OMB Memo Replaces Federal Logging Rules With Risk-Based Cybersecurity Requirements
Summary
OMB Memorandum M-26-14 replaces earlier federal logging requirements with a risk-based approach focused on real-time monitoring, threat investigation and forensics, with agency maturity milestones following CISA’s logging architecture.
Key points
- M-26-14 repeals requirements established by M-21-31, which followed the 2020 SolarWinds Orion supply-chain incident.
- CISA is to develop a Logging Reference Architecture by August 20; agencies then have 120 days to meet basic maturity and 320 days to reach advanced maturity.
- The memo emphasizes Continuous Event Monitoring for real-time anomaly detection and Threat Hunting, Investigation, Response, and Forensics for investigating potential compromises.
- It shifts emphasis from retaining large volumes of logs to prioritizing useful security context and risk-based logging.
- The article promotes Wiz monitoring, investigation, forensics, and compliance features as ways agencies could support the memo’s requirements.
Article Details
- Event Type
- U.S. federal logging policy change: OMB Memorandum M-26-14 replaces M-21-31 and establishes risk-based logging maturity requirements for federal agencies.
- Impact
- Federal agencies must develop logging plans aligned with CISA’s Logging Reference Architecture, meet basic maturity within 120 days of its release, and reach Advanced maturity within 320 days. The memorandum emphasizes real-time monitoring, threat investigation and forensics, and prioritized logging. The article also describes Wiz capabilities intended to support agency compliance.
Vendors
Products
Wiz Agentless ForensicsWiz Audit HistoryWiz Blue AgentWiz Data Security Posture Management (DSPM)Strategic Log Placement: By using Wiz Data Security Posture Management (DSPM), agencies gain the contextual insight needed to proactively verify that continuous data access logging is enabled specifically on data storesWiz Detection EngineReal-Time Log Ingestion & Analytics: The Wiz Detection Engine ingests and processes multi-layered logs in near real-time across your Cloud, SaaS, IdP, and VCS infrastructure.Wiz Runtime SensorLightweight Workload Visibility: The eBPF-based Wiz Runtime Sensor provides real-time container- and process-level application visibility (such as tracking process executions, command inputs, and connections).Wiz Security Grapha range of on-premises devices, including Internet of Things and Operational Technology, into the Wiz Security Graph. By leveraging this context of assets and identities, Wiz is able to enhance threat detectionWiz Unified Vulnerability Management (UVM)