OMB Memorandum M-26-14, issued May 2026, replaces the 2021 federal logging mandate M-21-31, shifting US federal agencies from broad log collection and retention requirements to a risk-based, outcome-focused approach. The new guidance centers on two distinct objectives: Continuous Event Monitoring (CEM) for real-time threat detection, and Threat Hunting, Investigation, Response, and Forensics (THIRF) for post-incident analysis. Agencies struggled with M-21-31 due to cost spirals, staffing shortages, and massive data volumes that didn't improve security outcomes. M-26-14 encourages smarter telemetry pipelines that filter, route, and enrich data intelligently rather than centralizing everything. The guidance also explicitly aligns logging strategy with the CISA Zero Trust Maturity Model, making logging a core part of Zero Trust rather than a standalone compliance exercise. Recommended next steps include mapping telemetry to CEM/THIRF objectives, evaluating filtering strategies, and aligning logging with Zero Trust initiatives.
