What Is OMB M-21-31? Logging Tiers, Deadlines, and SIEM Rules

OMB M-21-31 is a federal memorandum, issued by the Office of Management and Budget on August 27, 2021, that sets mandatory cybersecurity event logging standards for executive branch agencies. It tells agencies what system activity to log, how to format and timestamp the entries, how long to keep them, how to protect them, where to centralize them, and how to hand them over to federal investigators when an incident occurs.¹

Why the Memo Exists

The memo is a direct response to the SolarWinds supply chain compromise. When investigators tried to reconstruct attacker activity across affected agencies, many didn’t have the logs. Some agencies had discarded them. Others kept records in formats that couldn’t be correlated across systems.²

President Biden signed Executive Order 14028 on May 12, 2021, and section 8 of that order addressed logging, log retention, and log management directly. M-21-31 translates section 8 into concrete standards, with a heavy emphasis on giving each agency’s top-level security operations center centralized visibility.¹

The Four Maturity Tiers and Their Deadlines

The memo grades each agency’s logging capability across four tiers, and each tier has a hard deadline attached.

EL0 (Not Effective): the agency does not meet, or only partially meets, the highest-criticality logging requirements. This is the baseline the memo is meant to eliminate.
EL1 (Basic): only the highest-criticality logging requirements are met. Deadline: August 2022, one year after issuance.
EL2 (Intermediate): both highest-criticality and intermediate-criticality requirements are met, with cross-organizational analysis capability. Deadline: February 2023.
EL3 (Advanced): logging requirements at all criticality levels are met, with logs accessible to the agency’s top-level security operations center. Deadline: August 2023.

A December 2023 Government Accountability Office study found that most agencies were not on track to meet the advanced logging deadline.¹

What Has to Be Logged

Appendix C of the memo lays out specific categories of system activity and assigns each a criticality level that determines the tier at which it becomes mandatory. The major categories include:

Identity and credential management: account creation and deletion, credential changes, privilege assignments, credential usage.
Privileged account activity: provisioning, privilege escalation, delegation, privileged session monitoring.
Network device infrastructure: DHCP lease data, DNS queries and responses (including passive DNS), Wi-Fi logs, router and switch activity, proxy and load balancer records.
Email filtering: IP and domain reputation data from mail server connections.
Operating systems: Windows, macOS, and Linux/BSD.
Cloud environments: AWS, Azure, GCP, and general cloud platform logging.
Application and database activity: web applications, middleware, custom and commercial applications.
Container and virtualization systems: supply chain events, cluster and pod activity, image scanning, engine-level logs.
Network traffic: full packet capture (with a shorter retention window than other categories).
Mobile devices: enterprise mobility management and mobile threat defense logs.

Passive DNS is worth calling out because it catches agencies off guard at the basic tier. At EL1, agencies must implement DNS logging that captures every request, including those made over encrypted connections, and run analytics that quickly identify which host originated each query. Agencies are also expected to automatically generate and share with CISA a list of frequently accessed hostnames unique to their environment that don’t appear on general top-domain lists.¹

Formatting, Timestamps, and Integrity

Every log entry has to carry a minimum set of fields so records from different systems and different agencies can be correlated during an investigation. Appendix A specifies these: a properly formatted timestamp, a status code for the event type, a device identifier such as a MAC address, session or transaction ID, source and destination IP addresses in both IPv4 and IPv6, response time, and relevant headers. Where applicable, the username or user ID and the command executed must also appear. The memo encourages formatting all data as key-value pairs to make automated extraction easier.¹

Timestamps must follow ISO 8601 and RFC 3339, expressed in Coordinated Universal Time, with millisecond precision. Agencies must synchronize clocks against a GPS master station reference. If GPS isn’t feasible, NIST’s authenticated time service is the acceptable fallback. Public, unauthenticated NTP pools are only permitted as a last resort and only temporarily while the agency transitions to a better source.¹

Log integrity is enforced through cryptographic protections and operational controls. Closed log files must be verified with integrity-checking mechanisms, and those checks have to run periodically and on access throughout the retention period. Agencies must apply access controls that limit who can view or modify log files, back current logs up promptly to a centralized server or write-once media, and document who accesses logs. Monitoring traps have to watch the logging data streams themselves, and when logging stops unexpectedly, alerts must go out in near real-time to the responsible parties for immediate investigation.¹

How Long Logs Must Be Kept

Retention rules apply uniformly across criticality levels. Agencies must hold logs in active, warm storage for at least 12 months, so investigators can query them quickly. After that, data has to remain in cold storage for another 18 months. That totals a 30-month minimum.¹

Full packet capture is the one significant exception, given how much storage it consumes. Packet captures only need to be retained for 72 hours. These retention numbers are floors. Agencies can hold data longer if their risk profile or mission calls for it.

Centralization and the SIEM Requirement

Logs can’t sit scattered across siloed systems. Agencies must forward required logging data on an automated basis and in near real-time to centralized platforms that handle security monitoring, bulk storage, and analytical workflows. In practice this means a Security Information and Event Management (SIEM) system or an equivalent centralized log manager.¹

Centralization scales with the tiers. At EL1, logs flow to a component-level Enterprise Log Manager, with disruption traps monitored by the component-level security operations center. At EL2, all highest- and intermediate-criticality logs must be visible to the agency’s top-level security operations center, and cross-organizational analytics must be running across components. At EL3, logs across every criticality level are accessible to that top-level center. Container security tools must also feed into the agency’s SIEM so that container events aren’t lost in a separate monitoring stack.

Sharing Logs with CISA and the FBI

When an incident occurs, agencies must provide relevant logs to the Cybersecurity and Infrastructure Security Agency and the Federal Bureau of Investigation upon request, to the extent consistent with applicable law. The memo treats this sharing as central to defending federal information systems rather than as optional cooperation.¹

The centralized architecture exists partly to make that sharing feasible. If logs are fragmented across dozens of isolated systems, producing them during an active investigation becomes the bottleneck that delays the entire federal response. With automated forwarding to a central platform, the agency’s security operations center should already have the data aggregated and queryable when the request arrives.

Where Cloud Providers Fit

M-21-31 does not apply directly to commercial cloud service providers. It reaches them through FedRAMP. Cloud offerings that hold FedRAMP authorization must support their federal customers in meeting M-21-31 requirements inside the cloud environment. FedRAMP wrote these obligations into its Rev. 5 security baselines through specific controls, including AC-4(4) for information flow enforcement, AU-11 for audit record retention, and SI-4(10) for system monitoring visibility.³

The practical effect is that a provider whose platform can’t expose the necessary logs, support 30-month retention, or forward data to an agency SIEM puts its FedRAMP authorization at risk. Major providers have built out logging capabilities specifically to help agencies meet these requirements.

Where Agencies Are Struggling

The gap between what the memo requires and where most agencies stand is real. Storage costs alone are substantial: 30 months of logs across every system category, at the required granularity, generates enormous data volumes. Full packet capture, even with the 72-hour window, can overwhelm agencies that lack high-throughput recording infrastructure.

The Technology Modernization Fund is one funding path agencies can use to offset modernization costs, with flexible, incremental disbursements tied to project milestones. As of recent reporting, the TMF has invested over $1.05 billion across 70 projects at 34 federal agencies, though not all of those projects are M-21-31 specific.⁴

The technical lift is also real. Many agencies run legacy systems that were never designed to produce logs in the formats the memo requires. Retrofitting those systems, or standing up parallel logging infrastructure around them, takes time and specialized expertise. Passive DNS at EL1 is a good illustration: agencies need not just the capture capability but the analytics layer on top to identify anomalous hostnames and share that data with CISA on a daily automated basis. For agencies that were still at EL0 when the memo dropped, EL3 within two years was always going to be ambitious.

1
Office of Management and Budget. OMB M-21-31 – Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents
2
U.S. Government Accountability Office. Federal Response to SolarWinds and Microsoft Exchange Incidents
3
FedRAMP. FedRAMP Guidance for M-21-31 and M-22-09
4
Technology Modernization Fund. Technology Modernization Fund