Skip to main content
← All controls
IA-5(1) / A.9.3.1 / CIS-5.3 NIST SP 800-53 Rev 5

Automatic rotation enabled

Demonstrate that cryptographic keys, secrets, and credentials are automatically rotated according to defined policies without manual intervention, and that rotation events are logged and auditable.

Description

What this control does

Automatic rotation enabled ensures that cryptographic keys, secrets, passwords, API tokens, and certificates are replaced on a scheduled basis without manual intervention. This control leverages automated processes—often integrated with secret management platforms, cloud key management services (KMS), or privileged access management (PAM) systems—to enforce expiration and replacement policies. By eliminating reliance on manual rotation, this control reduces the window of exposure for compromised credentials and enforces consistent lifecycle management across environments.

Control objective

What auditing this proves

Demonstrate that cryptographic keys, secrets, and credentials are automatically rotated according to defined policies without manual intervention, and that rotation events are logged and auditable.

Associated risks

Risks this control addresses

  • Prolonged use of static credentials increases the window of opportunity for credential-based attacks following initial compromise
  • Manual rotation processes are deferred or forgotten, resulting in indefinite credential validity and accumulation of stale secrets
  • Stolen or leaked credentials remain valid for extended periods due to lack of enforced expiration
  • Insider threats with access to long-lived credentials can maintain persistent unauthorized access without detection
  • Compromised service accounts or API keys enable lateral movement and privilege escalation if not regularly invalidated
  • Hardcoded secrets in code repositories or configuration files remain exploitable when rotation does not occur
  • Regulatory non-compliance due to failure to enforce periodic credential lifecycle management as required by data protection standards

Testing procedure

How an auditor verifies this control

  1. Identify all systems, services, and platforms storing or managing cryptographic keys, secrets, passwords, API tokens, certificates, and service account credentials within scope.
  2. Obtain and review the organization's credential rotation policy, including rotation frequency requirements for each credential type and classification.
  3. Export configuration settings from secret management systems, KMS platforms, PAM solutions, and certificate authorities to verify automatic rotation schedules are enabled.
  4. Select a representative sample of active credentials spanning different types (database passwords, API keys, TLS certificates, encryption keys, service account tokens) and retrieve their rotation history logs.
  5. Verify that each sampled credential has been rotated within the policy-defined interval by comparing current rotation timestamps against policy requirements.
  6. Review audit logs and rotation event records to confirm that rotation occurred automatically without manual administrator action or intervention.
  7. Identify any credentials excluded from automatic rotation and validate that documented risk acceptance or compensating controls exist for each exception.
  8. Test notification and alerting mechanisms by reviewing records of rotation failures, expiration warnings, or service disruptions caused by rotation events to confirm monitoring is active.
Evidence required Configuration exports from key management services, secret vaults, and PAM platforms showing enabled automatic rotation policies and schedules. Rotation event logs or audit trails demonstrating timestamp records, credential identifiers, and automated trigger sources for rotation activities over the audit period. Policy documentation defining rotation intervals by credential type, exception lists with risk acceptance forms, and alert or notification records for rotation events or failures.
Pass criteria All in-scope credentials subject to automatic rotation have been rotated within the policy-defined intervals, rotation events are logged with evidence of automated execution, and any exceptions are formally documented with approved risk acceptance or compensating controls.

Where this control is tested

Audit programs including this control