AI-enabled adversaries are accelerating the pace of cyberattacks, and federal agencies must now detect and respond in less time. Their biggest obstacle is visibility: Critical security data is fragmented among cloud environments, IT infrastructure, endpoint events and operational technology.
Without bringing these sources together, agencies risk spotting threats too late.
In May, the Office of Management and Budget issued memorandum M-26-14, addressing this challenge. This shifts agency logging and network visibility requirements toward using logs to improve security outcomes rather than simply collecting and storing them. The Cybersecurity and Infrastructure Security Agency followed in August with its logging reference architecture (LRA) to guide implementation.
Shared services can help agencies meet these expectations and take on adversaries. CISA’s Security Information and Event Management as a Service (SIEMaaS) offering gives federal civilian agencies a shared platform for security monitoring, threat detection and incident investigation, at no cost.
Agency logging plans for M-26-14 are due Nov. 18, and agencies don’t have to build the answer from scratch. Starting from existing approaches, like SIEMaaS, is an effective way to meet it.
Creating better visibility without the added cost #
Government agencies need accessible security data and the ability to investigate suspicious activity before attacks disrupt critical services and cause damage. Not every agency has the resources to build and maintain those capabilities — monitoring, threat detection, incident response — independently, which is where shared cyber services come into play.
Collecting, indexing and storing large amounts of information forces agencies to make tough choices about how much data they can afford to keep readily available. M-26-14 eases those choices by separating logs that must be searchable from those that only need to be retrievable.
Shared cyber services allow agencies to reap the benefits without having to front the full financial burden. The Continuous Diagnostics and Mitigation (CDM) Program Management Office oversees the hosting and operations of the SIEMaaS environment, including infrastructure, data pipelines, enrichment workflows, and threat detection engines, allowing agencies to reallocate existing SIEM and logging budgets to other mission-critical needs.
M-26-14 also permits decentralized logging architectures as long as security operations centers (SOC) can access the necessary information. This way, improving visibility doesn’t require moving every log into one central repository. SIEMaaS can sit alongside the systems agencies already run rather than replacing them.
Threats affect multiple agencies, and an attack detected by one could be a warning sign for another. Hackers exploiting a SharePoint flaw at one agency becomes an early warning for every other agency running it. Security platform standardization enables all participating agencies to benefit from the detections of other agencies, enabling faster response to threats.
Making security logs useful #
M-26-14 emphasizes operational value, requiring agencies to keep security logs actively searchable for at least six months and retrievable for at least one year.
Searchable logs are important because they let analysts trace an attack back to its starting point and find out what an attacker touched along the way. That shortens investigations and helps agencies contain damage, whereas archived logs are slower to check.
Retention serves more than the SOC. A year of retrievable logs lets analysts reopen old activity when a new indicator surfaces, answer lawful requests from CISA and the FBI, supports evidence handling, and feeds maturity reports to OMB.
M-26-14 focuses on two complementary capabilities, and neither works effectively without timely access to relevant security data:
- Continuous Event Monitoring (CEM) : the ongoing collection, indexing, analysis, and review of security event data in real time, helping agencies identify suspicious activity.
- Threat Hunting, Investigation, Response and Forensics (THIRF) : post-compromise analysis, long-term historical data patterns, and proactive threat mitigation, helping analysts understand how attacks unfolded and determine responses.
M-26-14 and the LRA set a path for developing these capabilities through a series of maturity milestones, but meeting them requires more than a logging policy.
Agencies need a platform that can collect, search and correlate logs across cloud, on-site and OT environments, along with analysts who can monitor that data and investigate what they find. SIEMaaS supplies the first at federal scale at no cost; the second remains each agency’s job.
That model avoids high pricing, where cost becomes the ceiling on visibility, and it lets agencies move off legacy SIEMs without a rip-and-replace bill. The result is both stronger posture and real savings. Agencies can build CEM and THIRF capabilities while shifting scarce budget and staff from infrastructure to mission-critical activities and analysis.
CISA is working to align SIEMaaS with M-26-14 requirements, with the goal of providing compliance capabilities out of the box. That means spending less time building and tuning a platform to meet logging requirements and more time using the data to find and stop threats.
A shared platform is not a shared obligation, though. CISA runs the infrastructure and data pipelines. Each agency still handles the work the memo measures: knowing what is on its network, getting the right logs off those systems, watching and tuning alerts, hunting in its own environment and reporting maturity to OMB.
Looking beyond the deadline #
CISA leaders have called SIEMaaS a “rosetta stone” and a path to a shared common operating picture, giving agency and CISA threat hunters more of the timely, trustworthy data that cross-agency incidents demand. That matters because adversaries are using AI to move faster and evade detection, and no single agency can out-innovate that alone.
M-26-14’s Nov. 18 deadline should prompt practical decisions about how agencies collect, access and use security data. Leaders should inventory their log sources, assess existing CEM and THIRF capabilities, identify gaps and evaluate whether SIEMaaS can meet their requirements before investing in additional infrastructure. Plans should also name which logs go to SIEMaaS and who reports maturity.
Ultimately, the agencies that treat M-26-14 as an ongoing operational discipline to bolster cyber defense, and that lean into shared, collaborative defense, will be the ones best prepared for the next generation of AI-driven threats.
Chris Townsend is the global vice president of public sector at Elastic.