OMB Memo M-26-14 Replaces Federal Logging Mandate With Risk-Based Approach
Summary
OMB’s M-26-14 replaces the prior federal logging mandate with separate priorities for real-time monitoring and deeper forensic retention. CISA is directed to issue a Logging Reference Architecture within 90 days; eSentire also promotes its logging services.
Key points
- Issued May 22, 2026, M-26-14 rescinds the five-year-old M-21-31 mandate and calls for risk-based, prioritized logging.
- The memo separates Continuous Event Monitoring, for real-time detection, from Threat Hunting, Investigation, Response, and Forensics, which requires deeper retention.
- It rejects indiscriminate log collection as operationally impractical and not cost-effective, and does not prescribe one logging approach.
- CISA is directed to publish a Logging Reference Architecture within 90 days, covering log categories, retention tiers, and maturity benchmarks.
- The article warns that filtering logs for monitoring can leave gaps for later investigations and forensic reconstruction.
- eSentire describes separate logging options for monitoring and broader retention, including its Atlas SIEM and other SIEM integrations.
Article Details
- Event Type
- The White House Office of Management and Budget issued Memorandum M-26-14, rescinding M-21-31 and establishing a risk-based logging framework with separate priorities for Continuous Event Monitoring and Threat Hunting, Investigation, Response, and Forensics.
- Impact
- Federal agencies are directed to prioritize log collection according to security objectives rather than retain logs indiscriminately. CISA is directed to publish a Logging Reference Architecture within 90 days, with implementation guidance on log categories, retention tiers, and maturity benchmarks.
People
Vendors
eSentireeSentire’s MDR logging architecture has been built around this same distinction, offering separate paths for real-time monitoring and comprehensive forensic logging rather than forcing a single approach on everyMicrosoftand Threat Hunting, Investigation, Response, and Forensics distinction), eSentire Atlas SIEM, Microsoft Sentinel, or bring-your-own SIEM in Splunk. This puts the customer in full control of what getsSumo Logicfor forensic investigation, regulatory audit, or full traceability, eSentire offers MDR for Log through Sumo Logic (with two data tiers that map directly to the Continuous Event Monitoring and Threat Hunting,
Products
Atlas SIEMeSentire recently launched Atlas SIEM providing unlimited logging capabilities with real time correlation and threat detection capabilities.eSentire Atlas PlatformThis philosophy is embedded directly into the eSentire Atlas Platform; our cloud-native, AI-powered SecOps infrastructure purpose-built to ingest, correlate, and act on security telemetry at scale, without requiringMicrosoft Sentineland Threat Hunting, Investigation, Response, and Forensics distinction), eSentire Atlas SIEM, Microsoft Sentinel, or bring-your-own SIEM in Splunk. This puts the customer in full control of what gets collectedSplunkResponse, and Forensics distinction), eSentire Atlas SIEM, Microsoft Sentinel, or bring-your-own SIEM in Splunk. This puts the customer in full control of what gets collected and how long it is retained.