in accordance with Security Manual 4.2.1 (at least 24/at most 36 months).
run this daily or weekly from cron