The text of the Agency Logging Plan
Approval #
| Role | Name | Signature |
|---|---|---|
| Chief Information Security Officer (CISO) |
Revision History #
| Date | Version | Description | Reviewer |
|---|---|---|---|
| 2026-10-31 | 1.0 | Initial issuance | [Reviewer name] |
Review cycle: Every year, and within 30 days of a Logging Reference Architecture (LRA) revision.
Mandate. The Office of Management and Budget (OMB) issued memorandum M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, on May 22, 2026. It requires every agency to send an Agency Logging Plan to OMB and the Cybersecurity and Infrastructure Security Agency (CISA) within 90 days after CISA publishes its Logging Reference Architecture (LRA). CISA published the LRA on August 20, 2026, so this plan is due on November 18, 2026.
M-26-14 also sets three maturity deadlines for every logging element:
- Level 1 (Basic): 120 days after the LRA, on December 18, 2026.
- Level 2 (Intermediate): 180 days after the LRA, on February 16, 2027.
- Level 3 (Advanced): 320 days after the LRA, on July 6, 2027.
The CISO must update this plan within 30 days of any CISA notice that the LRA has changed. M-26-14 rescinded OMB M-21-31, and this plan does not use the event-logging tiers of the rescinded memorandum. The plan also meets National Institute of Standards and Technology (NIST) SP 800-53 controls AU-1, AU-6, and AU-11 for the enterprise logging capability.
1. Purpose and Scope #
The CISO uses this plan to deploy and maintain the two logging capabilities that M-26-14 requires of the Organization:
- Continuous event monitoring: real-time detection of, and response to, unusual activity by the Security Operations Center (SOC).
- Threat hunting, investigation, response, and forensics after a known or suspected compromise.
The plan applies to every information system the Organization owns or operates. That includes systems that contractors and other third parties operate for it, and any Internet of Things or operational technology that is part of a system. Every system covered by an authorization to operate is in scope.
2. Requirements This Plan Meets #
| M-26-14 requirement | Where this plan meets it |
|---|---|
| Agency Logging Plan to OMB and CISA within 90 days of the LRA (2026-11-18) | This plan, which the CISO submits for the Chief Information Officer (CIO) |
| Level 1 (Basic) across all five maturity elements by LRA + 120 days (2026-12-18) | Path to Level 1 |
| Levels 2 and 3 at LRA + 180 and + 320 days | Path to Levels 2 and 3 |
| Logs searchable for 6 months and retrievable for 12 months after creation (Appendix B) | Retention |
| Minimum log content and automated alerting (Appendix B) | Collection; Operations |
| Accurate timestamps, with network time synchronized to a traceable source | Collection |
| Coverage confirmed against Continuous Diagnostics and Mitigation (CDM) hardware and software asset data | Inventory and coverage |
| Logs and related data to CISA and the Federal Bureau of Investigation (FBI) on request | Log Access for CISA and the FBI |
| Plan updated within 30 days of an LRA revision | Governance and Maintenance |
3. Current State #
Before submission, the CISO records the Organization’s position on each LRA maturity element. The CISO uses measurements from the Continuous Diagnostics and Mitigation (CDM) inventory, the security information and event management (SIEM) platform, and the log archive. The CISO enters measurements only, never estimates. Where a measurement is unavailable, the CISO marks the cell as unavailable and carries the gap into the path to Level 1.
| Maturity element | Level 1 measure (per the LRA) | Measured value | Systems below Level 1 |
|---|---|---|---|
| Inventory visibility | Share of each system’s assets present in the centralized hardware and software inventory | [from CDM] | [list] |
| Collection coverage | Share of inventoried assets whose required logs are searchable and retrievable | [from SIEM] | [list] |
| Collection operations | Actionable alerts on the required log content, used in investigations | [from SIEM] | [list] |
| Data retention | Logs searchable 6 months and retrievable 12 months | [from archive] | [list] |
| Log management | Documented log management practice with owners and review cadence | [in place / gap] | [list] |
4. Operational Steps #
4.1 Inventory and coverage #
The logging lead measures coverage against the CDM hardware and software asset inventories. A hand-maintained list does not count. The CISO assigns each system in the authorization inventory a logging owner in the CIO’s organization. For each asset that the inventory shows for that system, the logging owner confirms that the asset sends its required logs. If it does not, the logging owner lists it as a coverage gap with a remediation date. Third parties that operate systems for the Organization provide equivalent inventory and log-coverage evidence under their contracts.
4.2 Collection #
For every in-scope system, the logging lead collects at least the log content in M-26-14 Appendix B:
- The identity used for each operation.
- Source and destination network addresses, with protocols, ports, and session attributes.
- Object and data events: accessed, modified, or destroyed.
- Privilege changes.
- Changes to information technology, operational technology, and Internet of Things infrastructure.
- Alerts from security tools.
- Known indicators of compromise.
- Unusual system and user activity.
- Data affected in an incident.
- Attack vectors, including initial access and lateral movement.
Every log carries an accurate timestamp. The network lead synchronizes network time through Network Time Protocol (NTP), or an equivalent method, to a time source the Organization designates and can trace. The preferred source is traceable to the U.S. Naval Observatory or NIST.
| Source class | Destination | Owner |
|---|---|---|
| Identity provider sign-in, audit, and multi-factor events | SIEM | Identity and access management lead |
| Endpoint detection and response; device management | SIEM and endpoint detection and response (EDR) console | Endpoint engineering lead |
| Email and collaboration platform audit | SIEM | Messaging lead |
| Public web, content delivery, and web application firewall | SIEM | Web platform lead |
| Cloud control-plane and tenant administration audit | SIEM | Cloud platform lead |
| Network, remote access, and boundary devices | SIEM | Network lead |
| Vulnerability scanning and CDM sensor data | CDM and SIEM | Vulnerability management lead |
| Privileged access management and administrative sessions | SIEM | Identity and access management lead |
The logging tools are:
(No technology inventory entries for this family.)
4.3 Operations #
The Organization’s top-level SOC can reach the logs whether storage is central or distributed. The SOC Manager maintains detection content for each class of required log content, and that content raises automated alerts. The SOC triages the alerts. Alerts that lead to investigations are the evidence that collection operations have reached Level 1. Threat hunting, investigation, response, and forensics use the same data, under the Incident Response Plan (PLAN-IR-001).
4.4 Retention #
| Tier | Minimum duration | Basis |
|---|---|---|
| Searchable (hot) | 6 months after creation | M-26-14 Appendix B |
| Retrievable (archive) | 12 months after creation | M-26-14 Appendix B |
| Records-schedule retention | As scheduled | Retention for cybersecurity never shortens a records obligation |
Where the Organization’s audit retention parameter is longer than these floors, the longer period applies. The CIO’s organization carries out legal holds with the Office of the General Counsel. A legal hold overrides the disposal step of every tier.
5. Path to Level 1 by December 18, 2026 #
| Target date | Action | Owner |
|---|---|---|
| 2026-09-30 | Freeze the system list from the authorization inventory. Assign a logging owner to each system. | CISO |
| 2026-10-14 | Pull hardware and software inventory completeness per system from CDM. Open gaps as plan of action and milestones (POA&M) items. | CDM lead |
| 2026-10-31 | Onboard the remaining identity, email, endpoint, and public web log sources. | Logging lead |
| 2026-11-07 | Confirm 6-month searchable and 12-month retrievable retention for every onboarded source, or begin archive backfill. | Logging lead |
| 2026-11-14 | Validate detection content against the Appendix B log content list. Run a tabletop with the incident response team. | SOC Manager |
| 2026-11-18 | Submit this plan to OMB and CISA. | CISO and CIO |
| 2026-12-11 | Assemble the evidence pack: coverage percentage per system for each element. | Logging lead |
| 2026-12-18 | Attest Level 1 across all five elements, or record a POA&M item for each system still below it. | CIO |
6. Path to Levels 2 and 3 #
Level 2 (Intermediate) is due 180 days after the LRA, on February 16, 2027. Level 3 (Advanced) is due 320 days after it, on July 6, 2027. The CISO reports progress as the share of systems at each level for each element, which is how M-26-14 measures agencies. After the Level 1 attestation, the CISO sets the Level 2 and Level 3 milestone tables. The CISO puts High Value Assets and high-impact systems first, as the LRA directs, and aligns the work with the visibility and analytics pillar of the CISA Zero Trust Maturity Model.
7. Log Access for CISA and the FBI #
If federal networks are known or suspected to be compromised, the Organization gives logs and other relevant data to CISA and the Federal Bureau of Investigation (FBI) on request. The Organization provides them in a format and by a means agreed with CISA and the FBI. It meets their requested timeframes as far as practicable and consistent with applicable law. The CISO is the point of contact for these requests. Before any release that may involve privileged material or statutory limits, the CISO consults the Office of the General Counsel without delaying the response.
8. Governance and Maintenance #
| Role | Responsibility |
|---|---|
| CIO | Approves the plan. Attests maturity levels to OMB and CISA. |
| CISO | Owns and submits the plan. Tracks the maturity milestones. Updates the plan within 30 days of an LRA revision. |
| Logging lead | Runs collection, retention, and coverage measurement. |
| SOC Manager | Owns detection content and alert operations. |
| System Owners and Information System Security Officers (ISSOs) | Make sure their systems’ assets send the required logs and stay in the inventory. |
| Contracting Officers and Contracting Officer’s Representatives | Write the logging requirements into contracts for systems operated for the Organization. |
The CISO reviews this plan every year, after each maturity-level attestation, and within 30 days of any CISA notice of an updated LRA.
9. References #
These are the sources this document cites, with a link to each official text.
- CISA Zero Trust Maturity Model, April 11, 2023.
- OMB M-26-14: Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, May 22, 2026.