Source summary On September 15, NIST announced the finalization of NIST IR 8587, guidance on protecting tokens and assertions developed jointly with CISA. It addresses protection against forgery, theft and misuse, covering responsibilities of cloud service providers and customer organizations. It sets protection objectives for areas such as key use and storage, and adds options concerning token revocation and related signal sharing. TABS Company's business perspective Review not only account login policies but also how integration tokens are created, stored, expired and revoked. Define permissions and operational owners for each cloud and AI tool, and verify how access is terminated when staff leave or credentials are exposed. Secret storage, key rotation, access logs and responses to unusual activity also deserve attention. Scope The guidance focuses on US federal environments but may also inform other organizations. It does not, by itself, determine the obligations of Korean businesses and should not be presented as a comprehensive AI security certification standard.