NIST’s final token-protection guidance updates signing-key protection, validity decisions and workload identity recommendations. Here are practical questions for a focused cloud-control review.

CRA reporting duties apply before the regulation’s wider requirements. Manufacturers should review existing products, preserve awareness timestamps and track distinct final-report deadlines.

NIST has expanded its DevSecOps resources with SSDF mapping and implementation examples. Human-directed AI is demonstrated; agentic-AI work remains in planning.