ASVS 5.0 V6.4.5 requires that when an authentication mechanism expires, users get renewal instructions with enough lead time to finish before the old one stops working. Automated reminders are part of the answer. This is a Level 3 requirement.
Why it matters
Expiry that surprises people causes outages, and outages cause shortcuts. A client certificate that lapses on a Friday leads to a shared account or a disabled check. Reminders keep rotation routine instead of an emergency.
How to implement it
Track expiry as data, then schedule messages against it.
REMINDER_DAYS = [30, 14, 7, 1]
def run_daily():
for cred in db.credentials.expiring_within(days=max(REMINDER_DAYS)):
days_left = (cred.expires_at.date() - date.today()).days
if days_left in REMINDER_DAYS and not cred.reminded(days_left):
send_renewal_notice(cred.owner, cred, days_left)
cred.mark_reminded(days_left)
Each message should say what expires, when, and the exact steps to renew, with a link. Send to the owner and a team contact for machine credentials. Alert on credentials with no owner.
How to test it
- Seed a credential that expires in 30 days and advance the clock in a test. Confirm each reminder fires once.
- Check the instructions work end to end by renewing a test credential from the email alone.
- Verify a missing owner raises an alert.
Common mistakes
- Only one reminder, a day before.
- Sending to a mailbox nobody reads.
- Reminders without renewal steps.
Quick check
Do passwords count here?
Only if they expire under your policy. The requirement covers any authentication mechanism that has an expiry date.
