NIST · Wednesday, September 16, 2026

NIST finalizes guide to protect online identity tokens

The File desk · Sep. 16, 2026, 10:12 a.m. ET

Confirmed1 primary sources

Status

Confirmed from a NIST news note dated Sept. 15, 2026.

The National Institute of Standards and Technology and the Cybersecurity and Infrastructure Security Agency finalized on Sept. 15. The guide helps agencies and cloud providers protect identity and access tokens from forgery, theft, and misuse. Updates after the December 2025 draft include outcome-based crypto-key guidance and new high-level notes on AI and post-quantum cryptography migration. Ryan Galluzzo of NIST’s digital identity program said anyone using tokens in access management can look to it.

The National Institute of Standards and Technology and the Cybersecurity and Infrastructure Security Agency finalized on Sept. 15.

The guide helps agencies and cloud providers protect identity and access tokens from forgery, theft, and misuse.

Updates after the December 2025 draft include outcome-based crypto-key guidance and new high-level notes on AI and post-quantum cryptography migration.

Ryan Galluzzo of NIST’s digital identity program said anyone using tokens in access management can look to it.

How we know

What this is

Legal instrument
NIST IR 8587 — Protecting Tokens and Assertions from Forgery, Theft, and Misuse
A finalized NIST/CISA report with implementation guidelines to keep digital identity and access tokens from being forged, stolen, or misused, aimed mainly at federal agencies and their cloud providers.
NIST: IR 8587 news note
—
Legal instrument
NIST IR 8587 — Protecting Tokens and Assertions from Forgery, Theft, and Misuse
A finalized NIST/CISA report with implementation guidelines to keep digital identity and access tokens from being forged, stolen, or misused, aimed mainly at federal agencies and their cloud providers.
NIST: IR 8587 news note
A finalized NIST/CISA report with implementation guidelines to keep digital identity and access tokens from being forged, stolen, or misused, aimed mainly at federal agencies and their cloud providers.

What is still unknown or disputed

Depth of the AI-agent guidance beyond the news summary; full PDF not required for the card.

Primary sources

Every claim in this story is drawn from the documents below. If a fetch failed, that is recorded on the card.

Source 1
NIST Finalizes Guidelines on Protecting Online Identity and Access Tokens From Misuse
NIST · September 15, 2026
Newly finalized report…
Legal instrument
NIST IR 8587 — Protecting Tokens and Assertions from Forgery, Theft, and Misuse
A finalized NIST/CISA report with implementation guidelines to keep digital identity and access tokens from being forged, stolen, or misused, aimed mainly at federal agencies and their cloud providers.
NIST: IR 8587 news note
(
Legal instrument
NIST IR 8587 — Protecting Tokens and Assertions from Forgery, Theft, and Misuse
A finalized NIST/CISA report with implementation guidelines to keep digital identity and access tokens from being forged, stolen, or misused, aimed mainly at federal agencies and their cloud providers.
NIST: IR 8587 news note
); new high-level considerations for handling AI and migration to post-quantum cryptography.
https://www.nist.gov/news-events/news/2026/09/nist-finalizes-guidelines-protecting-online-identity-and-access-tokens

NIST finalizes guide to protect online identity tokens

What is still unknown or disputed

Primary sources

NIST Finalizes Guidelines on Protecting Online Identity and Access Tokens From Misuse