OMB M-26-14: logging and network visibility, explained.
The May 2026 memo that replaced M-21-31. What it requires, how its maturity model works, and how to show progress with evidence instead of attestations.
What M-26-14 is
OMB Memorandum M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, sets how federal civilian agencies collect, keep and use security logs. It rescinds M-21-31 and moves from a prescriptive list of log types to outcomes agencies must achieve.
The memo is organized around two priorities: Continuous Event Monitoring (CEM) and Threat Hunting, Investigation, Response and Forensics (THIRF). Its scope explicitly includes IoT and operational technology, including devices that cannot log on their own. Logs may be stored in a federated way as long as the agency's top-level SOC can reach them, and must be available to CISA and the FBI on authorized request. Overall maturity is set by the lowest-scoring component.
What changes from M-21-31
| Topic | M-21-31 (rescinded) | M-26-14 |
|---|---|---|
| Approach | Catalog of log types and retention periods | Outcome-based activities |
| Maturity | Event logging tiers EL0 to EL3 | Five-level model across inventory visibility, collection coverage, collection operations, data retention and log management |
| Retention | 30 months (12 active, 18 cold) | At least 6 months searchable and 1 year retrievable |
Key deadlines
Most clocks start when CISA publishes its Logging Reference Architecture (LRA), which the memo gives CISA 90 days to produce. Agencies then submit an Agency Logging Plan to OMB and CISA, and climb the maturity levels on a schedule measured from the LRA. Published analyses report targets at roughly 120, 180 and 320 days after the LRA for the first three levels, with the LRA reviewed each year.
Why it is a zero trust problem
The LRA is to align with the CISA Zero Trust Maturity Model, in particular Visibility and Analytics. Because the weakest component sets the overall level, the hard part is proof: a current inventory of what should be logging, evidence that it is, and an alert when a source goes quiet.
How ZTASphere helps you evidence M-26-14
Asset intelligence integrations (Armis, Axonius, Forescout) reconcile what exists, including IoT and OT, against what reports in.
Elastic SIEM evidence and the Visibility and Analytics functions for every pillar show which sources are collected.
Feed health marks every source live, late, down or blocked, escalates silence and opens a ticket.
Evidence-backed pillar and CDM-aligned reports, released through approval, with a hash-chained audit trail.
ZTASphere supplies evidence for your logging plan and maturity reporting. It is not a SIEM and does not by itself make an agency compliant.
Frequently asked questions
What is OMB M-26-14?
OMB Memorandum M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, was issued on May 22, 2026. It replaces M-21-31 as the federal logging policy and is organized around continuous event monitoring and threat hunting, investigation, response and forensics.
Does M-26-14 replace M-21-31?
Yes. M-26-14 rescinds M-21-31. The old catalog of log types and the EL0 to EL3 tiers give way to outcome-based activities and a new five-level maturity model.
How long must logs be kept under M-26-14?
Public analyses of the memo report at least six months actively searchable and at least one year retrievable, down from the 30 months M-21-31 required. Confirm the details against the memo for your environment.
How does M-26-14 connect to zero trust?
CISA's Logging Reference Architecture under the memo is to align with the CISA Zero Trust Maturity Model, in particular the Visibility and Analytics capability. Logging coverage is therefore part of how zero trust maturity is measured.
How is overall logging maturity calculated?
As reported from the memo, overall maturity is set by the lowest-scoring component, so one weak area such as inventory visibility or retention caps the whole agency's level.
Sources: OMB M-26-14 (22 May 2026) as summarized by Elastic, Aquia and Splunk. Read the memorandum for the authoritative text.
Get M-26-14-ready with live evidence.
Bring your logging plan. We'll show what ZTASphere sees across your sources today.