The SolarWinds breach happened in 2020. The Biden administration's logging mandate, M-21-31, arrived nine months later as the federal government's institutional memory of that wound was still fresh. Now, five years on, OMB Director Russell Vought has rescinded it — effective immediately — and replaced it with something structurally different, philosophically distinct, and operationally incomplete for at least the next six months.
That gap deserves more attention than it's getting.
What M-21-31 Actually Was (And Why It Creaked)
M-21-31 was a compliance ladder. It defined four maturity tiers — EL0 through EL3 — and required agencies to climb them in sequence, logging progressively more event types with progressively more retention and faster retrieval capability. The theory was sound: establish a floor, raise it incrementally, improve the federal baseline over time.
The practice was messier. In August 2023, the GAO documented that more than a dozen agencies still hadn't cleared the most basic tier requirements. The blockers were familiar — understaffed security teams, fragmented infrastructure, and log volumes that outpaced both storage budgets and analyst bandwidth. Agencies were drowning in telemetry they couldn't query, retaining logs nobody had time to read, and calling that compliance.
The maturity model was designed for a threat landscape that moved at human speed. Attackers gathering intelligence over weeks, pivoting manually, operating during business hours in time zones that gave defenders overlap. That world is receding.
The problem with prescribing what to log is that adversaries adapted to what defenders were watching. The problem with prescribing how long to keep it is that storage costs became political justification for not doing anything else.
CEM and THIRF: What the New Framework Actually Says
M-26-14 replaces the four-tier model with two operational objectives, and the framing matters.
Continuous Event Monitoring (CEM) is real-time network visibility feeding directly into Security Operations Centers. The emphasis is on live detection — catching adversary behavior as it happens rather than reconstructing it after the fact. This is the "don't let them get comfortable" objective.
Threat Hunting, Investigation, Response, and Forensics (THIRF) covers the post-compromise layer — the forensic reconstruction work that lets agencies understand what happened, how far an intrusion went, and what data moved where. This is the "understand the breach when prevention failed" objective.
The architectural logic here is actually coherent. Rather than asking agencies to collect everything and organize it into tiers, the new framework asks agencies to answer two questions: what are you watching right now, and what can you reconstruct when something goes wrong? Those are the questions incident responders actually care about. Elastic's federal team has made this point publicly — that mass log retention without analytical purpose isn't security, it's expensive filing.
The memo's explicit rationale for this shift is the one detail that most news coverage has glossed over: M-26-14 names AI as the primary threat accelerant. The document warns that adversaries are using AI and automation to "rapidly gain unauthorized access, move laterally, and maintain illicit access undetected." That's not boilerplate. That's the memo's own justification for urgency.
The 180-Day Blind Spot
Here is the operational problem, stated plainly.
M-21-31 is rescinded as of May 22, 2026. CISA has 90 days to publish the new Logging Reference Architecture, and agencies have another 90 days after that to submit updated operational plans. Technically, the federal government isn’t flying entirely blind; M-26-14 mandates basic interim survival guardrails—like keeping searchable logs for at least six months—while the new architecture is cooked up. But the new standard governing what agencies should actually implement dynamically doesn’t exist yet, and won’t for roughly half a year.
This creates a highly precarious window where:
- The old, predictable compliance tiers are gone
- The permanent, modernized requirements aren't written
- Long-term budget justifications for logging infrastructure have lost their firm regulatory anchor
- Agency CISOs face the classic bureaucratic nightmare of defending robust security spending against a fluctuating, transitional mandate
Nick Leiserson, a former Biden administration cyber official, put it bluntly: this is moving "from something to nothing." That characterization may be slightly unfair to the framework's temporary floor, but it is entirely accurate about the practical vacuum gripping agency planning over the next 180 days.
The risk isn't that M-26-14 is a bad architecture. It may well be a better one. The risk is the operational lag between immediate rescission and final implementation—a gap that lands during a period when AI-enabled threat actors are operating at speeds that make six-month policy timelines look geological.
AI-Accelerated Threats Aren't Theoretical Anymore
The memo's AI threat language would be easier to dismiss if it weren't landing alongside documented real-world incidents.
Anthropic disclosed earlier this year that a Chinese state-sponsored group used Claude Code agentically — autonomously conducting intrusion operations without requiring human direction at each step. Google's GTIG separately reported a threat actor deploying an AI-developed zero-day exploit. These aren't red team exercises or proof-of-concept demonstrations. These are operational attack chains.
The significance for logging is direct. When an adversary moves laterally using an AI agent that generates novel tradecraft on each hop, traditional signature-based detection fails. The only reliable detection surface becomes behavioral telemetry — the patterns of authentication events, process executions, network flows, and privilege escalations that CEM is specifically designed to surface. The gap between "we have the logs" and "we're watching them in real time" has never been more consequential.
THIRF matters equally here. When AI-assisted attackers maintain persistence undetected for extended periods, forensic reconstruction becomes the difference between understanding a breach and managing a permanent blind spot. Agencies that use the next 180 days to deprioritize log retention budgets — citing the absence of a governing mandate — will pay for that decision during the next incident response engagement.
What Federal CISOs and Contractors Should Do Right Now
The practical question for anyone operating in federal environments isn't whether M-26-14 is good policy. It's how to operate in the gap.
A few concrete orientations:
- Treat CEM as the non-negotiable baseline today. The new framework's prioritization of real-time SOC visibility is coherent — implement it against your existing infrastructure now, before the LRA arrives. You won't be wrong, and you'll have demonstrable progress when the mandate lands.
- Document your THIRF capability honestly. Identify what you can reconstruct, how far back, and at what fidelity. That audit will be required when agencies submit updated plans. Doing it now finds gaps before regulators do.
- Don't let budget cycles eat the gap. FY2027 planning is happening now at most agencies. The absence of an active mandate creates political space to cut logging line items. That decision will be defensible until the first post-gap incident, at which point it will be indefensible.
- Watch the LRA draft process. CISA's 90-day clock started May 22. The reference architecture will define what CEM and THIRF mean operationally — what log sources qualify, what retention periods apply, what SOC integration looks like. Public comment periods matter here and the vendor community should engage them.
Final Thoughts
M-26-14 is not a deregulation move dressed up as modernization. The threat rationale in the memo is genuine, the CEM/THIRF architecture is operationally grounded, and the criticism of M-21-31's compliance-theater tendencies is fair. A framework that asks agencies to watch their networks and be able to reconstruct compromises is more honest than one that asks them to store terabytes of logs nobody queries.
But the timing is the problem. Rescinding immediately while the replacement takes six months to materialize is a real risk in a real threat environment. Federal agencies and their contractors should treat this interval not as regulatory breathing room, but as a period requiring heightened defensive discipline precisely because the external accountability structure has temporarily gone dark.
The attackers' timelines did not pause for the memo transition. Neither should yours.