OMB M-21-31 requires US Federal Civilian agencies to implement user behavior monitoring. We'll explain what that means and how to do it right.