NIST · Wednesday, September 16, 2026
NIST finalizes guide to protect online identity tokens
The File desk · Sep 16, 2026, 2:12 PM UTC
Status
Confirmed from a NIST news note dated Sept. 15, 2026.
The National Institute of Standards and Technology and the Cybersecurity and Infrastructure Security Agency finalized on Sept. 15. The guide helps agencies and cloud providers protect identity and access tokens from forgery, theft, and misuse. Updates after the December 2025 draft include outcome-based crypto-key guidance and new high-level notes on AI and post-quantum cryptography migration. Ryan Galluzzo of NIST’s digital identity program said anyone using tokens in access management can look to it.
The National Institute of Standards and Technology and the Cybersecurity and Infrastructure Security Agency finalized on Sept. 15.
The guide helps agencies and cloud providers protect identity and access tokens from forgery, theft, and misuse.
Updates after the December 2025 draft include outcome-based crypto-key guidance and new high-level notes on AI and post-quantum cryptography migration.
Ryan Galluzzo of NIST’s digital identity program said anyone using tokens in access management can look to it.
What is still unknown or disputed
- Depth of the AI-agent guidance beyond the news summary; full PDF not required for the card.
Primary sources
Every claim in this story is drawn from the documents below. If a fetch failed, that is recorded on the card.
Source 1
NIST Finalizes Guidelines on Protecting Online Identity and Access Tokens From Misuse
NIST · September 15, 2026
Newly finalized report… (); new high-level considerations for handling AI and migration to post-quantum cryptography.
https://www.nist.gov/news-events/news/2026/09/nist-finalizes-guidelines-protecting-online-identity-and-access-tokens