NIST and CISA release draft guidelines to protect identity tokens and assertions

The U.S. National Institute of Standards and Technology (NIST), in coordination with the Cybersecurity and Infrastructure Security Agency (CISA), published an initial public draft of IR 8587: “Protecting Tokens and Assertions from Forgery, Theft, and Misuse.” This draft report, open for public comment through January 30, 2026, provides implementation recommendations for federal agencies and cloud service providers on how to secure identity tokens and assertions against modern threats such as forgery and theft. It lays out architectural and key-management principles intended to guide future secure authentication systems, especially in cloud and federated environments — a topic many cybersecurity R&D groups are actively advancing.

24-12-2025