"Identity is the new perimeter, and the tokens and assertions behind it are attractive targets for sophisticated adversaries," said Chris Butera, CISA acting executive assistant director for cybersecurity.
Interagency Report 8587: who this targets and why
On September 15, CISA and NIST published Interagency Report 8587: final guidance intended to protect cloud identity tokens and assertions used behind single sign-on (SSO), identity federation and application programming interface (API) access. The agencies said adversaries are increasingly targeting those tokens to move laterally and reach sensitive data. Following the guidance is voluntary; the document is aimed at federal agencies, cloud service providers and organizations that procure from them.
Token lifetime, audience fields, and logging: tight constraints
The report sets several crisp, operational rules for token handling. Access and identity tokens should be valid for no more than an hour, and authorization services and policy enforcement points must reject expired tokens outright. Every token must carry an explicit audience field; any access control mechanism receiving a token without an audience claim must reject it. The guidance also demands that tokens, and any personal data contained within them, never be written to logs.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildKey management and signing: isolation, scoping, rotation
The guidance prescribes concrete key-management controls tied to impact level. For high-impact systems, signing keys must be rotated at least every 90 days; elsewhere, rotation must occur within a year. Keys at moderate impact and above must reside in hardware-backed or isolated storage and must never be persistently stored on the servers, virtual machines or containers that use them. High-impact systems have an extra requirement: signing must occur inside an isolated execution environment. Keys must be scoped to the narrowest sensible boundary, and critically, a key valid outside a federally authorized environment must not be used to sign tokens that operate inside that environment.
AI agents, scope limits, and the guidance's boundaries
The report calls out that AI agents are "increasingly" using signed tokens to access systems, data and APIs, and says the guidance applies to those uses. At the same time, the agencies explicitly excluded wider AI agent access risks from the report's scope and noted that NIST and CISA are still developing separate guidelines for broader AI agent controls.
Two incidents that shaped the rules, and who weighed in
The guidance is framed as a response to two concrete incidents that showed how token compromise can cascade. In a 2020 supply-chain intrusion, attackers who had compromised Active Directory Federation Services forged SAML assertions and bypassed multifactor authentication at thousands of organizations, including federal agencies. In a second incident, foreign actors used a consumer signing key that had been exposed by mistake, then forged tokens with it; token validation failures allowed the forged signatures to be accepted inside enterprise and government systems, and more than 60,000 emails were taken from one agency.
Regulators said the final text was shaped by nearly 250 public comments. Google, Microsoft, Okta, Amazon Web Services, Oracle, IBM, HashiCorp, Wiz and the OpenID Foundation provided input through the Joint Cyber Defense Collaborative.
How federal agencies, cloud providers, and enterprise security teams will need to respond
- Federal agencies: Expect to evaluate token lifetimes, enforce audience checks, and audit where signing keys are used. Agencies that accept tokens should ensure authorization services reject expired or audience-less tokens.
- Cloud service providers: Providers will be asked to offer hardware-backed or isolated key storage, support isolated signing environments for high-impact workloads, and enable short token lifetimes and strict audience scoping for federated scenarios.
- Enterprise security teams and procurement leaders: Buyers should require contractual or architectural guarantees that keys used to sign tokens for federally authorized environments are not valid outside those boundaries, and that tokens are not logged with personal data. They should also factor the guidance into procurement and compliance discussions with vendors named in the public comment list.
The guidance is voluntary, but it reads like a checklist of controls that remove easy lateral-movement paths once tokens are no longer treated as permanent, opaque credentials. By tying key storage, rotation cadence and signing locality to impact level, the report aims to make a single stolen credential far less likely to become a widespread foothold across federal and connected systems. CISA and NIST have left broader AI agent controls for future work, and the agencies' next steps will be watching whether industry adoption follows the lines the public comments and the incidents drew.
https://www.infosecurity-magazine.com/news/cisa-nist-cloud-identity-token/
