CISA and the National Institute of Standards and Technology (NIST) have released new guidance to help organizations protect identity and access tokens from theft, forgery and misuse.

 

What happened

According to Cybersecurity News, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST) have released final guidance designed to help organizations protect identity and access tokens from forgery, theft, and misuse.

Published as NIST Interagency Report 8587 (NIST IR 8587) on September 15, the guidance provides technical recommendations for federal agencies and cloud service providers (CSPs) that use tokens and identity assertions for single sign-on (SSO), identity federation, API access, and machine-to-machine authentication.

The guidance, “Protecting Tokens and Assertions from Forgery, Theft, and Misuse,” builds on updates to NIST's SP 800-53 security controls and provides recommendations covering identity providers, authorisation servers, key management, token verification and token lifecycle management.

 

Going deeper

The guidance focuses on several areas that organizations can use to strengthen token security, including:

  • Identity and authorization architecture: Organizations should consider how identity providers and authorization servers issue and manage tokens, particularly in environments using single sign-on (SSO), identity federation, and APIs.
  • Key management: The guidance recommends stronger controls for the cryptographic keys used to sign tokens and assertions. Protecting these keys is important because their compromise could allow attackers to forge legitimate-looking tokens.
  • Token verification: Organizations should implement appropriate checks to verify that tokens are authentic, have not been altered, and are being used in the context for which they were issued.
  • Token lifecycle management: The guidance addresses controls for token issuance, use, expiration, and revocation, helping organizations limit the period during which a compromised token can be used.
  • Continuous monitoring: CISA and NIST recommend monitoring token use and related identity activity to help organizations identify suspicious behavior and respond to potential compromise.
  • Secure-by-design practices: The guidance encourages cloud service providers and agencies to build token security into their systems rather than treating it as an additional security layer.
  • Interoperability and configurability: Organizations should be able to configure token security controls appropriately while maintaining compatibility across identity and access management systems.

The recommendations are intended to help federal agencies and cloud service providers protect token-based access across SSO, federation, and API environments. The guidance also builds on updates to NIST SP 800-53, extending existing security controls to address the risks associated with modern token-based authentication and authorization.

 

What was said

According to a NIST report, Ryan Galluzzo, NIST Digital Identity Program lead and one of the report's authors, said the guidance is intended to provide practical considerations for organizations using tokens as part of their access management infrastructure. “This publication provides implementation considerations for protecting tokens appropriately,” he said.

Galluzzo added that the guidance is relevant beyond federal agencies and cloud service providers: “Anyone who is using tokens as part of their access management infrastructure can look to this for insights, whether they are in government or commercial industry.”

NIST said the final guidance incorporates feedback received on its December 2025 draft. The agency received nearly 250 individual comments from more than 20 contributors, leading to changes covering signing-key protection, key validity periods, workload identities, and standards references.

The guidance was developed by NIST in coordination with CISA's Joint Cyber Defense Collaborative and is published as NIST IR 8587, “Protecting Tokens and Assertions from Forgery, Theft, and Misuse.”

 

In the know

Identity tokens are digital credentials that confirm a user's, device's, or application's identity after authentication. They allow systems to recognize an authenticated identity and determine what it can access without requiring the user to repeatedly provide their credentials.

They are commonly used in single sign-on (SSO), cloud applications, APIs, and identity federation. If an attacker steals or forges a valid token, they may be able to access resources as the legitimate identity.

 

Why it matters

Identity tokens have become an important part of how organizations control access to cloud applications, APIs, and other digital services. A compromised token can potentially allow an attacker to bypass some of the authentication steps that would normally protect an account.

The guidance gives organizations practical recommendations for protecting, validating, and managing tokens, including securing signing keys, limiting token lifetimes and monitoring token use. This can help reduce the opportunity for attackers to use stolen or forged tokens to access systems and data.

See also: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQS

What is authentication?

Authentication is the process of verifying that a user, device, or application is who or what it claims to be.

 

What is authorization?

Authorization determines what an authenticated user, device, or application is allowed to access or do.

 

What happens if an access token is stolen?

An attacker may be able to use a stolen token to access resources available to the legitimate user or application until the token expires or is revoked.

 

How can organizations detect suspicious token activity?

Organizations can monitor authentication and access activity for unusual patterns, such as unexpected locations, applications, devices, or access requests.