OMB Director Russell Vought issued M-26-14 on May 22, 2026, rescinding M-21-31 and establishing a new risk-based logging framework for all executive departments and agencies. For the first time, OT and IoT are explicitly named as in-scope—and the clock is already ticking.
Why this matters to you
M-26-14 mandates that agencies achieve continuous event monitoring (CEM) and forensic investigation capability (THIRF) across all information systems — including OT and IoT devices that lack native logging capability. If your environment includes industrial control systems, PLCs, sensors or legacy OT infrastructure, you are now explicitly in scope.
Key deadlines at a glance
| Deadline | Requirement |
|---|---|
| Aug 20, 2026 | CISA publishes Logging Reference Architecture (LRA) |
| Nov 18, 2026 | Agency Logging Plans due to OMB & CISA |
| Dec 18, 2026 | Achieve maturity Level 1 (Basic) across all elements |
| Feb 16, 2027 | Achieve maturity Level 2 (Intermediate) across all elements |
| Jul 6, 2027 | Achieve maturity Level 3 (Advanced) across all elements |
| Ongoing | After each LRA update: Logging Plan update in 30 days, Intermediate in 60, Advanced in 120 |
The maturity model your agency will be measured against
Overall maturity is calculated as the lowest watermark across all five elements—a single weak area pulls your entire score down.
| Element | L1—Basic | L2—Intermediate | L3—Advanced | L4—Optimal |
|---|---|---|---|---|
| Inventory visibility | ≥70% assets in HWAM/SWAM | ≥80%, updated daily | ≥90%, updated daily | ≥95%, updated daily |
| Collection coverage | Logs for ≥50% of assets | Logs for ≥80% of assets | Logs for ≥90% of assets | Logs for ≥95% of assets |
| Collection operations | Alerts <50% of baseline | Alerts 50-70%, tuned periodically | Alerts ≥70%, routinely tuned | Alerts ≥95%, ML/AI-assisted tuning |
| Data retention | Retrievable ≥6 months | Retrievable ≥12 months | Searchable ≥3 mo, retrievable ≥12 mo | Searchable ≥6 mo, retrievable ≥12 mo |
| Log management | Logs stored | Encrypted at rest | Encrypted in transit & at rest, hashed | JIT access, audited, two-gate retirement |
What you’ll need to do to get there
Instant THIRF Investigations: Choose a platform that doesn’t just detect anomalies or threats. Pick one that also tells you exactly where the finding came from, what triggered it and how it was derived, giving the analyst at varying skill levels full traceability and context to act on it with confidence.
The CISA Logging Reference Architecture dropped August 20th—that’s when agency planning timelines formally begin. To meet the requirements of this mandate, you’ll need one or more solutions that offer:
- OT/ICS monitoring
- Networking monitoring
- Endpoint monitoring
- Asset inventory visibility
- Networking event logging
- Multi-source correlation and prescriptive remediation
Agencies evaluating solutions should consider how platforms address these capabilities, particularly in passive OT environments where traditional logging approaches may be difficult to implement.
Galvanick was designed to address many of these challenges through passive monitoring, asset visibility, network event logging, and multi-source correlation. Join us for our webinar on August 27th – Moving Cyber Defense at the Speed of Threat and learn how OT/ICS defenders go from threat advisory to live detection in hours, not weeks.
Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator for our vendor partners, including Galvanick, we deliver solutions for Geospatial, Cybersecurity, MultiCloud, DevSecOps, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Explore the Carahsoft Blog to learn more about the latest trends in Government technology markets and solutions, as well as Carahsoft’s ecosystem of partner thought-leaders.
