5.4 Credential Rotation

Description

Credentials MUST be rotated on a defined schedule (90 days maximum).

Rationale

Credential rotation limits the window of opportunity for attackers using stolen credentials.

Audit Procedure

1. Document all credentials and creation dates
2. Check for rotation policy
3. Verify rotation automation

Remediation

1. Implement automated credential rotation
2. Set maximum credential lifetime
3. Implement rotation alerts

Framework Mappings