The US Cybersecurity and Infrastructure Security Agency (CISA) wants federal agencies to (re)shape their logging strategy around one question: when an attack hits, can you actually use the logs you’ve collected to catch it and reconstruct what happened afterward?
The Logging Reference Architecture (LRA), released in August 2026, is meant to help US federal civilian agencies meet the logging requirements in OMB Memorandum M-26-14, but CISA explicitly encourages critical infrastructure operators and other government organizations to use the document as a benchmark for their own logging and monitoring plans.
The guideline contains several appendices, two of which essentially provide free assessment tools: one to check whether the architectural decisions related to a logging plan are well thought-out, and the other to check whether the plan actually works in practice (Are the logs usable? Is the data timely? Is the event fidelity sufficient? Are the protections working? Can you detect when the logging capability has degraded?).
Although the LRA is a government document, private-sector security teams can run their own logging programs against the same checklists.
Monitoring, forensics, and the cost of storing it all
The LRA framework organizes everything around two operational goals:
- Continuous event monitoring (CEM): detecting and responding to suspicious activity in near-real time
- Threat hunting, investigation, response, and forensics (THIRF): reconstructing what happened after a compromise.
Every telemetry, retention, and architecture decision is meant to trace back to a concrete question the business needs answered during an incident.
Collecting logs is not the same as being able to use them, the cybersecurity agency noted.
A log source can be fully connected and still be useless in a real incident if the data shows up too late, is missing key details, carries unreliable timestamps, or has been boiled down into summaries that fall apart when an analyst starts to investigate.
The LRA calls the distinction between searchable, retrievable, and immutable data one of its most important storage decisions, and it maps directly onto budget.
Not all telemetry needs to sit in expensive, low-latency storage. The discipline is deciding what must remain immediately searchable for monitoring and hunting, what can move to cheaper tiers while staying retrievable for reconstruction, and what requires immutable, evidentiary handling. (The federal baseline – actively searchable for six months, retrievable for one year – is a useful reference point.)
The document also cautions against letting the SIEM become the system of record: the common pattern of ingesting everything into one analytics platform grows costly and brittle as volume rises, CISA says, and can weaken data fidelity if ingestion-time processing becomes the only durable copy of an event.
Its preferred model is collection suited to each source, feeding shared downstream processing. And the logging infrastructure should be treated as “a security-critical capability whose compromise can blind detection, corrupt evidence, disrupt sharing, or undermine confidence in downstream decisions.”
The LRA also notes the cons of centralized log storage: “Centralization can improve consistency and visibility, but only if the data remains timely, trustworthy, and usable. A centralized storage design that strips away context, introduces major delay, or creates a fragile chokepoint is weaker than a more federated design with strong common governance and shared operational handling.”
Governance around AI in the pipeline
The document addresses using AI and machine learning (ML) for detection, alert prioritization, triage, and investigation, with boundaries that matter for any organization adopting the same tooling.
The LRA treats AI outputs as derived data, not authoritative event records, and says actions with material operational, legal, or privacy consequences should remain subject to human review.
“Agencies should preserve the relationship between the original record and the derived output and should record enough metadata to support review, reproduction, and challenge of the result,” the LRA notes. For leaders under pressure to show AI adoption in the SOC, it’s a concise statement of where the guardrails belong.
What’s next for federal agencies
Agencies bound by the M-26-14 memorandum must submit an Agency Logging Plan to the Office of Management and Budget and CISA within 90 days of the LRA’s publication.
The plan should document how the agency will meet the baseline requirements and where it needs to log beyond them. From there, agencies will work through a maturity model, (in theory) reaching the “Advanced” level within 320 days.
CISA is also required to review and update the LRA at least annually, so the guidance is expected to evolve as threats and technologies change.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!