Are you M-26-14 ready?
The logging rulebookjust got torn up.
OMB rescinded M-21-31 and replaced it with M-26-14 — built on two priorities: Continuous Event Monitoring (CEM) and Threat Hunting, Investigation, Response, and Forensics (THIRF). CISA's implementation architecture is already published — the compliance clock is already running.
Are you M-26-14 ready? Find out in about 12 minutes.
Why the rules changed
What changed
M-21-31 asked agencies to log against almost everything. OMB itself now says that wasn't operationally realistic or cost-effective — M-26-14 replaces it with a leaner, 11-outcome model.
How you're graded
Five elements — inventory visibility, collection coverage, collection operations, retention, and log management. Your overall score is the LOWEST of the five, not an average.
What's next
Your Agency Logging Plan is due to OMB/CISA on a fixed clock that starts running from the LRA's publish date — there's no waiting for a separate announcement.
One Architecture. Five Maturity Elements.
M-26-14 doesn't grade you on a product. It grades the outcome of your whole logging architecture across five elements: inventory visibility, collection coverage, collection operations, data retention, and log management. CISA's Logging Reference Architecture is explicit that not all telemetry has to live in the SIEM, as long as it stays retrievable within operationally acceptable timeframes, and it warns that SIEM-first designs often become costly and inflexible as volume and retention grow. The SIEM is one component. We start by understanding the architecture you have, then close the gaps that hold back your score.
See what the architecture requiresHow TechForward can help
We evaluate your existing environment first, then close the architectural gaps — without prescribing a product.
What the LRA Requires — and Where Gaps Appear
Every layer M-26-14 and the LRA expect, the gap we most often find, and the capability that closes it. We recommend technology only after evaluating your environment.
| Layer | What's required | Common gap | Capability needed |
|---|---|---|---|
| Collection | Collect close to the authoritative source, preserve provenance (§4.2) | Sources onboarded through intermediaries that strip origin details | Source-level collection that keeps provenance |
| Transport | Durable, decoupled, buffered, replayable (§4.3, §5.2) | Data lost when a downstream system is busy or down | Buffered, replayable log pipelines |
| Normalization | Usable normalized representation via a validated schema — OCSF, ECS, or STIX/TAXII (§4.4, §7) | Inconsistent formats; normalization that discards original fields | Schema mapping that keeps the original event recoverable |
| Hot / searchable storage | Actively searchable ≥ 6 months (Appendix B) | Searchable window shorter than 6 months, or too costly to extend | Tiered storage sized to the searchable requirement |
| Cold / retrievable storage | Retrievable ≥ 12 months, cost-tiered (§4.5, §5.3) | Everything kept in the most expensive tier, or archives that can't be searched in time | Lower-cost retrievable tiers with tested retrieval |
| Evidentiary storage | Immutable handling for forensic data (§4.5) | Logs that could be altered or deleted after an incident | Write-once storage and integrity checks |
| Detection / analytics | Alerting covers ≥ 70% of baseline requirements, tuned routinely | Alerts cover only a few log categories; tuning is ad hoc | Detection engineering mapped to the baseline |
| Response automation | Optional above-baseline (§5.5) | Automation built on unreliable data, amplifying noise | Automation added only after data quality is proven |
| Identity / asset inventory | Feeds Inventory Visibility scoring directly | Inventory incomplete or not updated daily | Automated asset inventory tied to identity sources |
| Time sync | NTP, traceable to USNO or NIST (Appendix B.3) | Clock drift between systems breaks event timelines | Enforced, monitored time synchronization |
| Access control | RBAC/ABAC, encryption in transit + at rest (§4.6) | Broad access to log data; unencrypted transport | Role-based access and end-to-end encryption |
| Validation / observability | Schema conformance, synthetic tests, pipeline health (§4.7) | Sources silently stop sending and nobody notices | Pipeline health monitoring and synthetic tests |
| IoT / OT | Gateway aggregation where native logging is absent (§6.2.9) | Devices that can't log are invisible | Gateway or aggregation-based collection |