On September 15, 2026, the U.S. National Institute of Standards and Technology moved its token-security work from draft to final. In its announcement for NIST IR 8587, _Protecting Tokens and Assertions from Forgery, Theft, and Misuse_, NIST said the publication had been modified and expanded after public feedback on a December 2025 draft. NIST’s summary of those changes is specific but narrow: the final version is less prescriptive on cryptographic key protection, adds more advice on key usage, protection and storage, introduces high-level considerations for AI and migration to post-quantum cryptography standards, and adds references to current and emerging standards, including more options for token revocation and sharing signals around tokens (NIST announcement, September 15, 2026, NIST updates index).
What that finalization does not establish is just as important. NIST says the document is primarily written for federal agencies and the cloud service providers they work with, while also being potentially useful to other organizations that handle identity tokens and related assertions (NIST announcement). The records retrieved here do not show a universal compliance deadline, a mandatory control set for every sector, or measured evidence that the guidance has already changed outcomes in production. "Final" in this record means the guidance process is complete, not that the market has reached a settled implementation result.
That still leaves a practical question for identity and cloud teams. The safest reading of the record is not "buy a new platform." It is to inspect where tokens and assertions are issued, stored, validated, shared and invalidated, and which signing keys protect those flows. That is an analytical inference from the areas NIST highlighted, not a claim that any single architecture is now endorsed or sufficient.
A revised CISA post helps explain why this guidance landed now, but it should be treated as background, not as a fresh September 2026 incident count. The page is labeled Released July 15, 2025 and Revised September 15, 2026. In that post, CISA says review of recent cloud security incidents shows threat actors forging tokens, exploiting vulnerabilities and using stolen credentials, and it points to token technology, secrets management, logging and forensic capabilities as areas providers can harden (CISA blog). Useful context, yes. A newly measured 2026 trend line, no.
The European Commission’s EUDI Wallet testing pages show where token questions become operationally messy. A Commission page last updated on September 24, 2026 says Launchpad Testing 2026 is shifting toward validating how solutions work together under real-world conditions ahead of launch. Its listed scope includes peer-to-peer testing, the eIDAS Dashboard and Lists of Trusted Entities for trust establishment, and the IETF Token Status List draft 12 (Launchpad Testing 2026). That documents testing scope, not launch success, certification or adoption.
The more durable distinction is between identity assurance and token lifecycle security. The Commission’s eIDAS Levels of Assurance explainer, last updated on February 2, 2026, defines assurance as the degree of confidence in the claimed identity of the person using an eID, based on enrolment, management, design and authentication controls (eIDAS Levels of Assurance). That is a different layer from NIST’s token-handling focus. A service can perform a high-assurance identity check and still mishandle bearer tokens afterward. The useful takeaway from this record is a sharper checklist: separate proof-of-identity questions from token-protection questions, and do not mistake finalized guidance for evidence that either problem is already solved.
_Disclosure: This is an AI-assisted draft prepared from the public records linked above. It includes no original interviews or documentary images and requires human editorial review before any publication decision._
