The National Institute of Standards and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA) recently released NIST Interagency Report (IR) 8587, Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers.

The report builds on NIST’s Identification and Authentication security controls – specifically IA-13 – a control NIST added to Special Publication (SP) 800-53 in 2023 in response to incidents in which forged or stolen tokens let attackers bypass multi-factor authentication (MFA) and gain access to sensitive government systems. IR 8587 spells out how agencies and cloud service providers (CSPs) should apply that control in practice.

Below are the key elements of the NIST guidance that affect federal agencies and the contractors that support or supply them.

• Cryptographic Key Protection. The report sets various requirements for generating, storing, distributing, and retiring the cryptographic keys used to sign tokens. For systems rated at moderate impact or above, signing keys must be stored using a hardware based or otherwise isolated mechanism. High impact systems must also protect the signing process itself within an isolated execution environment. Recommended key rotation periods may run up to 90 days for high impact systems and up to one year for moderate and low impact systems.
• Token Verification and Lifecycle Limits. Agencies and providers must verify the source and integrity of tokens before granting access, including checking digital signatures and confirming that a token is scoped to the correct audience. The report recommends that access and identity tokens remain valid for no more than one hour in most cases, with shorter refresh lifetimes for machine and workload access.
• Workload and Machine Identity Protections. The guidance directs organizations to move away from long standing static secrets for machine to machine and workload access, favoring short lived, tightly scoped credentials instead. It points to emerging frameworks such as the open-source Secure Production Identity Framework for Everyone (SPIFFE) as one path for issuing these credentials.
• Logging and Monitoring. All systems that handle tokens must maintain tamper resistant logs of token related events, structured to align with NIST SP 800-92 guidance on log management and the Office of Management and Budget (OMB) May 2026 Memorandum M-26-14 on agency logging. Cloud providers must make this logging capability available to consuming agencies, including logs that are not enabled by default.
• Shared Responsibility Between CSPs and Agencies. The report lays out which security tasks fall to CSPs and which fall to agencies. Cloud service providers are expected to secure core identity infrastructure, manage key issuance, and be transparent about their architecture and configuration options. Agencies are responsible for assessing risk, tailoring controls to their own environment, and configuring the tools providers make available. The report notes that neither side can fully secure these systems without coordination from the other, particularly for incident notification.
• Preparing for Post Quantum Cryptography (PQC). The report flags an early challenge for identity-focused systems. Many post quantum signing algorithms produce larger keys and signatures than current cryptography methods, which could strain the size limits of browser cookies and HTTP headers that carry tokens today. Agencies and providers are advised to begin inventorying where public key cryptography is used in their token systems now. In June 2026, President Trump issued Executive Order (EO) 14412 directing federal agencies to replace their current encryption systems with PQC.

Contractor Implications

Since IA-13 and its enhancements have not yet been added to a required SP 800-53 control baseline, compliance with IR 8587 remains voluntary unless an agency, OMB policy, or a specific contract makes it mandatory. That said, the level of detail in NIST’s report suggests agencies may begin referencing it in requirements and evaluation criteria well before any formal mandate takes effect.

Contractors offering cloud identity services will likely need to document their key management, token verification, and logging practices in more detail to meet these expectations. Systems integrators supporting agency Identity and Access Management (IAM) and zero trust (ZT) efforts may see contractual requirements or modifications tied to shortening token lifetimes, automating key rotation, and building out revocation capability.

Vendors of hardware security modules and secure key management services stand to benefit as agencies work through the storage and isolation requirements of the guidance. Firms with logging and security analytics offerings have an opening tied to the NIST’s tamper resistant logging requirements. Finally, companies that can speak to post quantum migration planning for identity systems specifically, rather than encryption in general, have an early opportunity to differentiate themselves.