The Cybersecurity and Infrastructure Security Agency (CISA) and National Institute of Standards and Technology (NIST) on Sept. 15 released final guidance to help federal agencies and cloud service providers (CSPs) protect identity and access tokens that support single sign-on, federation, and application programming interface access.
The guidance incorporates feedback from nearly 250 public comments and builds on updates to NIST Special Publication 800-53. According to a CISA press release, the recommendations apply across commercial and government-operated cloud services.
“Identity is the new perimeter, and the tokens and assertions behind it are attractive targets for sophisticated adversaries,” said Chris Butera, CISA acting executive assistant director for cybersecurity.
“These guidelines give agencies and cloud providers a clear, practical path to harden token issuance, verification, and management so a stolen or forged credential can’t become a foothold across the federal enterprise,” Butera added.
Identity tokens contain cryptographically protected information that can be used for authentication and authorization across cloud environments.
In a separate press release, NIST noted that stolen or forged tokens can allow attackers to gain access to sensitive systems. The agency cited an attack in which foreign actors used forged tokens derived from a stolen commercial signing key to access federal agency email systems and steal more than 60,000 emails from one agency.
The final guidance provides architectural considerations for identity providers and authorization servers, along with recommendations for strengthening cryptographic key management, token verification, and token life cycle controls.
NIST said the final version makes several changes based on feedback to the initial December 2025 draft.
One notable change is that guidance on cryptographic key protection is less prescriptive and more focused on security outcomes. The guidance also includes more recommendations on key use, protection, and storage.
It also adds high-level considerations for artificial intelligence and migration to post-quantum cryptography standards, as well as new references to current and emerging standards for areas including token revocation and sharing security signals.
The guidance responds to NIST’s tasking under a June 2025 cybersecurity executive order from President Donald Trump.
CISA and NIST are urging federal agencies, CSPs, and other cloud consumers to review and implement the guidance to strengthen the security of cloud identity systems.
“This publication provides implementation considerations for protecting tokens appropriately,” said NIST Digital Identity Program Lead Ryan Galluzzo, one of the publication’s authors. “Anyone who is using tokens as part of their access management infrastructure can look to this for insights, whether they are in government or commercial industry.”