M-21-31: Identify gaps in event logging requirements

[rocheller123]

Background Information

M-21-31: Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents requires federal agencies to log information to aid in the "detection, investigation, and remediation of cyber threats" and to share information with other agencies, if required, to address cybersecurity risks or incidents.

The required log information is broken down into 4 Event Logging (EL) tiers: EL0, EL1, EL2, EL3.

The requirements for ensuring the information for each tier is being collected are as follows with specific deadlines from date of memo (8/27/2021):

• Within 60 days of memo date: As per memo, "Identify resourcing and implementation gaps associated with completing each of the requirements listed below. Agencies will provide their plans and estimates to their OMB Resource Management Office (RMO) and Office of the Federal Chief Information Officer (OFCIO) desk officer."
• Within one year of memo date: reach EL1 maturity as defined in M-21-31.
• Within 18 months of memo date: achieve EL2 maturity as defined in M-21-31.
• Within 2 years of memo date: achieve EL3 maturity as defined in M-21-31.

The first step is to identify the required information that is not being collected and to create a plan to ensure the information is being collected.

Implementation Steps

• Identify groups that will be involved.
• Identify tasks for groups.
• Identify what log information is currently being collected.
• Identify gaps in event logging requirements.
• Develop a plan to address gaps.

Acceptance Criteria

• The gaps in the implementation of the logging requirements as per M-21-31 have been identified and an appropriate plan to complete implementation has been developed.

[afeld]

cc https://github.com/18F/aws-admin/issues/150

[rocheller123]

Discussed in Slack: https://gsa-tts.slack.com/archives/CG8SNAEQM/p1636040839007600

[MichaelSides]

Week of June 3rd:

• Repurposing NSF spreadsheet provided by Search.gov: OMB M-21-31 status sanitized v01 20231002 working copy
• Discovery meetings with:
• Login
  BLUF: They believe they are EL1/tier 1 compliant and will begin working on the tracking spreadsheet. Meeting noteWeekly
  check in sessions will be scheduled.
• Cloud
  BLUF: They believe they are also EL1/tier 1. High level compliance info:
  https://cloud.gov/docs/compliance/logging-requirements/. No availability per Kelsey to work on this until
  after current ATO effort in July. Will be planned in July. Meeting Minutes: https://docs.google.com/document/d/145CZvw2OIroVNm6uRCfwYyM9SQXool2Yjmdk_qQ33hg/edit
• USA
• Consolidate info provided and check on status of tracking spreadsheets
• Update GAO Audit Corrective Active Plan (CAP)/POAM Due 6/21 #1681