On May 22, 2026, the Office of Management and Budget issued Memorandum M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, and rescinded M-21-31 effective immediately. The memo is direct about why: some M-21-31 requirements, such as retaining vast quantities of logging data without clear utility, proved neither operationally feasible nor cost-effective for most agencies. In their place, it directs a risk-based, prioritized logging approach.
The clock is now running. CISA published its Logging Reference Architecture (LRA) on August 20, 2026, which set the memo’s deadlines: Agency Logging Plans are due November 18, 2026, Level 1 maturity by December 18, 2026, Level 2 by February 16, 2027, and Level 3 by July 6, 2027.
If you read our earlier post on M-21-31, its event logging tiers (EL0 through EL3) and its retention requirements no longer apply. This post covers what replaced them and where network flow fits.
One scope note: M-26-14’s requirements do not apply to national security systems or to the Department of Defense and Intelligence Community systems described in 44 U.S.C. § 3553(e). In practice it governs federal civilian executive branch agencies, which is the audience CISA’s LRA addresses.
What Changed
M-26-14 organizes logging around two objectives. Continuous Event Monitoring (CEM) covers the logs a SOC uses to monitor activity in real time, flag anomalies, and respond. Threat Hunting, Investigation, Response, and Forensics (THIRF) covers the logs needed to investigate after a known or suspected compromise, and the memo requires agencies to maintain sufficient hot and cold storage and the ability to retrieve and centralize data from multiple sources to map attack patterns.
Four other changes matter for network telemetry. Retention moves from M-21-31’s 12 months in active storage plus 18 months in cold storage for most log categories to a baseline of six months actively searchable and one year retrievable. Log storage may be decentralized, as long as logs are readily available to the agency’s top-level SOC. Maturity is measured on a five-level model (Level 0 through Level 4) across five elements, with overall maturity set by the lowest-scoring element. And IoT devices and operational technology are explicitly in scope, with the LRA required to provide guidance for IoT and OT that have no native logging capability.
M-21-31 set broad retention requirements. M-26-14 asks agencies to prioritize logs they can use. Enriched network flow is evidence built to be used.
Network Flow Is Written into the Baseline
Appendix B of the memo lists the minimum activities agencies’ logs must support. One of them, activity (b), reads like a definition of flow: determining source and destination network address information, including protocols, ports, and session attributes. Several others depend on the same evidence.
The table below maps NFO’s evidence to the Appendix B activities where network telemetry contributes. These rows are not compliance claims. Each describes evidence NFO supports collecting; meeting an activity depends on the agency’s logging plan and its full set of sources. Activity (k), generating automated alerts, happens in the SIEM, not in NFO.
| Appendix B activity | Network evidence NFO supports collecting |
| (a) Determining the identity used for operations | User identity added to flow records where an identity mapping exists, so network activity ties to an account |
| (b) Source and destination addresses, protocols, ports, and session attributes | The flow records themselves, parsed from NetFlow, IPFIX, sFlow, and J-Flow and normalized to a consistent schema |
| (e) Changes to IT/OT/IoT infrastructure | SNMP auto-discovery of network devices, plus new endpoints appearing in flow as they begin to communicate |
| (g) Known indicators of compromise | Threat intelligence and GeoIP/ASN context on each record, with newer indicators matched in the SIEM against stored history |
| (h) Anomalous system or user activity | Enriched records of who talked to what, when, and how much, for analysis in the SIEM |
| (i) Quantity and types of data affected during an incident | Byte and packet counts for each conversation, showing how much data moved and where; the types of data involved come from other sources |
| (j) Attack vectors, initial access, and lateral movement | Inbound, outbound, and internal (east-west) conversations across multi-vendor network devices |
Where Flow Moves the Maturity Score
The maturity model in Appendix C is where network flow has the most practical effect, in four of its five elements.
Collection Coverage is measured as the percentage of hardware and software assets in the inventory whose required logs are searchable and retrievable: 50 percent at Level 1, rising to 80, 90, and 95 percent. The hardest assets to cover are often the ones that cannot log themselves, which is why the memo calls out IoT and OT without native logging. Flow exported by the switches, routers, and firewalls around those devices records their network activity without touching them. Whether that meets the logging requirements for a given asset is a decision each agency documents in its logging plan, following the LRA.
Data Retention requires logs to be retained and retrievable for six months at Level 1 and twelve months at Level 2, with Level 4 requiring six months searchable and twelve retrievable. CISA’s LRA notes that the Appendix B baseline of six months searchable still applies regardless of maturity level. Raw flow is typically one of the largest data sources an agency produces, so retention cost is often where flow programs stall. NFO reduces flow volume by 80 to 90 percent, primarily through aggregation, which makes keeping network evidence searchable for six months practical.
Inventory Visibility measures the share of IT, OT, and IoT assets captured in a centralized hardware and software inventory. NFO’s SNMP auto-discovery inventories the network devices themselves, and flow shows which endpoints are active and communicating. That supports the inventory picture; it does not replace an agency’s HWAM and SWAM tools.
Collection Operations measures how much of the baseline is covered by actionable alerts. The alerts and detections live in the SIEM. Enriched flow provides the context many of those detections need, such as identity, application, and threat intelligence, without a separate lookup step.
Where NFO Fits in the Architecture
NetFlow Optimizer (NFO) collects NetFlow, IPFIX, sFlow, and J-Flow from multi-vendor network devices, enriches each record with user identity where a mapping exists, application, threat intelligence, and GeoIP/ASN context, reduces volume through aggregation, and delivers the result CIM-compliant to Splunk and other destinations. It is software, deployed on premises inside the agency’s boundary, and it can feed a centralized SIEM, a federated architecture, or both, matching the centralized, centralized-access, and hybrid options the memo describes.
One baseline requirement applies to network devices as much as to servers: logs must carry a consistently accurate timestamp, synchronized to a traceable time source. Flow timestamps come from the exporting devices, so their clocks belong in the agency’s time-synchronization plan.
As always, NFO does not detect, alert, or decide what is malicious. It collects, enriches, reduces, and delivers. Monitoring, hunting, and response happen in the SIEM. Splunk has published its own view of the memo, and NFO is built to make network evidence usable there.
The Bottom Line
M-26-14 rescinded M-21-31 and replaced its broad retention requirements with a risk-based model built around continuous monitoring and threat hunting. Network flow is written into its minimum baseline, it reaches IoT and OT devices that cannot log themselves, and it is often one of the largest retention costs an agency carries. NFO supports evidence collection for those requirements by delivering enriched, reduced, CIM-compliant flow to the SIEM, so agencies can keep network evidence searchable for the full baseline and use it for both CEM and THIRF.
Agency Logging Plans are due November 18, and Level 1 maturity follows on December 18. Make sure network flow is in both.
Want to see how network flow fits your Agency Logging Plan? Start a free 60-day trial of NetFlow Optimizer or schedule a technical demo with a NetFlow Logic engineer who works with federal networks.
Start Free Trial | Schedule a Demo | Government Solutions | NFO Documentation