# IAM-06 Credential rotation

Domain: IAM Identity, Access & Authorization · HI-AAF v1.3 · Public review · https://humanintel.net/standard/iam/iam-06

Credentials and tokens are rotated on a documented schedule, with evidence of execution.

Agent credentials are rotated on a documented cadence and on personnel changes that affect the risk-owner role. Rotation is executed, not just planned, and evidence of execution is retained. Stale credentials are one of the highest-risk findings in agent deployments because they survive long after the context that justified them has changed.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for IAM-06: Rotation schedule is documented; rotation has been executed within the documented cadence; evidence of execution is retained; rotation on personnel changes has been tested or executed.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Rotation schedule is documented.
- Rotation has been executed within the documented cadence.
- Evidence of execution is retained.
- Rotation on personnel changes has been tested or executed.

## Framework mappings

- ISO/IEC 42001: A.7.4
- SOC 2 (TSC): CC6.1, CC6.2
- EU AI Act: Art. 15(2)
- Singapore: AI Verify Security

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Cite this control

Human Intelligence. HI-AAF v1.3, IAM-06 Credential rotation. Public review edition, July 2026. https://humanintel.net/standard/iam/iam-06