GAITHERSBURG, September 16 — The National Institute of Standards and Technology and the Cybersecurity and Infrastructure Security Agency have finalized a publication offering implementation guidelines to protect online identity and access tokens from forgery, theft and misuse. The document, titled Protecting Tokens and Assertions from Forgery, Theft, and Misuse (NIST IR 8587), was announced on NIST’s official website in September 2026. Tokens are snippets of cryptographically protected information that identify users and specify which online resources they are permitted to access — webmail inboxes, contacts, or other sensitive data.
For communities and families across the region, tokens are the quiet machinery behind conveniences they use every day. They enable single sign-on, which lets a user move between applications without repeatedly reauthenticating, and they form an important component of zero trust architectures.
They are also a key part of access management infrastructure at most major cloud service providers. Without proper protection, malicious actors can exploit tokens to break into sensitive systems. The report cites one attack in which foreign actors accessed agency email systems using forged tokens derived from a single stolen commercial signing key, stealing more than 60,000 emails from a single agency.
NIST IR 8587 responds to NIST’s tasking in Executive Order 14306 and builds on recent updates to Special Publication 800-53, NIST’s catalog of security and privacy controls, for the purpose of enhancing the security of tokens and token management.
Written for agencies, useful to anyone handling identity
While the document is primarily written for federal agencies and the cloud service providers they work with, it can help any organization that handles identity tokens and related forms of identity assertions, according to NIST Digital Identity Program Lead Ryan Galluzzo, one of the publication’s authors. “This publication provides implementation considerations for protecting tokens appropriately,” Galluzzo said.
“Anyone who is using tokens as part of their access management infrastructure can look to this for insights, whether they are in government or commercial industry.” The publication lays out a set of principles for both provider and consumer organizations, delineating what each party should do to ensure data remains protected. Galluzzo said the authors revised the initial draft in response to reader feedback, and he highlighted critical support from industry partners such as the Joint Cyber Defense Collaborative, which provided feedback.
“This document consolidates insights from across the cybersecurity community to help improve our ability to protect government data, resources and systems from the evolving threats they face today,” he said. The intended audience includes federal agencies, which need to understand how to configure services from their cloud service providers appropriately, and the providers themselves, which need to deliver secure products to these agencies.
The next thing to watch is how quickly agencies and cloud providers put these implementation considerations into practice — and whether the principles laid out for providers and consumers alike become standard practice for identity systems well beyond government use.
