Agreed. But being prepared for key rotation, on the other side, is an important requirement IMHO.
Would you like to submit a PR with better details and mitigation?

from pytm.

What is the policy for changing an SID? Should this get a new SID or can this just be rewritten?

Further I would suggest to extract the Lifetime.HARDCODED condition and make this a new threat, since this is a design failure, which can not be fixed.

Here a first draft to change AC22:

Credential disclosure

If credentials (passwords and certificates) have a long lifetime their disclosure can have severe consequences, if the credentials cannot quickly be revoked and/or rotated.

Mitigations

All credentials need a possibility to be revoked immediately and the credentials have to have high enough entropy and length to be future proof.
To detect disclosure of the credentials their use should to be monitored for suspicions activity.

References

• NIST SP 800-63-3

from pytm.

@izar should I write a PR?

from pytm.

sure thing!

from pytm.

@noloader could you also look over my PR and give your opinion?

from pytm.