NIST finalizes guidelines for identity tokens

The National Institute of Standards and Technology and the Cybersecurity and Infrastructure Security Agency have finalized a report on identity and access tokens. NIST published the account in September 2026. The title is Protecting Tokens and Assertions from Forgery, Theft, and Misuse, NIST Internal Report 8587.

NIST says a token is a snippet that identifies a person and the online resources that person may use, such as an inbox or contacts. Tokens carry cryptographically protected information and are used in authentication. They also make single sign-on possible, so a person can open several applications without signing in again each time. NIST says tokens are part of the access systems at most major cloud providers and are used in zero-trust designs.

The report cites one attack in which foreign actors entered agency email with forged tokens made from a single stolen commercial signing key. NIST says those attackers took more than 60,000 emails from one agency.

The publication is written first for federal agencies and the cloud providers they use. It sets out what the provider and the customer organization should each do. Ryan Galluzzo, who leads NIST's Digital Identity Program and is an author of the report, said any organization that uses tokens in access management can use it, in government or in industry. The report answers a task in Executive Order 14306 and follows updates to Special Publication 800-53.

Galluzzo said the authors changed the draft after comments on the December 2025 version. Guidance on protecting cryptographic keys is now less prescriptive and more concerned with whether an organization can do the job. The report adds advice on how keys are used, protected, and stored. It adds high-level considerations for artificial intelligence and for moving to post-quantum cryptography, and NIST says it does not offer a full toolkit for either subject. It also adds references to current and emerging standards, including more options for revoking a token and for sharing signals about tokens. The Joint Cyber Defense Collaborative was among the industry groups that commented.