OMB Updates Cyber Event Logging Requirements for Federal Agencies

On May 25, 2026, the Office of Management and Budget (OMB) released a new memorandum, M-26-14, revising the cybersecurity event logging requirements for federal agencies. This memo rescinds the previous M-21-31, which aimed to enhance logging capabilities but proved costly and operationally challenging. The new guidelines emphasize a risk-based approach to logging, focusing on continuous event monitoring and threat hunting. Agencies are required to submit updated logging plans within 90 days of the Cybersecurity and Infrastructure Security Agency (CISA) developing a logging reference architecture. The changes aim to improve the efficiency of cybersecurity operations in light of evolving threats. Critics have raised concerns about the potential gaps in security during the transition period. The Government Accountability Office previously noted that many agencies failed to meet the logging maturity benchmarks set by M-21-31.

Key Points: • OMB's new memo M-26-14 replaces the previous M-21-31 logging requirements. • Agencies must adopt a risk-based approach to logging and submit updated plans within 90 days. • Concerns exist about the timing of the transition and potential security gaps during implementation.