In 2021, OMB published Memorandum M-21-31 developed pursuant to EO 14028. The memorandum establishes a maturity model for event log management, providing executive agency implementation requirements and details.Since the end of 2020, the U.S. public sector has suffered two information security shocks - the hacked of SolarWinds and four zero-day vulnerabilities in Microsoft Exchange Server. The U.S. government investigated both incidents. Investigators were unable to collect evidence due to the lack of log retention in the government agency, and were unable to establish a normal baseline and detect abnormal behavior that deviates from the baseline. "Log retention in federal information systems is critical to the detection, investigation, and remediation of cyber threats," said OMB Director.