Logging compliance
Overview
Federal logging requirements for civilian agencies are set by OMB Memorandum M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, issued May 22, 2026. M-26-14 rescinded and replaced OMB M-21-31.
Cloud.gov helps agencies meet their M-26-14 requirements for the applications and data inside their Cloud.gov boundary, by capturing application logs, retaining them, and forwarding them to agency systems. Questions about your specific requirements: support@cloud.gov.
What M-26-14 requires
M-26-14 sets two retention objectives, both measured from the moment a log is created:
- Continuous event monitoring (CEM) — logs must be actively searchable for at least 6 months after creation. "Searchable" means the data can be used for cyber defense immediately, without preparation steps.
- Threat hunting, investigation, response, and forensics (THIRF) — logs must be retrievable for a year after creation. "Retrievable" means the data can be used after intermediary steps, such as restoring it from cold storage.
The searchable window sits inside the retrievable window; they are not sequential phases.
M-26-14 also replaces M-21-31's EL1/EL2/EL3 event-logging tiers with a five-level logging maturity model, and is accompanied by the CISA Logging Reference Architecture (LRA). Agencies assess their own maturity against that model and produce an Agency Logging Plan.
M-26-14 sets deadlines — measured from the LRA's release — for your Agency Logging Plan and for reaching each maturity level. Refer to M-26-14 and the LRA for the current dates; these are agency obligations, not Cloud.gov's.
Meeting these retention minimums does not relieve your agency of other obligations, such as agency-specific or government-wide records schedules.
What Cloud.gov provides
Log retention
As of 2026-09-02, customer application logs are:
- Searchable for 6 months after creation, in Cloud.gov Logs.
- Retrievable for 12 months after creation, then deleted.
These figures describe customer application-layer logs — the logs your applications emit inside your Cloud.gov boundary.
Centralized log aggregation
- Customer application logs are forwarded by default to OpenSearch, encrypted in transit and at rest.
- Customer responsibility: to forward logs to your agency's SIEM, use
cf create-user-provided-serviceandcf bind-serviceto configure a syslog-TLS log drain.
Time synchronization
Log timestamps are synchronized against NIST time servers.
Fields captured
Cloud.gov automatically captures:
- Timestamp (UTC)
- Source and destination IPs
- User identity
- Action performed
- Response codes
- Service name
Application-level logging
Customer responsibility: ensure your applications emit structured JSON logs containing the fields your agency's logging plan requires.
FAQs
Q: How long can I search my logs? A: 6 months from creation. Logs remain retrievable for 12 months from creation; contact support@cloud.gov to retrieve logs older than the searchable window.
Q: Can I retain logs longer than 12 months? A: Yes. Configure a log drain to your own storage or SIEM, where your agency controls the retention period.
Q: Does Cloud.gov satisfy M-26-14 for my agency? A: Cloud.gov provides the platform capabilities described above for logs inside your boundary. Your agency is responsible for its own Agency Logging Plan, maturity assessment, and any logging outside Cloud.gov. Contact support@cloud.gov with specifics.
Q: How do we share logs with CISA or the FBI during an incident? A: Cloud.gov supports secure log export for authorized law enforcement and CISA requests. Contact support@cloud.gov.