Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
CISA’s October 4, 2023 announcement covered an Enduring Security Framework (ESF) publication on identity and access management challenges for developers and technology vendors—not a new product or a universal compliance mandate. Its central concern is technology gaps that make it harder for organizations to adopt and securely use multifactor authentication (MFA) and single sign-on (SSO). CISA encouraged defenders to discuss implementation with software vendors and said smaller organizations may also find the recommendations useful. Read CISA’s announcement.
Which CISA IAM guidance did the announcement refer to?
The October 2023 release announced Identity and Access Management: Developer and Vendor Challenges, authored through the Enduring Security Framework, a CISA- and NSA-led working panel with a public-private, cross-sector partnership. It examines obstacles faced by developers and technology manufacturers, especially gaps that constrain secure MFA and SSO adoption. CISA described the publication as guidance and recommendations, not a product endorsement or a universal requirement. The announcement identifies its purpose and intended audience; it does not verify the security claims of any particular vendor.
The announcement followed a separate ESF publication from March 2023: Identity and Access Management Recommended Best Practices Guide for Administrators. The two documents address different sides of the problem, so the developer-and-vendor release should not be mistaken for the administrator guide.
| Publication | Primary audience | Problem it addresses | Coverage |
|---|---|---|---|
| Identity and Access Management: Developer and Vendor Challenges (October 2023) | Developers and technology manufacturers; CISA says recommendations may also apply to smaller organizations. | Technology gaps that hinder secure adoption and use of MFA and SSO. | Developer and vendor challenges; the announcement does not enumerate detailed controls. |
| Identity and Access Management Recommended Best Practices Guide for Administrators (March 2023) | Administrators and organizational defenders. | Operational measures for securing and monitoring identity and access management. | Identity governance, environmental hardening, federation and SSO, MFA, and auditing and monitoring. See CISA’s announcement. |
What should administrators do with the companion guide?
The March guide organizes administrator practices into five areas. Its quick-reference material gives examples to adapt to the organization’s environment and risk:
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Identity governance: Inventory organizational assets and understand who has access to them.
- Environmental hardening: Identify existing security controls and remaining gaps.
- Federation and SSO: Assess which on-premises applications and cloud providers can connect through SSO.
- MFA: Select an MFA solution suited to the operating environment and maintain an inventory of authenticators.
- Auditing and monitoring: Track activity and network traffic for unexpected changes, including unusual application connections or external traffic.
The guide treats federation and SSO as part of a broader set of safeguards, alongside MFA, hardening, and monitoring. An SSO deployment on its own is not a substitute for those other controls.
How does the 2026 NIST token report relate?
A newer, separate development is NIST IR 8587, Protecting Tokens and Assertions from Forgery, Theft, and Misuse, finalized on September 15, 2026. It is not the 2023 ESF publication. It focuses on protecting identity tokens and assertions used in access systems, including SSO, federation, API access, and workload identity. NIST says its main audience is federal agencies and the cloud service providers they use, while the guidance may also help other organizations handling tokens and assertions. NIST’s announcement and the IR 8587 publication page describe the report.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Controls and lifecycle concerns in IR 8587
The report sets out considerations for cloud providers and the agencies that consume their services. It addresses identity-provider and authorization-server architecture, key management, token verification, and token lifecycle controls across SSO, federation, API, and workload-access scenarios. NIST’s final report reflects nearly 250 individual comments from more than 20 contributors; that count refers to input on IR 8587, not to the 2023 ESF guides or IAM adoption generally.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
NIST says revisions include more flexible signing-key guidance and an approach to token validity periods that considers system classification and transaction sensitivity. For workload identity, the report emphasizes short-lived tokens over static credentials and secrets. It also adds high-level considerations for artificial intelligence and post-quantum cryptography, while noting that it does not provide comprehensive tools for either topic. Its key-protection guidance takes an outcome-based approach and adds advice on key use, protection, and storage.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How to apply the guidance without assuming every recommendation fits
Use the publications according to the question being addressed: engage developers or vendors about product and implementation barriers to MFA and SSO; use the administrator guide to assess internal governance and controls; and consult IR 8587 when the issue concerns protecting tokens or assertions. The organization’s systems, risks, and access patterns determine which practices apply. For MFA, verify that any authenticator is compatible with the organization’s identity provider, devices, and policies; the cited government guidance does not endorse a specific product.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
