NIST Finalizes Guidance for Protecting Identity Tokens and Assertions

The National Institute of Standards and Technology has finalized guidance for protecting identity tokens and assertions against forgery, theft and misuse, setting out security practices for federal agencies and their cloud service providers.

NIST Interagency Report 8587 addresses the credentials exchanged behind the scenes during online sign-in and access authorization. Tokens can carry cryptographically protected information about a user and permitted resources, while assertions convey identity information between systems. Both can support single sign-on without requiring a fresh login to every application.

The guidance was developed with the Cybersecurity and Infrastructure Security Agency’s Joint Cyber Defense Collaborative. It responds to Executive Order 14306 and builds on updates to NIST Special Publication 800-53 Revision 5, the agency’s catalog of security and privacy controls.

The final version gives organizations more flexibility in protecting the cryptographic keys used to sign tokens and assertions. It distinguishes secure key storage from secure key use, focusing on the security outcomes organizations need rather than prescribing a single implementation.

Signing-key validity periods now reflect system classification and the sensitivity of transactions, rather than deployment models. NIST continues to emphasize automated key management and rotation, which replaces keys on a managed schedule instead of leaving the process to manual administration.

The guidance also addresses workload identities, the credentials used by software processes and services. It recommends short-lived tokens rather than continued reliance on static credentials and secrets, alongside updated references to standards, protocols and implementation profiles.

Organizations receive additional options for revoking tokens and sharing security signals around their use. The publication also includes high-level considerations for artificial intelligence and migration to post-quantum cryptography.

Stolen authenticated access has featured in recent cloud attacks. Microsoft has tracked social engineering that captures credentials and session tokens, while SpyCloud’s identity exposure analysis examined stolen API keys and non-human credentials across cloud and developer services.

NIST and CISA received nearly 250 individual comments from more than 20 contributors, alongside industry feedback and a public webinar, when revising the draft. Although written primarily for government agencies and their providers, the final recommendations can be used by commercial organizations operating token-based access systems.

Sources: NIST, NIST CSRC

–

By the ID Tech Editorial Team