CISA Releases Foundational, Flexible Guidance to Help Federal Agencies Implement Effective Logging, Visibility and Operational Standards

WASHINGTON – Today, the Cybersecurity and Infrastructure Security Agency (CISA) published the Logging Reference Architecture, an outcome-driven guide for federal civilian executive branch (FCEB) agencies to establish logging, visibility and operational standards in an Agency Logging Plan, as required in Office of Management and Budget (OMB) Memorandum M-26-14. Developed in collaboration with OMB and the Chief Information Security Officers (CISO) Council, this guidance implements a practical, risk-based, prioritized logging approach that improves agency network monitoring.

In alignment with the objectives of M-26-14, CISA’s Logging Reference Architecture guidance directly helps agencies achieve priority logging capabilities that support continuous event monitoring, threat hunting, incident response, and forensics. Agencies will be able to utilize this guidance to update enterprise logging strategies, which will inform an Agency Logging Plan that agencies are required to submit to OMB and CISA by November 18, 2026. The M-26-14 Agency Logging Plan Template, provided by CISA, offers a structured format to streamline planning.

“Cyber defense begins with insight. Robust logs provide the critical visibility needed to counter daily threats targeting federal systems. CISA is enhancing agency logging strategies to ensure security teams can rapidly detect and respond to cyber incidents,” said CISA Acting Executive Assistant Director for Cybersecurity Chris Butera. “The Logging Reference Architecture guides agencies away from fragmented practices, establishing a mature enterprise capability that maximizes the operational value of their data.”

Within the Logging Reference Architecture, CISA provides operational checklists to help federal agencies inform their logging architecture design and organizational strategies, achieve baseline logging fidelity, and ensure logging plans are operationally ready to support necessary security outcomes. The guidance will also inform agency decisions on integrating artificial intelligence (AI) into logging processes in ways that enhance operational value while still maintaining required governance and oversight. 

Although the Logging Reference Architecture was developed for federal agencies, CISA encourages critical infrastructure entities and state, local, territorial, and tribal government organizations to review the guidance to benchmark their own logging and monitoring plans.

###

About CISA

As the nation’s cyber defense agency and national coordinator for critical infrastructure security, the Cybersecurity and Infrastructure Security Agency leads the national effort to manage, uncover, and reduce risk to our digital and physical infrastructure Americans rely on every hour of every day.