NIST and CISA Release Important Cloud Token Security Guidance for Federal Agencies

The National Institute of Standards and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA) have recently finalized NIST Interagency Report 8587, which outlines essential technical guidance regarding the security of identity tokens utilized in cloud sign-ins, Application Programming Interfaces (APIs), and service-to-service interactions. Published on September 15, 2026, this document is particularly relevant for federal agencies and cloud service customers needing to assess and understand the security responsibilities of cloud providers. Importantly, this report is merely guidance and does not constitute a legal mandate, allowing for flexibility in its application. Nonetheless, its implications for cloud procurement are substantial, as it outlines critical areas for security assessments and fosters clearer communication between agencies and their cloud service providers.

Identity tokens are pivotal in modern cloud systems, acting as digital credentials that indicate authenticated users, applications, or permissions. The security of these tokens is paramount, as some can be replayed or misused when acquired by malicious actors, potentially granting them access to sensitive resources without the need for original authentication. To counteract this threat, NIST IR 8587 emphasizes that security measures for identity tokens cannot be treated as afterthoughts; they require a systematic approach to managing the entire lifecycle of tokens. The report details areas such as token lifecycle management, key management, token verification processes, and continuous monitoring.

Through a comprehensive architecture delineating security responsibilities, NIST aims to eliminate ambiguity between the cloud service provider and the customer regarding who manages what aspects of identity and authorization security. This clarity is crucial, as responsibilities often lead to security gaps when each party assumes the other is handling key components. NIST IR 8587 approaches these security concerns as architectural problems that necessitate holistic solutions rather than quick fixes.

One of the critical elements highlighted in the report includes recommendations around cryptographic key protection and token revocation practices, which have been revised to reflect new standards and insights into emerging threats. These recommendations should aid federal agencies in reinforcing their cybersecurity frameworks, particularly in light of directives provided by Executive Order 14306 and NIST’s existing security control frameworks.

For procurement teams, this guidance can serve as a reference point for evaluating potential cloud service providers. The focus areas identified—token lifecycle management, key management, security monitoring, and revocation rights—are crucial for informing vendor assessments and discussions surrounding security responsibilities in cloud procurements. Consequently, cloud providers and contractors may find it beneficial to examine how their services align with these specified protections and be prepared to elucidate relevant compliance measures to their government clients.

NIST IR 8587 represents a significant step toward enhancing the cybersecurity posture of federal agencies engaging in the cloud. By establishing clear guidance on the management and safeguarding of identity tokens, NIST and CISA enhance the ability of agencies to make informed procurement decisions that ultimately bolster national security and protect sensitive information.