By GAO told VA, HHS, DHS, and GSA to fully implement federal event logging requirements, and none had closed the recommendation as of GAO's last updates. OMB has since replaced the rules, and the new logging plans are due November 18, 2026.
In December 2023, GAO reported on how the 23 civilian CFO Act agencies were meeting federal incident response requirements. The report, Cybersecurity: Federal Agencies Made Progress, but Need to Fully Implement Incident Response Requirements (opens in a new tab) (GAO-24-105658), measured each agency against the event logging tiers in OMB's 2021 memo M-21-31.
The results were lopsided. As of August 2023, the month agencies were due to reach the top tier, three of the 23 agencies were at tier 3. Of the remaining 20, three were at the basic tier 1 level and 17 were at tier 0, which the memo defines as not effective.
GAO made 20 recommendations to 19 agencies, chiefly to fully implement event logging requirements as directed by OMB guidance. VA, HHS, DHS, and GSA each received one. In its June 2025 status notes, GAO said none of the four had provided sufficient evidence to close it, and the same recommendation appears again in the VA CIO open recommendations letter (opens in a new tab) of January 2026.
Agencies gave GAO three obstacles: a lack of staff, event logging technical challenges, and limits on cyber threat information sharing. None of them is quick to fix inside one budget year.
The old rules also made the target expensive. M-21-31 required agencies to keep logs at every criticality level for 12 months in active storage and another 18 months in cold storage. For a department with hundreds of systems, that is a large ingest and storage bill sized before anyone decided which logs mattered most.
Then the target moved. On May 22, 2026, OMB issued M-26-14 (opens in a new tab), a non-GAO directive that rescinds M-21-31 effective immediately.
The EL0 to EL3 tiers are gone. In their place is a five-level maturity model scored across five elements: inventory visibility, collection coverage, collection operations, data retention, and log management. Retention now follows two objectives instead of one rule: logs must stay searchable for six months to support continuous event monitoring and retrievable for a year to support threat hunting, investigation, response, and forensics.
GAO's status notes for these four departments predate the new memo. The underlying gap does not. Our roadmap for logging under M-26-14 covers the memo's requirements for CISOs and ISSMs in more depth.
M-26-14 starts new clocks, and they run through the next round of task orders. CISA published its Logging Reference Architecture in August 2026, and agencies must submit an Agency Logging Plan to OMB and CISA by November 18 (opens in a new tab). From the architecture's release, the memo gives agencies 120 days to reach at least Level 1 across all five elements, 180 days for Level 2, and 320 days for Level 3.
That puts logging next to almost any operations, cloud hosting, or monitoring buy at VA, HHS, DHS, or GSA, because every workload a contractor runs produces log sources the department has to inventory, collect, and retain. Evaluators know the open list. A generic O&M approach reads as a gap. A technical volume that explains how the work will onboard sources, meet the six-month searchable baseline, and hand the CISO maturity evidence reads as understanding of the requirement.
Transition plans are the other pressure point. Cloud migrations often finish without monitoring parity, and the operations team that understood the data center may not see the new environment at all. A prime that brings a defined method for that gap has something specific to put in front of the board.
The method below comes from Avalon's Enterprise Monitoring service. It describes how the work is done, at the methodology level.
The department's logging plan submission and maturity self-reporting stay with its CISO. Analyzing the logs for threats, and investigating a suspected compromise, are separate security work. This work builds capability and evidence; it does not certify compliance.
GAO has not yet published closure evidence for any of these four recommendations, so the measures below are targets, taken from the current memo:
Whether GAO will close its recommendation against the new memo, or ask for something more, is GAO's call.
The recommendation was open at all four departments as of GAO's June 2025 status update.
| Department | Where GAO lists it | Status | As of |
|---|---|---|---|
| VA | GAO-24-105658; VA CIO letter GAO-26-108706 | Open | January 2026 |
| HHS | GAO-24-105658 | Open | June 2025 |
| DHS | GAO-24-105658; DHS CIO letter GAO-25-108460 | Open | July 2025 |
| GSA | GAO-24-105658; GSA CIO letter GAO-25-108537 | Open | July 2025 |
| Field | Detail |
|---|---|
| NAICS | 541512, 541519 |
| Avalon's sub role | Log-source inventory, M-26-14 maturity gap analysis, and retention architecture under the prime's IT operations or monitoring task order |
| Small-business status | Small business; HUBZone (in progress) |
| Likely vehicles | GSA MAS (SIN 54151S IT Professional Services); GSA Alliant 3; VA T4NG2 |
If operations, cloud, or monitoring work at VA, HHS, DHS, or GSA is in your capture plan, Avalon teams as the sub that inventories the log sources, scores them against M-26-14, and designs the retention architecture behind the department's logging plan.
