NIST Interagency Report (IR) 8587 is now available: Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers.
What is in the report?
Developed in coordination with CISA’s Joint Cyber Defense Collaborative (JCDC) and in support of Executive Order 14306, this report provides implementation guidelines to help federal agencies and cloud service providers (CSPs) protect identity tokens and assertions from forgery, theft, and misuse.
Building on updates to NIST SP 800-53 Revision 5, the report outlines principles for CSPs and consuming agencies, details architectural considerations for identity providers and authorization servers, and recommends enhancements to key management, token verification, and lifecycle controls. The report also addresses threats demonstrated in recent high-profile attacks, emphasizes the importance of secure and configurable cloud services, and provides technical recommendations to safeguard single sign-on, federation, application programming interface (API), and workload access scenarios.
What changes have been made since the draft?
NIST and CISA received nearly 250 individual comments from over 20 contributors, as well as feedback through JCDC, and a public webinar held in January 2026. This collaboration resulted in an improved document with substantive changes, most notably:
- Signing key protection and usage options. These sections have been updated to provide more flexibility and clarity around how organizations can protect keys used for signing assertions and tokens. The document now distinguishes guidelines for secure storage and secure usage of these keys.
- Updated signing key validity periods. Based on feedback, this final document shifts from tying the validity periods to deployment models to one that focuses on system classification and sensitivity of transactions. The guidelines continue to emphasize automated key management and rotation practices.
- Workload considerations. This document now integrates considerations for the use of tokens in workload identity scenarios – reinforcing the need for short-lived tokens rather than reliance on static credentials and secrets.
- Updated standards references. Integrates additional standards, protocols, and profiles that can be referenced by implementers to achieve the capabilities described in the document.
While NIST IR 8587 is final, we are always open to continued feedback. Please submit your comments or questions via email at [email protected].
