CISA and NIST have published final guidance for protecting cloud identity tokens and assertions from theft, forgery and misuse. Interagency Report 8587, released on 15 September 2026, applies to tokens used for single sign-on, identity federation and API access, and is aimed at federal agencies, cloud providers and their customers. Compliance is voluntary. The agencies said attackers increasingly target these credentials to move laterally and access sensitive data.
The report recommends that tokens remain valid for no more than one hour, with expired tokens rejected by authorisation services and policy enforcement points. Signing keys for high-impact systems should be rotated at least every 90 days, and annually elsewhere; at moderate impact and above, they should be stored in hardware-backed or isolated systems rather than persistently on the machines using them. High-impact systems should sign tokens within an isolated execution environment.
Tokens should use narrowly scoped keys, include an explicit audience field and never be written to logs, including any personal data they contain. The guidance also covers AI agents that use signed tokens, although broader AI-agent risks are outside its scope.
The recommendations follow two incidents: a 2020 supply-chain intrusion in which attackers compromised Active Directory Federation Services and forged SAML assertions to bypass MFA at thousands of organisations, and a later incident involving an exposed consumer signing key that enabled forged tokens and resulted in more than 60,000 emails being taken from one agency. CISA said almost 250 public comments contributed to the final report.