By Event Logging Is Open at 19 Agencies, and Contractor-Run Systems Count
GAO told 19 agencies to fully implement federal event logging requirements, and all 19 recommendations were still open as of June 2025. OMB's new logging memo covers systems third parties run on an agency's behalf, which puts contractor-operated systems inside the next round of agency logging plans.
In December 2023, GAO told 19 civilian agencies the same thing: fully implement all event logging requirements as directed by OMB guidance (opens in a new tab). As of GAO's June 2025 status notes, every one of the 19 recommendations was still open.
Most coverage of that finding treats it as an agency problem. A line in OMB's new logging memo makes it a contractor problem too. If your company runs hosting, applications, or infrastructure for one of these agencies, the systems you operate are part of what the agency now has to log.
The Memo Reaches Systems Contractors Run
OMB issued M-26-14 (opens in a new tab) on May 22, 2026. It is a non-GAO directive, and it rescinds the 2021 memo GAO measured agencies against. Its scope sentence is the one capture teams should read twice: each agency must pursue the memo's logging objectives (opens in a new tab) for "all information systems owned or operated by the agency or by third parties on the agency's behalf," including IoT devices and operational technology that are part of those systems.
The memo does not apply to national security systems, or to Defense and Intelligence Community systems covered by a separate provision of the law. For the civilian agencies in GAO's report, though, contractor-operated systems sit inside the same plan as agency-run ones.
That plan has a date. CISA published its Logging Reference Architecture in August 2026, and each agency must submit its Agency Logging Plan to OMB and CISA by November 18 (opens in a new tab). The architecture spans identity, endpoint, network, application, cloud, IoT, and operational technology sources. Few of those exist only on systems the agency runs itself.
Nineteen Agencies, One Recommendation
GAO made 20 recommendations in GAO-24-105658. One went to CISA, to update its incident and vulnerability response playbooks, and GAO closed it after verifying the update. The other 19 use identical wording, one per agency.
| Agency | Event logging recommendation, as of GAO's June 2025 update |
|---|---|
| Commerce, Education, Energy, HHS, DHS | Open |
| HUD, Interior, Justice, Labor, State | Open |
| Transportation, Treasury, VA | Open |
| EPA, GSA, NASA | Open |
| NRC, OPM, SSA | Open |
For each one, GAO's note reads the same way: the agency "has not provided sufficient evidence to close this recommendation." Those notes predate M-26-14, so how GAO will judge closure against the new memo is still an open question.
The underlying numbers explain why the list is so long. As of August 2023, the month agencies were due to reach the old top tier, 17 of the 23 civilian CFO Act agencies were at the lowest tier. Agencies told GAO they lacked staff, faced technical challenges with event logging, and had limited cyber threat information sharing.
What an Operations Contract Now Carries
Read against the new memo, a hosting or operations contract at one of these agencies picks up a set of logging obligations whether or not the current performance work statement names them:
- Sources. The agency has to account for the log sources on systems you operate, by the categories CISA's architecture uses.
- Retention. Logs must stay searchable for six months and retrievable for a year.
- Access. After a known or suspected compromise, agencies must give logs to CISA and the FBI on request, and the scope sentence means that request can reach systems a contractor runs.
- Maturity. From the architecture's release, agencies have 120 days to reach at least Level 1 across the memo's five maturity elements, 180 days for Level 2, and 320 days for Level 3.
Our Technical Brief on the event logging recommendation at VA, HHS, DHS, and GSA covers those deadlines and the maturity elements in more detail.
Where It Shows Up in Capture
Recompetes written after November are likely to carry logging language the last solicitation never had. Expect it in three places.
The performance work statement is the obvious one. A requirement to onboard defined log sources to the agency's platform, keep them searchable for six months, and report against the agency's logging plan turns into a deliverable with a schedule.
The cost volume is easier to miss. Ingest and storage have real prices, and an offer that assumes the agency absorbs them may not match a requirement that puts them on the contractor. Sizing ingest from measured volumes, with a growth model, keeps the price defensible.
Transition is the third. An incoming contractor inherits the outgoing contractor's log sources, or the gaps in them. A transition plan that inventories sources and coverage in the first weeks gives the agency an early, concrete step toward its own plan.
Four things are worth pinning down before the draft RFP lands:
- Whether the agency's logging plan names the systems this contract covers.
- Which platform receives the logs, and who pays for ingest and storage.
- The retention tiers the plan sets for these systems.
- Who produces the maturity evidence for this contract's systems.
Where Avalon Fits
Avalon's Enterprise Monitoring white paper describes the work behind those answers: inventorying monitoring tools and telemetry coverage against the asset inventory, baselining collection, retention, and searchability against the agency's M-26-14 plan, sizing ingest before it sizes the bill, and onboarding log sources against an agreed source matrix. The agency's plan submission and maturity reporting stay with its CISO, and the work does not certify compliance.
If operations, hosting, or cloud work at one of these 19 agencies is in your capture plan, Avalon teams as the sub that inventories the log sources your contract will own and builds the retention and evidence the agency's logging plan needs from them.
