The Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST) have released final technical guidance to prevent attackers from forging, stealing, replaying, or misusing identity and access tokens. Released as NIST Interagency Report 8587 on September 15, 2026, it provides federal agencies and cloud service providers with a roadmap for securing single sign-on, identity federation, API access, and machine-to-machine authentication environments. CISA NIST Identity Token Security However, adversaries who steal a legitimate token, compromise a signing key, or exploit weak validation can bypass multifactor authentication and access connected resources as trusted users.
The NIST technical guidance expands on the IA-13 control introduced in NIST SP 800-53 Release 5.1.1, focusing on token architectures, protocols, lifetimes, validation processes, key management, revocation procedures, session controls, logging, and incident response. Conformance remains voluntary unless mandated by policy or contract, with "MUST" and "SHOULD" indicating measurable implementation expectations. A key requirement is stronger protection for cryptographic keys, which must use approved algorithms and FIPS 140-validated modules, be inventoried by purpose, move through protected channels, and never be exported in plaintext.
For theft and replay resistance, mechanisms such as mutual TLS and Demonstrating Proof of Possession, along with explicit audience restrictions and fine-grained conditional access decisions informed by device, network, geolocation, and behavioral context, should be employed.
