2026-16535NoticeWallet

HUD's 'Sumo Logic' System Pins Down Security Logs

Published Date: 8/13/2026

Notice

Summary

Pursuant to the provisions of the Privacy Act of 1974, as amended, the Department of Housing and Urban Development (HUD), Office of Chief Information Officer (OCIO), and Infrastructure and Operations (IOO), is issuing a public notice of its intent to establish a Privacy Act System of Records Notice (SORN) titled "Sumo Logic." Sumo Logic serves as HUD's Security Information and Event Management (SIEM) tool, supporting centralized log collection, aggregation, and security monitoring. It collects system log data from HUD applications, infrastructure, security tools, and cloud platforms, and performs event correlation, custom searches, dashboard monitoring, scheduled reporting, and other standard security monitoring. This newly established system will be included in HUD's inventory of record systems. HUD had previously published a SORN for this system on June 10, 2026 (91 FR 35248). However, the underlying authority was revoked and replaced. Accordingly, HUD withdraws the SORN published on June 10, 2026, and instead publishes this SORN with the updated authority.

Analyzed Economic Effects

5 provisions identified: 0 benefits, 3 costs, 2 mixed.

HUD will collect specific personal identifiers

Sumo Logic will store items such as device identifiers, full names, email addresses, phone numbers, geolocation information, user IDs, and web URLs from HUD systems. These categories of records are explicitly listed as being collected.

HUD may share records with contractors and agencies

HUD may disclose Sumo Logic records to contractors, grantees, other federal agencies, state/local entities, law enforcement, and courts for purposes such as investigations, breach response, research, and litigation. Routine uses explicitly list multiple disclosure categories.

HUD will log many users' system activity

HUD is establishing a new system called "Sumo Logic" that will collect security logs about people who access or interact with HUD systems. The system explicitly covers federal employees, contractors, vendors/partners, and members of the public whose accounts or devices interact with HUD networks or services.

Records kept up to 30 months (possible longer use)

HUD will manage Sumo Logic logs under General Records Schedule 3.2 and these cybersecurity logging records can be destroyed when 30 months old. The notice also says longer retention is authorized for business use under the listed disposition authority.

Access, contesting requires ID and notarized proof

If you want to see or contest records about yourself in Sumo Logic, HUD requires a written request with full name and contact information plus either a notarized statement or an unsworn declaration under 24 CFR 16.4. Access also requires HSPD-12 credentials and network/ID controls for users inside HUD.

Personalized for You

How does this regulation affect your finances?

Personalize government policy and PRIA will tell you what this federal register document means for your household, plus every other regulation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Key Dates

Published Date
Comments Due
Effective Date
8/13/2026
9/14/2026
9/15/2026

Department and Agencies

Department
Independent Agency
Agency
Housing and Urban Development Department
Source: View HTML

Related Federal Register Documents

Previous / Next Documents

Back to Federal Register