# NIST and CISA finalize guidance on protecting access tokens

> NIST IR 8587 sets out implementation recommendations for federal agencies and cloud providers managing identity tokens.

- Canonical URL: https://newsverum.com/en/news/nist-token-protection-guidelines-september-2026
- Publisher: Newsverum
- Section: Security
- Published: 2026-10-06T08:59:01+00:00
- Updated: 2026-10-07T00:55:16+03:00
- Event / data period: 2026-09-15
- Other editions: [Türkçe](https://newsverum.com/tr/news/nist-token-protection-guidelines-september-2026.md), [العربية](https://newsverum.com/ar/news/nist-token-protection-guidelines-september-2026.md), [Français](https://newsverum.com/fr/news/nist-token-protection-guidelines-september-2026.md), [Español](https://newsverum.com/es/news/nist-token-protection-guidelines-september-2026.md), [Deutsch](https://newsverum.com/de/news/nist-token-protection-guidelines-september-2026.md), [Português](https://newsverum.com/pt/news/nist-token-protection-guidelines-september-2026.md)

The National Institute of Standards and Technology and the US Cybersecurity and Infrastructure Security Agency published the final NIST IR 8587 on 15 September 2026. The guidance gives federal agencies and cloud service providers implementation recommendations for protecting identity and access tokens against forgery, theft and misuse.

It addresses identity-provider and authorization-server architecture, key management, token verification and lifecycle controls. NIST says the report covers single sign-on, federation and API access scenarios and was revised after public feedback on its draft.

## Data

### Security development

Information and scope published by the source.

Methodology: Figures and dates are reproduced as stated by the source; no additional forecast is made.

| date | label | description | status |
|---|---|---|---|
| 2026-09-15 | NIST IR 8587 published | NIST and CISA published final implementation guidance on protecting identity and access tokens from forgery, theft and misuse. | occurred |

Sources: <https://www.nist.gov/news-events/news/2026/09/nist-finalizes-guidelines-protecting-online-identity-and-access-tokens> · Download data: [JSON](https://newsverum.com/api/v1/articles/nist-token-protection-guidelines-september-2026/data/security-event?lang=en&format=json) · [CSV](https://newsverum.com/api/v1/articles/nist-token-protection-guidelines-september-2026/data/security-event?lang=en&format=csv)

## Sources

- [National Institute of Standards and Technology (NIST)](<https://www.nist.gov/news-events/news/2026/09/nist-finalizes-guidelines-protecting-online-identity-and-access-tokens>) (Source checked: 2026-10-06; Published: 2026-09-15)

## Correction history

- 2026-10-07T00:55:16+03:00: German and Portuguese editions and translations of the data and correction explanations have been added to this article.

---

Cite the canonical URL above. [Editorial standards and corrections](https://newsverum.com/en/editorial)