M-26-14 Logging Plans Are Due Nov 18: What Comes Next

On August 20, CISA published its Logging Reference Architecture (LRA), the companion guide to OMB Memorandum M-26-14. That date started the clock in the memo: federal civilian agencies must submit their first Agency Logging Plan to OMB and CISA within 90 days of the LRA's release, which puts the deadline on November 18, 2026. That is nine days away.

The plan matters, but it is not the hard part. Within weeks of filing it, agencies have to start showing measurable maturity across every system in scope, and the requirements reach contractor-operated and cloud systems too. Here is what M-26-14 requires, which dates come next, and what agencies and their cloud and IT providers should be doing now.

What M-26-14 changed

OMB issued M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, on May 22, 2026. It rescinded M-21-31, the 2021 memo that set logging baselines after the SolarWinds response. OMB's own memo says M-21-31 "improved foundational capabilities across agencies," but that some of its requirements, such as retaining vast quantities of logging data without clear utility, proved neither operationally feasible nor cost-effective for most agencies. In its place, the memo directs a risk-based, prioritized approach organized around two objectives:

• Continuous Event Monitoring (CEM): logs and infrastructure that let a Security Operations Center (SOC) watch activity in real time, flag anomalies and respond promptly.
• Threat Hunting, Investigation, Response, and Forensics (THIRF): logs that support investigation after a known or suspected compromise, which the memo says requires sufficient hot and cold storage and the ability to pull data from many sources together to map attack patterns.

Scope is broad. The memo applies these objectives to all information systems owned or operated by the agency or by third parties on the agency's behalf, including IoT devices and operational technology (OT). National security systems and Defense and Intelligence Community systems described in 44 U.S.C. § 3553(e) are excluded.

The minimum baseline in Appendix B is short and concrete:

• Logs must be actively searchable for 6 months and retrievable for 12 months. "Searchable" means detections can run on the data without preparation; "retrievable" means it can be used after steps such as thawing it from cold storage.
• Storage may be decentralized, but logs must be readily available to the agency's top-level SOC.
• Timestamps must be accurate, with network time synchronized to a traceable source designated within the agency.
• Agencies should use CDM, hardware and software asset inventory data to confirm log coverage spans all IT, IoT and OT.
• Logs must support eleven activities, from identifying who performed an operation and tracking privilege changes to determining attack vectors and generating automated alerts for all of them.

The memo also requires agencies to provide logs to CISA and the FBI on request after a known or suspected compromise, consistent with applicable law.

The deadlines after November 18

The Agency Logging Plan is the first of four dates, all counted from the LRA's August 20 release. Calculated from the memo's "Agency Actions" table:

Days after LRA	Date	Requirement
90	Nov 18, 2026	First version of the Agency Logging Plan
120	Dec 18, 2026	Minimum Level 1 across all elements of the maturity model
180	Feb 16, 2027	Minimum Intermediate (Level 2)
320	Jul 6, 2027	Minimum Advanced (Level 3)

The cycle does not end there. Whenever CISA notifies agencies of an updated LRA, they have 30 days to update the plan, 60 days to be at Intermediate and 120 days to be at Advanced. The memo commits CISA to re-evaluating the LRA at least once a year.

What the maturity levels actually require

The maturity model turns "risk-based" into numbers. To reach Advanced (Level 3) for a system, Appendix C requires, among other things:

• At least 90% of IT/OT/IoT assets captured in a centralized hardware and software asset inventory, updated daily.
• Logs required by the plan searchable and retrievable for at least 90% of assets in that inventory, with timely aggregation.
• Actionable alerts covering at least 70% of the baseline logging requirements, with detections routinely evaluated and tuned.
• Logs encrypted in transit and at rest and regularly hashed for veracity.

Two details are worth reading closely. The Agency Actions table calls Level 1 "Basic," while Appendix C labels it "Initial." And Appendix C's retention row for Level 3 lists logs searchable for a minimum of 3 months, while the Appendix B baseline says 6 months. Until OMB or CISA clarifies, the safer course is to design to the 6-month searchable baseline, since it is the stated minimum requirement.

What CISA's reference architecture adds

The LRA is not a product list. CISA describes it as practical, outcome-driven guidance that turns the memo's policy into architectural, operational and governance decisions. A few points stand out for planning:

• A recommended default model. For most maturing agencies, CISA recommends "source-appropriate collection with common downstream handling": collect close to the source, move data over durable transport with buffering and replay, normalize and enrich it in shared services, and keep separate operational search tiers and lower-cost retrievable tiers. It does not require a single product or physical architecture.
• Cloud and SaaS are core telemetry. The LRA says cloud and SaaS administrative and control-plane activity should be treated "as core enterprise telemetry rather than as a specialized add-on," preserving actor identity, action, target resource, timestamp, outcome and session context. Where a provider offers only API-based retrieval, CISA says those integrations should be monitored for lag, missed records, schema drift and provider-side change.
• Validation is part of the design. CISA states that a logging capability that lacks validation of its operational functions cannot be considered reliable. It lists health and completeness monitoring, schema checks, required-field validation, synthetic tests and replay validation, and says the plan should answer how the agency will know required data is present, timely, complete and usable.
• Retention tied to use, not vendor defaults. Data needed for monitoring and hunting stays in low-latency tiers; data kept for forensic reconstruction can move earlier to cheaper storage if it remains retrievable and its integrity holds.

The plan template is hosted on CyberScope, where agencies also submit. CISA's suggested content includes scope and governance, the CEM and THIRF approach, how each baseline requirement will be met, risk-based additions for High Value Assets and High Impact Systems, retention and protection, and how the agency will validate and measure progress.

A checklist for the next 60 days

1. File a plan you can execute. CISA frames the plan as a strategy document, not an implementation manual, and the memo expects periodic updates. Get an honest first version in by November 18 and record known gaps.
2. Reconcile the asset inventory first. Inventory visibility is a scored element and the denominator for collection coverage. Without a current inventory, the coverage percentages cannot be measured.
3. List every system operated on your behalf. Cloud services, SaaS platforms and contractor-run systems are in scope. Confirm each provider can deliver control-plane and administrative logs in a format and timeframe your SOC can use, and that contracts support it.
4. Map the eleven baseline activities to sources. For each required activity, name the log source, where it lands and which alert depends on it. That mapping drives the collection-operations score.
5. Split hot and cold storage deliberately. Decide which datasets must stay searchable for 6 months and which can move to retrievable storage, then test a real retrieval before you count it.
6. Measure the weakest element per system. Since overall maturity follows the lowest score, find the systems and elements most likely to sit below Level 1 by December 18 and fix those first.
7. Build validation in now. Add pipeline health checks and synthetic test events so you can show logs are arriving, complete and usable, not just configured.

M-26-14 gives agencies more freedom than the memo it replaced, but it also makes logging measurable, system by system, on a fixed schedule. Baygramm helps federal agencies and the companies that serve them inventory their cloud and on-premises assets, design logging pipelines that meet searchable and retrievable retention without runaway storage costs, and connect cloud control-plane telemetry to the SOC. Learn more about our cybersecurity, cloud visibility and federal cloud services, or talk to our team about your logging plan.