Federal agencies are moving from broad cybersecurity requirements toward more deliberate, measurable approaches to identity, logging, and operational visibility. During the GovExec webcast, “Take Note: How NSPM-12 and OMB’s Logging Directive are Reshaping Federal Cybersecurity,” government and industry experts examined how agencies can translate new mandates into practical cybersecurity operations.
Bringing Government and Industry Perspectives Together
Advanced Technology Academic Research Center (ATARC) moderator Tom Suder led a webcast discussion with Patrick Donahue, chief information security officer of FEMA; Amir Dastouri, chief information security officer of FERC; and Dr. Steve O’Dell, senior director of Civilian & Health national security at ASRC Federal. The panel combined first-hand government CISO perspectives with the implementation experience of an industry integrator.
The Differences Between NSPM-12 and OMB M-26-14
The panel emphasized that NSPM-12 and OMB M-26-14 address different parts of the federal technology environment. OMB M-26-14 excludes national security systems, while NSPM-12 provides the governance framework for resetting cybersecurity expectations for those systems.
Understanding that distinction is essential for agency leaders. The applicable mandate, system type, mission requirements, and risk profile all influence how an organization establishes logging priorities and implementation plans.
Moving From Requirements to Risk-Based Implementation
According to the panelists, effective logging begins with a risk-based decision about which data an agency should capture, retain, and analyze. More data does not automatically create better security outcomes. Agencies must determine which sources provide meaningful insight into mission systems, identity activity, security events, and potential threats.
The panelists suggested that a practical approach considers:
- Which systems and activities are most important to mission operations
- What telemetry is needed to support threat detection and investigation
- How long different types of data should be retained
- Which logging costs are justified by the data’s operational and forensic value
- How security teams will use the information in day-to-day operations
Closing the Visibility Gap Across the Enterprise
Agencies often manage a diverse environment that includes legacy platforms, cloud services, endpoints, and mission systems. Visibility gaps can emerge when asset inventories are incomplete, telemetry is inconsistent, or security data is not connected to the systems it represents.
As O’Dell explained, asset inventory, logging, and threat detection should be treated as interconnected capabilities. Agencies need to know what assets exist, which assets generate telemetry, whether that telemetry is being delivered in usable formats, and how security teams will apply it to detect and respond to threats.
Practical Guidance from Government CISOs
Donahue and Dastouri emphasized the importance of aligning implementation with mission outcomes and operational realities. Their perspectives reinforced that agencies must make responsible decisions about where to invest, how to sequence implementation, and how to demonstrate value through improved cybersecurity operations.
For government leaders, the objective is not simply to collect more logs. It is to establish capabilities that support mission assurance, informed decision-making, and effective investigations while using public resources responsibly.
The Integrator’s Role: Turning Data into Operational Value
O’Dell highlighted several areas where implementation support can help agencies move from policy to practice. Integrators can assist agencies in reconciling asset inventories with available telemetry, identifying coverage gaps, and designing repeatable processes for logging and analysis.
Successful implementation practices should help agencies answer practical questions:
- Are critical assets represented in the agency’s inventory?
- Do those assets produce the telemetry required for their risk profile?
- Can the agency receive, retain, and analyze the data effectively?
- Can security teams demonstrate how the data supports detection, response, or forensics?
Preparing for Key Milestones
The panel identified November 18 as the deadline for an Agency Logging Plan and December 18 as the Level 1 maturity milestone. Agencies can use these milestones to organize near-term planning and establish a foundation for longer-term capability development.
A readiness review should include:
- Confirming the systems and environments covered by each applicable mandate
- Validating asset inventories and identifying ownership for critical systems
- Mapping available telemetry to mission and cybersecurity requirements
- Documenting gaps in logging coverage, retention, delivery, and analysis
- Establishing implementation priorities based on risk and operational value
- Defining how progress and maturity will be measured
Contract Guidelines for Operational Success
Contract requirements can determine whether logging capabilities operate consistently after implementation. Agencies should define expectations for log delivery, data formats, retention, access, and coordination across service providers and system owners.
Contracts should also address emergency-change processes. Clear procedures can help agencies adapt logging configurations when operational conditions or cybersecurity priorities change, while maintaining accountability and continuity.
Proving Security Value Beyond Log Volume
The ATARC panel’s central message was practical: agencies should measure progress by operational proof and mission outcomes rather than by the volume of logs collected. Effective logging gives security teams the visibility, context, and evidence needed to support detection, response, and forensic activity.
By distinguishing the requirements of NSPM-12 and OMB M-26-14, aligning inventories with telemetry, and planning for the November 18 and December 18 milestones, agencies can build logging programs that are risk-informed, measurable, and connected to mission needs. The webcast offers federal cybersecurity leaders a useful perspective on translating policy expectations into sustainable operations.
To view the full webcast, please visit the following link and select “Register Now”, and then complete the registration form to view: https://events.govexec.com/reshaping-federal-cybersecurity/
