M26-14 Logging Plan Template
The template has 31 subsections and 165 sub-subsection items across its nine major sections.
Major section | Subsections | Sub-subsection items |
1. Executive Summary and Strategic Intent | 2 | 17 |
2. Governance, Scope, and Accountability | 4 | 19 |
3. CEM and THIRF Strategic Outcomes | 3 | 14 |
4. Baseline Logging Strategy and Coverage Posture | 4 | 14 |
5. Mission/Risk-Based Prioritization | 3 | 17 |
6. Enterprise Logging and Data Strategy | 4 | 17 |
7. Security, Privacy, Integrity, and Resilience | 4 | 17 |
8. Validation, Maturity, and Performance | 4 | 22 |
9. Gaps, Roadmaps, Review, and Submission | 3 | 28 |
Total | 31 | 165 |
1. Executive Summary and Strategic Intent
1.1 Summary
Mission Context
Threat Environment
Current Posture
Target Posture
Principal Decisions
1.2 Strategic Priorities
Each of the three priority entries contains:
Priority 1 | Priority 2 | Priority 3 |
Outcome | Outcome | Outcome |
Rationale | Rationale | Rationale |
Accountable Executive | Accountable Executive | Accountable Executive |
Target Milestones | Target Milestones | Target Milestones |
2. Governance, Scope, and Accountability
2.1 Plan Ownership and Approval
Plan Ownership
Accountable Executives
Participating Organizations
Approval Authority
Governance Body
Decision Rights
2.2 Scope and Applicability
In-Scope Boundaries
Material Exclusions or Deferrals
Rationale
Accountable Owner
Planned Disposition
2.3 Inventory and Coverage Governance
Authoritative Inventory Sources
Coverage Governance
Reporting Approach
Known Limitations
2.4 Review Cadence and Change Triggers
Review Cadence
Update Triggers
Approval Workflow
Revision History Expectations
3. CEM and THIRF Strategic Outcomes
3.1 CEM Strategy
CEM Strategic Outcomes
Priority Mission Services
Timeliness Expectations
Governance Decisions
Key Dependencies
3.2 THIRF Strategy
Threat Hunt Strategic Outcomes
Incident Response Strategic Outcomes
Forensics Strategic Outcomes
Reconstruction & Recovery Needs
Evidence Expectations
Key Dependencies
3.3 CEM and THIRF Integration
Integrated Operating Model
Enterprise Access Expectations
Major Cross-Functional Coordination Decisions
4. Baseline Logging Strategy and Coverage Posture
4.1 Enterprise Coverage Posture
Current Enterprise Coverage Posture
Authoritative Coverage Evidence
Material Blind Spots/Visibility Gaps
Highest-Priority Coverage Decisions
4.2 Searchability, Retrieval, and SOC Availability
Agency Retention Posture
Enterprise Access Approach
Longer-Duration Requirements
Material Constraints
4.3 Minimum Fidelity and Usability
Strategic Fidelity Standards
Source-Native Recovery Expectations
Known Fidelity Gaps
Ownership
4.4 Above-Baseline Enhancements
Summary of Above-Baseline Enhancements
Mission/Risk Rationale for Each
5. Mission/Risk-Based Prioritization
5.1 Mission, Threat, and Risk Profile
Mission-Critical Services
Representative Threat Scenarios
Risk Drivers
HVA/HIS Considerations
Major Visibility Gaps
5.2 Strategic Above-Baseline Decisions
Above-Baseline Decisions
Scope
Justification
Accountable Owner
Validation Expectation
Target Milestone
5.3 Artificial Intelligence-Enabled Capabilities
Authorized AI-Enabled Purposes
Governance
Validation
Human Review
Fallback
Boundaries (or state N/A)
6. Enterprise Logging and Data Strategy
6.1 Enterprise Visibility and Access
Enterprise Visibility Model
Central SOC Access Approach
Delegated Responsibilities
Material Access Dependencies
6.2 Retention, Search, and Retrieval Strategy
Strategic Retention and Tiering Approach
Retrieval Expectations
Cost or Scale Constraints
Governing Authorities
6.3 Data Usability, Normalization, and Source Context
Enterprise Data-Usability Principles
Source-Context Preservation
Schema Governance
Known Interoperability Gaps
6.4 Portability, Interoperability, and Authorized Sharing
Portability Principles
Authorized-Sharing Governance
Approval Authority
Expected Timeframes
Documentation Requirements
7. Security, Privacy, Integrity, and Resilience
7.1 Protection of the Logging Capability
Strategic Protection Model
Accountable Control Owners
Key Exceptions
Assurance Approach
7.2 Integrity, Provenance, and Evidentiary Handling
Designated Datasets
Required Integrity or Evidentiary Outcomes
Governance
Validation Expectations
7.3 Privacy, Minimization, and Access Restrictions
Privacy and Minimization Principles
Sensitive-Data Access Model
Related Authorities
Unresolved Constraints
7.4 Resilience and Recovery
Resilience Objectives
Degraded-Mode Expectations
Recovery Priorities
Material Fragilities
Accountable Owners
8. Validation, Maturity, and Performance
8.1 Evidence-Based Validation Strategy
Validation Governance
Frequency
Evidence Standards
Accountable Owners
Authoritative Location of Test Results
8.2 Operational Readiness Demonstrations
Readiness Demonstrations
Cadence
Participating Organizations
Evidence to Be Retained
Remediation Process
8.3 Maturity Assessment and Targets
Current Maturity by Element
Target Maturity by Element
Target Maturity by Target Date
Target Maturity by Executive Owner
Largest Barriers
Largest Dependencies
Largest Assumptions
8.4 Performance Measure and Executive Reporting
Executive Measures
Reporting Cadence
Thresholds
Escalation Paths
Decision Forums
9. Gaps, Roadmaps, Review, and Submission
9.1 Material Gaps and Improvement Roadmap
Each of the three priority gap entries contains:
Priority Gap 1 | Priority Gap 2 | Priority Gap 3 |
Affected Outcome | Affected Outcome | Affected Outcome |
Risk/Impact | Risk/Impact | Risk/Impact |
Owner | Owner | Owner |
Dependencies | Dependencies | Dependencies |
Milestone | Milestone | Milestone |
Measurable Completion Condition | Measurable Completion Condition | Measurable Completion Condition |
9.2 High-Level Readiness Statement
Agency Readiness Conclusions
Material Reservations
Approval Conditions
9.3 Review, Update, and Submission Commitments
Submission Commitments
Approvers
Submission Owner
Due Date
Channel
Supporting Artifacts
Next Scheduled Review
Provenance: source event times, ingest times, and unmodified fields are preserved, so each record can be traced to its origin and handling.
Transformation integrity: KQL transformations are governed, and SIEM schema-drift monitoring detects changes that would otherwise go unnoticed.
Privileged access accountability: query auditing and administrative-action auditing record who accessed or changed logging data and the logging infrastructure.
Integrity in transit: transport is encrypted, with the documented syslog exception covered by compensating controls.
Comments