Guidelines for Protecting Identity Tokens from Cyber Threats

• •NIST and CISA released guidelines for protecting identity tokens on September 15, 2026.
• •The report addresses threats from recent high-profile cyber attacks targeting token forgery and theft.
• •Recommendations include enhancements to key management and token verification processes.

On September 15, 2026, NIST and CISA released a report detailing implementation guidelines for federal agencies and cloud service providers to protect identity tokens, access tokens, and assertions from forgery, theft, and misuse. This report addresses threats highlighted in recent high-profile attacks and emphasizes secure design practices, interoperability, and continuous monitoring. It provides recommendations for key management, token verification, and lifecycle controls, particularly in hybrid and multi-cloud environments. The report aims to enhance security for single sign-on (SSO), federation, and API access scenarios, reflecting the growing need for robust authentication measures in the face of evolving cyber threats. Agencies are urged to adopt these guidelines to safeguard sensitive data and maintain secure operations.