Federal government
Signed logs and source coverage reports for agency audits.
Security built for federal agencies
Agencies need evidence that connects collection coverage to investigation and response. A clear view of sources, retained records and review decisions helps teams protect public services and explain how controls operate.
Controls
| Source | Requirement | Asks | Supporting evidence |
|---|---|---|---|
| M-26-14 | Level 2 | Logs regularly hashed for veracity. | Each log signed and chained. → |
| Coverage | Share of systems at each level. | Each source and when it last reported. → | |
| Level 4 | Detections tuned with machine learning. | 21 detectors, each tested on agency data first. → | |
| SP 800-53 Rev. 5 | AU-5 | Alert on audit logging failure. | Alerts when a source goes silent. → |
| AU-6(3) | Correlate across repositories. | Events linked across sources. → | |
| AU-9(3) | Protect audit information cryptographically. | Signed, chained logs and role-based access. → | |
| IR-4 to IR-6 | Handle, track and report incidents. | SIEM cases and SOAR incidents, with history. → | |
| M-25-21 | High-impact AI | Accountability for AI-assisted decisions. | Each case records who accepted it. → |
FISMA
A source inventory and collection-health history show what the agency actually observes. They help the team address gaps before an Inspector General review and explain the limits of any investigation.
OMB M-26-14
Federal logging policy calls for a usable record of relevant activity. Set retention and retrieval around the agency’s requirements, and use integrity controls to preserve evidence for investigation and oversight.
RMF
On-premises deployment can place security services on agency-operated infrastructure. The agency’s RMF process determines the authorization boundary, required assessment and approval of the change.
OMB M-25-21
AI oversight needs a record of the evidence considered, the assessment and the person responsible for accepting it. Permissions and response authority remain separate from the model’s reasoning.
By rule
SP 800-53 Rev. 5 AU-5
Alert on audit logging failure. Collection-health monitoring in a SIEM shows when a source stops reporting and helps the team investigate the gap.
SP 800-53 Rev. 5 AU-6(3)
Correlate across repositories. Correlation in a SIEM connects related events across sources while preserving the records behind the resulting finding.
SP 800-53 Rev. 5 AU-9(3)
Protect audit information cryptographically. Restricted access, signed records and administrative history support protection and review of the audit trail.
SP 800-53 Rev. 5 IR-4 to IR-6
Handle, track and report incidents. A SOAR incident workflow retains ownership, evidence, approvals and actions so reviewers can follow the response.
Questions
Where does it run?
The deployment can use agency-controlled infrastructure. Sizing and supported platforms follow the selected products; local analytical processing can keep evidence within the approved environment.
What does it collect?
The source plan can include directory, VPN, firewall, EDR, Microsoft 365 and Azure records. Evaluate the available logs and any custom parsing needed before treating a system as covered.
Who approves an action?
The team. SOAR pauses at each step marked for approval, and the history shows who chose what, and when.
What stays with the agency?
The agency retains authorization, reporting to CISA and OMB, and operating responsibility. Security records and workflow history provide evidence for those decisions.
Guide
What is OMB M-26-14?
Replacing M-21-31, OMB M-26-14 sets a risk-based approach to agency event logging and network visibility. It focuses on records that help agencies detect, investigate and respond to evolving threats.
What logging does FISMA require?
FISMA requires agency security programs with incident detection and response. Inspectors general test logging against NIST SP 800-53 AU controls.
How is on-premises software authorized?
The agency assesses the proposed deployment through its Risk Management Framework and authorization process. Hosting location is one part of that decision.
How ARRTECH takes care of federal agency security
Connects security activity into a signed record, giving incident decisions and board reporting evidence that can be independently verified.
Protects intellectual property and customer trust, with content-aware controls that let organizations adopt AI on their own terms.
Expands response capacity through automation, with defined human authority and a record of who approved what.
Finds changes in behavior that predefined rules miss, connecting the signs of an attack so teams can understand what warrants action.
Investigates alerts, tests explanations and prepares the evidence, giving analysts more capacity while people retain authority over the response.
