Appearance
Key and Credential Rotation Schedule
Requirement: HIPAA §164.312(a)(2)(iv) — encryption/decryption, access control. SOC2 CC6.1/CC6.6 — logical access controls, credential management.
Owner: Rory
Review cadence: Quarterly — verify last-rotated dates and update this log after each rotation.
This document is the authoritative rotation schedule for all credentials and cryptographic material at Cirius Group. Auditors use this to verify that credentials are periodically rotated and that rotation is tracked.
Rotation Schedule
Certificates — Automated Monitoring
Monitored continuously by cert_expiry_agent. Rotation is triggered by findings, not a fixed calendar. See Certificate Renewal Procedure.
| Certificate | Alert at | Owner | Last Renewed | Notes |
|---|---|---|---|---|
| OneLogin SAML — Keeper | 90 days remaining | Rory | (populate) | Triggers SSO lockout if expired |
| OneLogin SAML — Zendesk | 90 days remaining | Rory | (populate) | |
| OneLogin SAML — Zendesk (secondary) | 90 days remaining | Rory | (populate) | |
| OneLogin SAML — KnowBe4 | 90 days remaining | Rory | (populate) | |
GlobalProtect wildcard *.ciriusgroup.com | 90 days remaining | Rory | (populate) | Import to Panorama |
Privileged / Break-Glass Accounts — Annual + After Use
| Account | Rotation Frequency | Last Rotated | Notes |
|---|---|---|---|
| cirius-breakglass@ciriusgroup.com | Annual + immediately after any use | (populate) | Keeper → Break-Glass — Entra |
| cirius-breakglass@ciriusdde.com | Annual + immediately after any use | (populate) | Keeper → Break-Glass — Entra |
| AD Break-Glass — Primary DC | Annual + immediately after any use | (populate) | Keeper → Break-Glass — On-Prem AD |
| AD Break-Glass — RODC | Annual + immediately after any use | (populate) | |
| AD Break-Glass — Domain Admin (DR) | Annual + immediately after any use | (populate) | |
| AWS Root — Management (206820231356) | Annual + after any root use | (populate) | Keeper → Break-Glass — AWS Root |
| AWS Root — Production (807267566999) | Annual + after any root use | (populate) | |
| AWS Root — Logging (038901680748) | Annual + after any root use | (populate) | |
| AWS Root — Networking (238342914131) | Annual + after any root use | (populate) | |
| AWS Root — Identity (414134953818) | Annual + after any root use | (populate) | |
| AWS Root — Backup (863609217450) | Annual + after any root use | (populate) | |
| AWS Root — Dev (040067931468) | Annual + after any root use | (populate) | |
| Palo Alto Admin — Azure PublicFW | Annual + after any local login | (populate) | Keeper → Break-Glass — Palo Alto |
| Palo Alto Admin — Azure PrivateFW | Annual + after any local login | (populate) | |
| Palo Alto Admin — DDE Firewall | Annual + after any local login | (populate) | |
| Palo Alto Admin — AWS DR Firewall | Annual + after any local login | (populate) | |
| Panorama Admin — AWS DR | Annual | (populate) | Keeper → Panorama |
| Panorama Admin — DDE | Annual | (populate) |
Service Accounts and API Keys — Annual
| Credential | Rotation Frequency | Last Rotated | Where Stored | Notes |
|---|---|---|---|---|
| SecOps API Key (agents → platform) | Annual | (populate) | Key Vault: cirius-openai-kv-prod | Update Container App env vars after rotation |
| Azure OpenAI API Key | Annual | (populate) | Key Vault: cirius-openai-kv-prod | |
| Container Registry token — kobe-bot | Annual | (populate) | Keeper → Infrastructure — Shared | |
| GitHub PAT — cirius-kobe-bot | Annual | (populate) | Keeper → Infrastructure — Shared | |
| Arctic Wolf API credentials | Annual | (populate) | Keeper → Vendor Accounts | Coordinate with Arctic Wolf |
| Veeam console admin password | Annual | (populate) | Keeper → Vendor Accounts | |
| Cloudflare API token | Annual | (populate) | Keeper → IT Operations | Scoped to zone edit only |
| Keeper master password (break-glass) | Annual | (populate) | Physical emergency kit | Backup when SSO unavailable |
MFA Credentials — Recovery Codes and Hardware Tokens
| Item | Rotation / Verification | Last Verified | Notes |
|---|---|---|---|
| AWS root MFA recovery codes (all 7 accounts) | After any root account access | (populate) | New codes generated on root login reset |
| Entra break-glass MFA setup | Annual verification | (populate) | Verify MFA still works; rotate if suspicious |
| Keeper admin MFA recovery codes | Annual | (populate) |
Encryption Keys — Managed by Platform (No Manual Rotation)
These are managed automatically by Azure/AWS and do not require manual rotation:
| Key | Platform | Rotation | Notes |
|---|---|---|---|
| Azure CMK (Customer Managed Keys) | Azure Key Vault | Auto-rotate annually if configured | Set auto-rotation policy in Key Vault |
| S3 SSE-KMS keys (backup buckets) | AWS KMS | Annual auto-rotation | Enabled in Terraform |
| Terraform state storage encryption | Azure Storage CMK | Platform-managed | |
| LAW workspace encryption | Microsoft-managed | Platform-managed | Not CMK currently |
How to Perform a Rotation
Annual Rotation Workflow
- Generate new credential — use Keeper's password generator (16+ chars, mixed case, symbols)
- Test the new credential before revoking the old one (where possible — service accounts)
- Update all systems that use the credential:
- Keeper record (update the password field)
- Key Vault secret (if machine-to-machine)
- Any hardcoded references (there should be none — secrets live in Key Vault only)
- Container App environment variables (if an API key changed)
- Verify the change works end-to-end before confirming rotation complete
- Update this document — fill in the Last Rotated date
- For break-glass accounts: test the account can actually log in after rotation
Documenting a Rotation
After completing any rotation, update the table above with the date. Format: YYYY-MM-DD.
If a rotation was triggered by a security event rather than the annual schedule, note it in the table (e.g., 2026-05-25 — emergency rotation after incident INC-0042).
Rotation Triggers (Out-of-Cycle)
Rotate immediately — do not wait for the annual cycle — when:
- A credential was used by someone no longer at the company
- A credential appears in a SecOps alert (credential exposure, phishing success)
- A GitHub secret scanning alert fires for a committed credential
- A break-glass account was used (any use requires immediate post-use rotation)
- A team member with access to shared credentials leaves the company
- A vendor relationship ends (revoke their access and rotate shared creds)
Log emergency rotations in the table and in SecOps if related to an incident.
Auditor Notes
For SOC2 CC6.1/CC6.6 evidence:
- Point to this document as the rotation policy and schedule
- The Last Rotated column shows rotation occurred
- Keeper audit log shows who changed each record and when (Keeper Admin Console → Reports)
- For certificates: cert_expiry_agent findings history in SecOps shows monitoring was active
For HIPAA §164.312(a)(2)(iv): the rotation schedule demonstrates that encryption and access control credentials are periodically refreshed as required.
Document History
| Date | Change | Author |
|---|---|---|
| May 2026 | Initial draft — consolidated rotation schedule for all credential types: certs, break-glass, service accounts/API keys, MFA, platform-managed keys. | Rory |