CISA and NIST Urge One-Hour Limits to Block Cloud Token Theft

CISA and NIST have issued final guidance for protecting cloud identity tokens and assertions from theft, forgery and misuse. Published on 15 September 2026 as NIST Interagency Report 8587, the voluntary guidance is aimed at federal agencies, cloud service providers and their customers. It covers tokens used for single sign-on, identity federation and API access, which the agencies say are increasingly targeted by attackers seeking lateral movement and access to sensitive data.

The report recommends that tokens expire within one hour and that expired tokens be rejected. Signing keys for high-impact systems should be rotated at least every 90 days, while other keys should be rotated within a year. At moderate impact and above, keys should be held in hardware-backed or isolated storage rather than persistently on the servers, virtual machines or containers using them; high-impact systems should sign tokens within an isolated execution environment.

Tokens should be limited to the narrowest appropriate scope, include an explicit audience field and never be written to logs, including any personal data they contain. The guidance also applies to AI agents using signed tokens, although broader AI-agent risks remain outside its scope.

CISA and NIST said the recommendations were informed by two compromises: a 2020 supply-chain intrusion in which attackers forged SAML assertions after compromising Active Directory Federation Services, bypassing MFA at thousands of organisations, and a later incident involving an exposed consumer signing key that enabled forged tokens and resulted in more than 60,000 emails being taken from one agency. Nearly 250 public comments contributed to the final document.