Cybersecurity Policy Report, Agencies Would Face Fewer Cyber Logging Obligations Under Revised OMB Directive, (May 27, 2026)
Organizations Mentioned:Federal Bureau of Investigation
Federal agencies would be relieved of some of their obligations to maintain logs that can reveal cyber intrusions and other “anomalous activity” under a directive issued Friday by the Office of Management and Budget.
The OMB memorandum rescinds a 2021 OMB directive that required agencies to retain logging data for cybersecurity purposes. The 2021 directive issued under the Biden administration “improved foundational capabilities across agencies,” the new memo says.
“However, some requirements, such as the retention of vast quantities of logging data without clear utility, proved neither operationally feasible nor cost-effective for most agencies. To address these inefficiencies and the evolving cyber threat environment, this memorandum directs agencies to employ a risk-based, prioritized logging approach,” it says.
“Going forward, as described below, agencies shall work within an adaptive framework that enables them to effectively and efficiently monitor their networks while minimizing red tape and containing costs,” it says.
The new requirements will enable agencies to “build upon their progress” under the Biden-era rules “while affording them greater flexibility to accommodate their disparate mission requirements and associated cybersecurity risks,” the memo notes.
Under the new requirements, the Cybersecurity and Infrastructure Security Agency will have 90 days to develop a “logging reference architecture” (LRA). Agencies will have 90 days after that to submit an “agency logging plan” to OMB and CISA.
“Retained logs must be actively searchable for a minimum of 6 months after creation to support continuous event monitoring (CEM). They must be retrievable for a year after creation to support threat-hunting, investigation, response, and forensics (THIRF),” the memo says.
The logs would have to identify, among other things, changes in agencies’ information technology, operational technology, and IoT (Internet of things) infrastructure. They would also have to detect “known indicators of compromise” and “anomalous system or user activity,” according to the memo.
“In the event of a known or suspected compromise of one or more Federal networks, agencies shall provide logs and other relevant data to CISA and the Federal Bureau of Investigation (FBI) upon request, to the extent consistent with applicable law, to assist in incident response, investigation, and remediation,” the memo adds. “Agencies shall provide such data in a format and by means agreed upon by the agency and CISA or the FBI as appropriate.”
News: FederalLegislation DataSecurity