On 20 August 2026 CISA published its Logging Reference Architecture, written to help federal agencies meet OMB Memorandum M-26-14. That memo, dated 22 May 2026, rescinded the 2021 logging memo M-21-31 after finding that retaining vast quantities of logs without clear use was neither feasible nor cost-effective. It replaced volume targets with a risk-based approach.
These rules bind federal agencies, not your company. But the baseline is a handy reference for how long to keep what.
What's affected
Under the memo's minimum baseline, logs must be actively searchable for at least 6 months to support continuous monitoring, and retrievable for a year to support investigation and forensics. Timestamps must be consistent, with time synchronized through NTP or an equivalent traceable source. Logs may be stored in several places, but must be readily available to the central security operations team.
Your equivalent is your identity provider, cloud audit trail, source control, CI/CD, remote access and production authentication logs.
What to do now
- List your five log sources that would matter in a breach: identity provider, cloud control plane, source control, CI/CD and production auth.
- For each, record the actual default retention. Check whether the tool keeps audit logs for a year or only for weeks, and whether you must export them.
- Pick a baseline you can afford. A reasonable small-company target, adapted from the federal baseline, is a few months searchable and twelve months in cheap storage.
- Send logs to one place that attackers with production credentials cannot edit or delete.
- Sync clocks and use UTC, so events from different systems line up.
- Check that logs do not capture secrets or personal data that you then keep for a year.
- Write the retention periods in your incident plan and in your records policy. Legal and contract duties may require longer.
| Log source | Why it matters in an incident |
|---|---|
| Identity provider | Who signed in, from where, MFA changes |
| Cloud control plane | Who created keys, changed roles, opened storage |
| Source control and CI/CD | Who pushed, who changed pipelines and secrets |
| Remote access and VPN | Entry points and session times |
| Production auth and admin actions | What users and staff touched |
Try it yourself
Pick one past incident or a near miss. Ask whether you could answer "who did what, and when" from the logs you have today, going back to the start.
Click through it at your own pace, or open it full screen.
Quick check
What is the difference between searchable and retrievable in M-26-14?
Searchable logs can be queried actively, for 6 months at minimum. Retrievable logs can be brought back for investigation, for a year at minimum.
