OMB M-26-14 officially rescinds M-21-31, replacing the requirement to hoard all raw log data with a flexible, risk-based maturity model. This transition helps agencies adapt to tightening fiscal constraints, including a 10% nondefense spending cut for fiscal year 2027 (FY27).
Compliance is now divided into two distinct operational goals: Continuous Event Monitoring (CEM; real-time detection that’s searchable for 6+ months) and threat hunting, investigation, response, and forensics (THIRF; long-term data that’s retrievable for 12+ months).
Agencies are no longer required to pump all raw data into central repositories. M-26-14 encourages hybrid and federated architectures, allowing teams to filter traffic at the edge and send only high-priority alerts to primary security information and event management (SIEM) to keep ingestion fees manageable.
Akamai App & API Protector powers real-time CEM telemetry and zero-day edge defense, while Akamai Guardicore Segmentation covers THIRF by mapping lateral movement, securing headless Internet of Things/operational technology (IoT/OT) devices, and driving Zero Trust network maturity.
Once the Cybersecurity and Infrastructure Security Agency (CISA) publishes its Logging Reference Architecture, agencies have just 90 days to submit a formal Agency Logging Plan and demonstrate baseline capabilities.
Federal Chief Information Security Officers (CISOs) are facing unprecedented times as they navigate a growing attack surface, reduced budgets, and updated mandates from the Office of Management and Budget (OMB).
On May 22, 2026, the OMB issued Memorandum M-26-14, establishing a rigorous, risk-based maturity model for event logging and network visibility. Yet, this aggressive compliance timeline arrives at the same time that the proposed FY27 budget outlines a strict 10% cut to nondefense discretionary spending, followed by an ongoing annual 2% reduction constraint thereafter.
Furthermore, key cybersecurity leadership agencies like CISA are navigating proposed reductions of up to US$707 million.
The message from Washington is clear: Agencies must defend against and persistently combat cyber enemies within an environment of intense fiscal restraint. OMB M-26-14 officially rescinds the older M-21-31 guidelines, acknowledging that storing vast amounts of unfiltered log data without clear utility was neither operationally feasible nor cost effective.
By shifting to an adaptive model and adopting a risk-based approach to software and hardware security, the government has opened the door to intelligent, edge-driven architectures.
To streamline collection operations, M-26-14 explicitly divides logging objectives into two distinct, mission-critical functions:
CEM consists of logs, log management, and logging infrastructure that enable agencies to monitor network activity in real time, promptly flag anomalous activity, and respond via a security operations center (SOC). These logs must be actively searchable for a minimum of 6 months.
THIRF consists of logs, log management, and logging infrastructure that enable agencies to investigate and perform forensic analysis of network activity after a known or suspected compromise. These logs must be retrievable for at least 12 months to satisfy long-term data retention requirements.
The legacy approach to compliance meant storing every single raw byte of data in a centralized repository. Under the proposed FY27 US Government budget, continuing this operating model is a financial challenge.
Crucially, M-26-14 allows log storage to be decentralized. The directive explicitly notes that logs must be readily available to the top-level agency SOC, encouraging hybrid approaches that combine centralized storage with federated access (Figure).
To mitigate the risk of sophisticated, automated digital threats, federal civilian agencies must maintain the ability to rapidly detect, respond to, and analyze anomalous network activity. Under OMB Memorandum M-26-14, this mandate requires a shift toward an adaptive, risk-based, and prioritized logging approach that reduces administrative complexity while strictly containing operational costs.
Akamai provides FedRamp-certified solutions that help agencies achieve the necessary visibility baselines across all information systems, including:
Achieving CEM, the first core objective of the memorandum, requires real-time log management and infrastructure capable of promptly flagging anomalous activity to a SOC. App & API Protector maps directly to this real-time mandate with:
Real-time threat detection via Rapid Rules
App & API Protector continuously monitors edge traffic, enabling SOCs to track and block anomalous user activity in real time. To counter automated threats driven by AI, Akamai uses Rapid Rules to instantly deploy edge defenses against zero-day vulnerabilities. This automated shield prevents initial access attempts while generating the high-fidelity telemetry required for CEM objectives.
Automated baseline telemetry
The edge architecture natively captures mandatory Appendix B logging data, including precise source and destination network address parameters, protocols, ports, session attributes, and suspicious activity caught by inline security gateways.
Upstream traffic filtering
By mitigating malicious activity and web noise at the edge, App & API Protector minimizes raw traffic sent to internal agency environments. By using DataStream2, agencies capture granular edge logs in real time. To control costs, the system sends this telemetry to TrafficPeak, which uses native pre-built integrations for major SIEMs (like Splunk, Microsoft Sentinel, or Elastic) to split the data pipeline.
Critical alerts go to the primary SIEM for immediate SOC response, while bulk raw logs remain in a cost-effective storage tier. This framework keeps logs actively searchable for the mandatory 6-month CEM threshold without cost-prohibitive SIEM ingestion fees.
The second objective of the mandate demands robust infrastructure for THIRF, ensuring that agencies can reconstruct attack patterns, isolate compromised systems, and maintain logs for a 12-month retrieval window.
Furthermore, OMB requires log collection coverage to encompass all information technology, explicitly including IoT devices and OT. Akamai Guardicore Segmentation delivers the precise technical capabilities to resolve these visibility challenges with:
Comprehensive infrastructure mapping
Akamai Guardicore Segmentation addresses the log coverage gap by providing an exhaustive, real-time look across the entire distributed IT infrastructure, ensuring total inventory visibility by capturing and logging assets that traditional software agents cannot easily reach.
Headless IoT and OT enforcement
By tracking assets and grouping them within a centralized visualization layer, Akamai Guardicore Segmentation ensures that network security boundaries and log coverage extend seamlessly over non-native logging environments, including legacy OT systems and connected IoT devices.
Forensic mapping of lateral movement
To support comprehensive THIRF investigations, Akamai Guardicore Segmentation continuously records internal network interactions by tracking identity metrics, infrastructure changes, and exact lateral movement vectors. If an incident occurs, this structured data can be easily retrieved.
Zero Trust alignment
Akamai Guardicore Segmentation directly fulfills the mandate’s requirement to align logging activities with CISA’s Zero Trust Maturity Model. Beyond reinforcing the “Visibility and Analytics” cross-cutting capability that underpins all five foundational pillars of the cybersecurity framework, Akamai Guardicore Segmentation specifically hits the framework's “Networks” pillar.
Microsegmentation is explicitly designated as the key capability that delivers a comprehensive enforcement layer across all seven Zero Trust pillars. By implementing Akamai Guardicore Segmentation, federal agencies natively elevate their network infrastructure straight to the highest tier of Zero Trust maturity.
The compliance timelines mandated by OMB are fast-moving. CISA is slated to publish the finalized Logging Reference Architecture this fiscal year, triggering an immediate 90-day countdown for every federal civilian agency to submit its formal
Agency Logging Plan and demonstrate a minimum baseline capability.
Federal IT leaders face strict limits on time, staffing, and budgets when designing logging architectures.
By using Akamai’s solutions, agencies can cleanly inherit robust, Zero Trust–aligned network visibility that scales naturally, fulfills CISA's upcoming reference architecture framework, and keeps operational costs firmly under control.
Are you ready to integrate edge-driven visibility into your upcoming 90-day Agency Logging Plan?
Contact the Akamai Federal Public Sector Team today to request an architectural consultation.
© 2026 Akamai Technologies
