NIST SP 800-53 Rev. 5 · Identification and Authentication

IA-5(1) on Splunk

Credentials past required rotation — a published SPL query you can run against Splunk Enterprise / Enterprise Security, with the evidence it needs, the settings you decide, and what a result does and does not establish.

Why this matters

A password or key still in use long past the date it should have been replaced

Applications and automated systems sign in using long-lived keys rather than passwords typed by a person. These are created once, pasted into a configuration file, and forgotten. They frequently outlast the project, the vendor, and the employee who created them, and a key that leaks stays useful to whoever finds it for as long as it remains valid.

Why this check earns its place. Nobody receives a reminder that an application key is ageing. There is no login prompt to nag anyone, so the only way to find them is to go looking.

What it reads: The organization's own inventory of application keys and when each was created.
What it reports: Keys older than the organization's own replacement interval, and keys about to stop working without warning.

See related public disclosures on the Signals page →

ControlIA-5(1) — Authenticator Management | Password-Based Authentication

PlatformSplunk (SPL)

SeverityMedium

ValidationLab-validated

What this finds

Active credential older than the rotation interval, or approaching hard expiry.

The requirement

The organization must enforce authenticator lifetime restrictions and require authenticators to be changed or refreshed at an organization-defined frequency.
NIST SP 800-53 Rev. 5 — IA-5(1) (Authenticator Management | Password-Based Authentication).

NIST requires a defined refresh frequency without setting it. The 90-day rotation interval below, and any exemption for credentials managed by an automated rotation service, are local decisions.

How this maps to the CISA performance goals

The Cross-Sector Cybersecurity Performance Goals are a voluntary baseline published by CISA — the U.S. federal agency for critical-infrastructure cybersecurity — written for organizations too small to employ security staff. This control speaks to:

3.C — Create unique credentials (partial — see note)
CPG 2.0 has NO goal for credential rotation age. Current NIST guidance moved away from forced periodic rotation, so this pack answers an organization-defined policy rather than a CPG. Mapped here only because both concern credential hygiene -- do not present it as satisfying 3.C.

See the full coverage map, including the goals no query can answer →

Evidence this query needs

None. This query runs on platform telemetry alone — there is no file to prepare and nothing to export.

The query

Published as ia-5-1-credential-rotation.splunk.spl. Reads index=identity sourcetype=credential:inventory. Requires: Search access to the identity index.

Before this returns anything, index=identity sourcetype=credential:inventory has to be reaching Splunk Enterprise / Enterprise Security. If not, the query reports nothing found — which looks exactly like nothing wrong. What has to be switched on first →

index=identity sourcetype=credential:inventory
| dedup credential_id
| where managed_rotation!="TRUE"
| eval rotated_epoch=strptime(last_rotated,"%Y-%m-%d")
| eval age_days=round((now()-rotated_epoch)/86400)
| where age_days > 90
| eval severity=case(age_days>365,"critical",
                     age_days>180,"high",
                     1=1,"medium")
| table credential_id, principal, credential_type, source_system,
        last_rotated, age_days, severity
| sort - age_days

Open this pack on Splunk to adjust the settings and download it →

The interactive version opens on Splunk — the platform on this page — even if your environment profile does not list it.

Settings you decide

NIST states the objective and leaves these to your organization. The interactive version of this pack applies them to the query for you.

Rotation interval (days) (default 90): Credentials older than this are reported.

What this query returned when it was run

Executed against Splunk Enterprise 10.4.2 on 2026-08-07 against purpose-built test data. The software examined 4 records and returned 2 results in 0.078 seconds.

credential_id	principal	credential_type	source_system	last_rotated	age_days	severity
CRED-9002	svc-reporting	access_key	AWS IAM	2025-07-03	401	critical
CRED-9001	svc-etl	access_key	AWS IAM	2026-01-19	201	high

Test data, not a real organization. It shows the query executes and returns the intended shape of result.

Running it continuously

Correlation search → notable event

Search type:      Correlation search (Enterprise Security)
Cron schedule:    0 5 * * *   (daily, 05:00)
Time range:       -2d to now
Trigger:          Number of results > 0
Alert action:     Create notable event
Urgency:          Medium (escalates by computed severity)
Security domain:  Access
Throttling:       Suppress 7d on credential_id

The computed severity band lets one search serve both routine rotation hygiene and genuinely aged credentials without splitting into separate rules.

What a result does not prove

Credential age alone does not indicate compromise. It indicates that the organization's own rotation requirement has not been evidenced for this credential.

Validation status for this platform: Lab-validated. Executed by the maintainer in a personally controlled laboratory environment on the date shown. Table names, field names, and operator support still vary by tenant configuration, API version, connector, and add-on.

Before you act on a result

Is the credential under an automated rotation service this query does not see?
Is the credential still in use, or is it an orphan that should be deleted rather than rotated?
Would rotation break a dependency that needs coordinated change?
Is there a documented exception with an expiry?

Common questions

How do I check for credentials past required rotation in Splunk?: Run the published SPL query on this page against Splunk Enterprise / Enterprise Security. It reads index=identity sourcetype=credential:inventory and reports: Active credential older than the rotation interval, or approaching hard expiry.
What permissions are needed to run this Splunk query?: Search access to the identity index.
Does a result from this query mean the control has failed?: Credential age alone does not indicate compromise. It indicates that the organization's own rotation requirement has not been evidenced for this credential.

Terms used on this page

NIST SP 800-53the U.S. federal catalogue of security requirements: The catalogue of security and privacy requirements published by the National Institute of Standards and Technology, a U.S. federal agency. U.S. government systems are measured against it, and many private organizations adopt it voluntarily. Each requirement has an identifier such as AC-2. Official source →
CISACybersecurity and Infrastructure Security Agency: The U.S. federal agency responsible for national critical-infrastructure cybersecurity. Its publications are works of the U.S. government and are free to use. Official source →
SPLSearch Processing Language: The language used to ask questions of data held in Splunk. A query written in it is text and can be read before it is run.
CPGCross-Sector Cybersecurity Performance Goals: A voluntary baseline of security practices published by the U.S. Cybersecurity and Infrastructure Security Agency, written specifically for organizations too small to employ security staff. It is a short, plainly written starting list rather than a full standard. Official source →
lab-validatedexecuted in a controlled test environment: The check has been run, by the maintainer, against real security software loaded with purpose-built test data, and what it returned was recorded. It has not been run on any real organization's data.

Every term this project uses →