Beyond the Login
A successful sign-in does not settle subsequent access.
NIST IR 8587, finalised 15 September 2026, guides cloud providers and consuming agencies on verification, signing keys and credential lifecycles; neither a new flaw nor an EU obligation.
IETF RFC 6750 explains why possession can permit access without repeating authentication or proving a separate cryptographic key. Protect confidentiality, lifetime and intended recipients. This does not make every token universally replayable or MFA useless.
Final changes separate signing-key custody from use, base validity on system classification and transaction sensitivity, and prefer brief workload credentials to static secrets.
Test continued access
Review administrative, federation and production-workload paths; record owners and trust-configuration authority.
- Record each credential’s intended service, lifetime and privileges; verify enforcement beyond design diagrams.
- Identify permitted signers, constraints and investigation of unusual use.
- In authorised tests, check account disabling, expiry and key changes; record delays and exceptions.
- Find copies in support exports, diagnostic logs, URLs and automation; restrict collection and retention while preserving response evidence.
- Find lasting secrets in jobs and deployments; agree supported migration rather than untested incident-time replacement.
- Rehearse revocation, surviving evidence and dependent-service restoration; test the customer/supplier responsibility boundary.
These are our questions, not a prescribed checklist. Protocol, credential type and platform matter. Password changes need not end every access path; one product’s revocation behaviour does not represent the estate.
Keep strong authentication; ask complementary MFA and credential issuance/checking/protection/retirement questions.
The separate Passportal case illustrates token-handling risk; it does not mean this guidance disclosed another flaw there.
Source chronology
Announcement metadata: created 14 September, updated 16 September. Its date and publication record agree with the final date above; no clocks are supplied. The protocol standard dates from October 2012, not a September 2026 disclosure.
