Key rotation enforced annually

CWE-324 (use of a key past its expiration date) describes the accumulating risk of long-lived keys: the longer a key is in use, the more ciphertext an attacker accumulates to attempt cryptanalysis against, and the longer a previously undetected key compromise remains exploitable. NIST SP 800-57 Part 1 sets maximum key usage periods; for symmetric keys protecting sensitive data, annual rotation is the established upper bound. PCI-DSS 4.0 Req-3.7.4 explicitly requires cryptoperiod management for encryption keys. An unrotated key that was compromised six months ago continues to expose all data encrypted since the compromise — rotation limits the blast radius of any past key exposure.

Enable automatic annual rotation in your KMS — this is one console toggle, not a code change. For AWS KMS:

AWS Console → KMS → Customer managed keys → [your key] → Key rotation → Enable automatic key rotation

For Google Cloud KMS:

gcloud kms keys update [KEY_NAME] \
  --location=[LOCATION] \
  --keyring=[KEYRING] \
  --rotation-period=365d \
  --next-rotation-time=$(date -u -d '+365 days' +%Y-%m-%dT%H:%M:%SZ)

If you manage keys manually, create a rotation log at docs/key-rotation.md with signed entries and a calendar reminder. Manual rotation without a dated audit trail fails this check even if rotation occurred — the evidence requirement is a log entry, not just a newer key version.