CISA and NIST Release Guidelines to Protect Federal Cloud Identity Systems from Token Theft, Forgery, and Misuse
CISA and NIST released guidelines to protect federal cloud identity systems from token theft and forgery, addressing rising attacks on SSO and API access mechanisms.
The Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST) published Interagency Report (IR) 8587, titled *Protecting Tokens and Assertions from Forgery, Theft, and Misuse*. The report provides implementation recommendations for federal agencies and cloud service providers (CSPs) to secure identity tokens and assertions used in single sign-on (SSO), federation, and API-based access systems. These tokens are frequent targets for adversaries seeking to move laterally within networks and access sensitive data.
The final report incorporates feedback from nearly 250 public comments on token validation, secrets management, and large-scale detection. It also reflects input from CISA’s collaboration with industry CSPs and interagency partners through the Joint Cyber Defense Collaborative. Technical exchanges and webinars, including a June 2025 session with over 50 experts and a January 2026 review of the draft report, shaped the guidelines.
CISA Acting Executive Assistant Director for Cybersecurity Chris Butera emphasized the importance of securing identity tokens, stating they are prime targets for sophisticated adversaries. The report builds on NIST Special Publication (SP) 800-53 Release 5.1.1 and its IA-13 control, offering practical steps to harden token issuance, verification, and management across cloud environments.
CISA urges federal agencies, CSPs, and cloud consumers to adopt the recommendations in IR 8587 to enhance cloud system security. The guidelines align with Executive Order 14306 on secure software development practices and apply to both commercial and government-operated cloud services.