When (and how) to rotate

Rotation isn't theatre — it's how you contain a leak you may not know about yet. Rotate immediately when:

• An employee with access leaves the company
• A contractor or vendor finishes their engagement
• A device that knew the password is lost or stolen
• You suspect the password was photographed, screenshot, or shared externally
• At least every 6–12 months as a baseline