White House Replaces Federal Cybersecurity Logging Guidance With Risk-Based Rules
Summary
OMB memo M-26-14 replaces federal logging guidance from 2021 with a risk-based approach. CISA has 90 days to develop a logging architecture; experts warn rescinding the old guidance first could delay agency prioritization.
Key points
- OMB memo M-26-14 replaces the 2021 federal cybersecurity logging guidance, M-21-31.
- Agencies are directed to prioritize logging based on risk and reduce collection of data without clear operational value.
- CISA must develop a logging reference architecture within 90 days, focused on continuous monitoring and post-compromise investigation.
- Agencies will have another 90 days to submit logging plans aligned with the architecture.
- An analyst warned that rescinding the previous memo before the new directives are in place could leave agencies without guidance for six months or more.
Article Details
- Event Type
- Federal cybersecurity logging policy update
- Impact
- The new OMB memorandum, M-26-14, replaces the 2021 guidance and directs federal agencies to use risk-based, prioritized logging. CISA must publish a logging reference architecture within 90 days, after which agencies have another 90 days to submit plans. Nick Leiserson warned that rescinding the prior guidance before the new directives are in place could delay agency prioritization and budgeting for six months or more.
People
Joe BidenSigned the 2021 federal cybersecurity logging memorandum that the new guidance replaces.John HarmonRegional vice president of cyber solutions at Elastic; commented on the cybersecurity implications of the revised federal logging memorandum.Nicholas LeisersonSenior vice president for policy at the Institute for Security and Technology and former Biden administration Office of the National Cyber Director staff member; warned that the transition between memoranda could delay agencies’ logging priorities and budgets.