BCN-T3-IAM-002Tier 3 · Best PracticesIdentity & Access Management

Manual Credential Lifecycle

Credential provisioning, rotation, and revocation performed by hand rather than automatically.

Remediation SLA: 90 days
Tier: 3 · Best Practices
Domain: Identity
Escalation: Reviewed at quarterly planning; may be formally deferred

What this finding is

Credentials are managed through manual process — rotation performed on a calendar reminder, provisioning through ticket and console, revocation depending on someone remembering. The credentials are within policy today; the finding is that maintaining that state depends on human diligence.

Why it is Tier 3

Manual processes fail silently and eventually. Every long-lived credential finding at Tier 1 began as a manual rotation that stopped happening, which makes automation preventive work with clearly compounding returns. Tier 3 is correct because the current state is compliant — this is investment against future Tier 1 and Tier 2 findings rather than a present exposure.

Most common misclassification

Applied to privileged credentials that are already past their rotation interval. That state is BCN-T1-IAM-003; this finding covers process immaturity where credentials are currently within policy.

How to detect it

1Ask how rotation occurs; if the answer names a person or a reminder rather than a system, the finding applies.
2Compare actual rotation dates against policy intervals to see whether manual process is holding.
3Check whether revocation is triggered by an authoritative event or by notification.
4Identify credentials distributed by hand — chat, email, shared documents — which cannot be rotated without coordination.

How to remediate it

Steps are ordered. The first step is the one that reduces exposure fastest, which is not always the one that closes the finding.

1Adopt a managed secret store with automatic rotation for supported credential types.
2Replace static credentials with short-lived federated ones wherever the platform allows, which removes rotation from the problem entirely.
3Automate provisioning and deprovisioning from the authoritative identity source.
4Deliver credentials to workloads through the secret store rather than through people.
5Alert on credentials approaching maximum age so failures surface before expiry.

How to verify the fix

Rotation for supported credential types occurs automatically and is observable in the secret store's audit log, and a simulated leaver event triggers automated deprovisioning.