In late August, the Cybersecurity and Infrastructure Security Agency (CISA) published their Logging Reference Architecture (LRA), a practitioner-focused guide for how federal civilian agencies should design and operate their logging systems.

CISA developed the LRA at the direction of Office of Management and Budget (OMB) Memorandum M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, which took effect in May 2026 and replaced the Biden Administration's earlier logging directive, M-21-31.

CISA notes that the LRA is not a new policy or a compliance checklist, but a design reference that helps agency architects turn M-26-14's requirements into working systems. CISA is explicit that the document does not prescribe specific vendor products, schemas, or technical stacks, and it does not expand CISA's authority beyond what M-26-14 already grants. Instead, it is intended to help agencies build and document their required Agency Logging Plans.

Two Outcomes Drive Every Decision

OMB’s M-26-14 sets two priority objectives around which agencies must design their logging capabilities. The first is Continuous Event Monitoring (CEM), the ability to “monitor network activity in real time” and flag problems quickly. The second is Threat Hunting, Investigation, Response, and Forensics (THIRF), the ability to dig into historical data after a suspected compromise to figure out what happened and fix it. The LRA breaks THIRF into three connected functions: threat hunting, incident response, and digital forensics.

Every architectural recommendation in the document ties back to one of these outcomes. That includes what data agencies collect, how that data moves through their systems, how long it is retained, and how agencies prove the whole system actually works when needed.

Six Areas Where Agencies Must Make Decisions

The LRA organizes agency choices into six areas: what telemetry to collect, how to collect it, how to move it through the infrastructure, how to normalize and enrich it, how to store and retain it so it stays searchable and unaltered, and how to enforce policy and validate that the system performs as intended.

A recurring theme across all six areas is provenance. CISA wants agencies to know, for any given log record, where it came from, when it was generated, and what happened to it along the way. Agencies are told to favor authoritative source records over summarized or downstream copies whenever accuracy and investigative value are on the line.

AI Gets a Cautious Green Light

The LRA dedicates a full section to using Artificial Intelligence (AI) and machine learning to help agencies keep up with the volume of security data they generate. CISA sees clear value in AI for tasks such as anomaly detection, alert prioritization, event correlation, and “summarization of large investigative datasets.” But the document is careful to frame AI as an optional tool for improving CEM and THIRF, not a substitute for the underlying telemetry or required human judgment.

Agencies using AI in their logging pipeline must document the use case, the data feeding it, how they validate its outputs, where a human has to review before action is taken, and what happens if the AI tool fails or produces unreliable results. This lines up with OMB's existing AI governance memo, M-25-21, and agencies must treat any AI capability that qualifies as "high-impact" under that memo with the same oversight given to other high-impact AI systems.

LRA as a Maturity Model, Not a One-Time Fix

CISA does not expect every agency to arrive at full compliance overnight. The LRA lays out a three-stage maturity progression tied to the five elements in M-26-14's own maturity model: Inventory Visibility, Collection Coverage, Collection Operations, Data Retention, and Log Management. Agencies starting from fragmented, compliance-driven logging are pointed toward closing their biggest coverage gaps first, while more mature agencies are pointed toward improving fidelity, enterprise visibility, and long-term validation.

What CISA’s LRA Means for Contractors

The LRA explicitly states that its scope covers systems operated on behalf of an agency, including those run by contractors, managed service providers, and other third parties. Agencies are directed to hold these delegated environments to the same logging, retention, and visibility standards as their own internal systems. Contractors running any part of an agency's IT environment, including cloud-hosted or managed security services, should expect logging and data-retention requirements to show up in new contract language and recompetes tied back to this architecture.

The document also signals where near-term agency spending is likely headed. Agencies working through the maturity stages will need help closing baseline coverage gaps, standing up or upgrading Security Information and Event Management (SIEM) and log-management platforms, building normalization and schema governance processes, and validating that their pipelines hold up under real incident conditions. Contractors offering AI-enabled security analytics have an opening here as well, but the LRA's governance expectations mean those offerings need built-in traceability, human review checkpoints, and documented fallback procedures to be a fit for agency use.

Because the LRA avoids naming specific products or platforms, it will not point directly to any particular vendor. What it does is describe, in detail, are the operational outcomes agencies will be evaluating proposals against. Contractors who can speak to those outcomes, rather than just features, are better positioned as agencies work through their Agency Logging Plans over the next several budget cycles.