CISA's new logging architecture is really a free audit kit: can your logs rebuild the attack?

The useful part is not the architecture, it is the second checklist. It asks whether logs are usable, whether the data is timely, whether event fidelity is sufficient, whether the protections are working, and whether you can detect that the logging capability has degraded ^[4]. Those are pass/fail questions about an estate that a coverage dashboard will happily report as green. CISA's own framing is blunter: collecting logs is not the same as being able to use them, and a source can be fully connected while still being useless in an incident if the data arrives too late, is missing key details, carries unreliable timestamps, or has been boiled down into summaries that fall apart once an analyst starts digging ^[6].

The storage taxonomy is where this turns into a budget conversation. The LRA treats the split between searchable, retrievable and immutable data as one of its most important decisions, and says it maps directly onto cost ^[7]. The federal reference point is six months actively searchable and one year retrievable ^[8]. Read the two numbers together and half the mandated retention year does not need to sit in low-latency storage at all ^[16]. Most teams that quote a twelve-month retention figure to an auditor are paying searchable-tier prices for all twelve.

The architectural advice cuts against what a lot of shops have already bought. CISA warns against letting the SIEM become the system of record, arguing that ingesting everything into one analytics platform grows costly and brittle as volume rises, and can weaken fidelity when ingestion-time processing produces the only durable copy of an event ^[9]. Its preferred model is collection suited to each source feeding shared downstream processing ^[10]. The document also declines to endorse centralisation on principle: it says centralisation improves consistency and visibility only if data stays timely, trustworthy and usable, and that a central design which strips context, adds major delay or creates a fragile chokepoint is weaker than a federated one with strong common governance ^[12]. The pipeline itself is named as a security-critical capability whose compromise can blind detection, corrupt evidence, disrupt sharing or undermine confidence in downstream decisions ^[11].

On AI, the guidance is narrower than the marketing around SOC automation. Model outputs are derived data, not authoritative event records, and actions with material operational, legal or privacy consequences stay subject to human review ^[13]. The LRA asks agencies to preserve the relationship between the original record and the derived output, with enough metadata to support review, reproduction and challenge of the result ^[14]. That is a procurement test: a triage product that cannot show the source event behind its verdict fails it.

Federal teams have a forcing function, since agencies bound by M-26-14 must submit an Agency Logging Plan ^[15]. Everyone else gets the checklist for nothing, which is the point.