it are hard to account for in coverage.

The Level 3 bar for the other elements, the one due around July 2027: logs searchable and retrievable for at least 90 percent of inventoried assets, actionable alerts covering at least 70 percent of the baseline logging requirements with detections routinely tuned, and logs encrypted in transit and at rest and regularly hashed for veracity.

Watch the labels. The deadline table calls Level 1 "Basic," while Appendix C calls it "Initial." Agencies report the percentage of systems at each level. The memo also says the LRA will align with CISA's zero trust maturity model, which we cover in our post on scoring an agency against the CISA zero trust maturity model.

The memo points agencies to cisa.gov/Logging for the LRA and its materials, and says the plan must describe the operational steps to deploy and maintain CEM and THIRF, the actions to reach the minimum baseline, and any additional collection the agency will do given its "threat environment, risk profile, and mission." A plan that will hold up through the later deadlines usually answers five questions system by system:

1. Which systems are High Value Assets or high-impact under FIPS 199? Appendix A says the LRA's prioritization guidance emphasizes them.
2. What share of each system's assets is in the HWAM/SWAM inventory today, and what closes the gap to 70, 80 and 90 percent?
3. Which of the 11 Appendix B activities can current logs support, and which need new sources, including OT and IoT devices with no native logging?
4. Where does each log land, how fast does the top-level SOC see it, and how long is it searchable and retrievable?
5. Which systems are run by contractors or cloud providers, and do their contracts let the agency collect, access and hand logs to CISA or the FBI on request?

The fifth question is where programs tend to stall. If a contract doesn't already address log format, delivery or retention, changing it is a matter for the contracting officer, and that takes time the 120-day mark doesn't leave.

Before the plan goes in, put the inventory baseline in the plan, even if it's incomplete, because it drives every later score. Get the retention figure confirmed in writing. Then schedule the December Level 1 check now, since the lowest element decides it.

Contractors that operate systems for an agency should expect questions about log sources, time synchronization, encryption at rest and how quickly they can deliver logs. Have those answers ready, and route any change in scope through the contracting officer. Our cybersecurity team supports FISMA and NIST compliance and Zero Trust programs aligned to NIST SP 800-207.