The National Institute of Standards and Technology finalized updated guidelines for protecting digital identity credentials and access tokens on Sept. 14, setting new standards for the security architecture underpinning government and commercial online authentication.
The guidelines serve as de facto national standards for digital identity verification and affect virtually every federal agency, federal contractor and eventually most private-sector online authentication systems, NIST said.
The updated standards address how digital credentials are issued, managed, stored and verified across networked systems. Access tokens, which allow users to authenticate their identities when logging into government portals, banking systems, healthcare platforms and commercial websites, are a primary focus of the update.
Every federal agency is required to comply with NIST identity and authentication standards. Federal contractors with access to government systems must also meet the requirements, creating a compliance cascade that reaches thousands of private-sector organizations.
The private sector typically adopts NIST cybersecurity standards on a rolling basis, as industry groups and regulatory bodies incorporate the guidelines into their own compliance frameworks. Financial regulators, healthcare oversight bodies and other sector-specific agencies frequently reference NIST standards in their own rules.
The update responds to evolving cybersecurity threats, including credential theft, phishing attacks and token compromise techniques that have been used in major data breaches affecting millions of Americans, according to NIST.
NIST developed the guidelines through a multi-year process that included public comment periods and input from government agencies, industry groups and academic researchers.
The Cybersecurity and Infrastructure Security Agency is expected to issue implementation guidance for federal agencies based on the finalized NIST standards. Agency compliance timelines will be set by the Office of Management and Budget.