diff --git a/src/dda/backup/cred_rot.clj b/src/dda/backup/cred_rot.clj
new file mode 100644
index 0000000..761def0
--- /dev/null
+++ b/src/dda/backup/cred_rot.clj
@@ -0,0 +1,22 @@
+(ns dda.backup.cred-rot
+  (:require
+   [orchestra.core :refer [defn-spec]]
+   [clojure.spec.alpha :as s]
+   [dda.backup.cred-rot.domain :as domain]))
+
+(s/def ::new-password-file string?)
+
+(s/def ::cred-rot
+  (s/keys :req-un []
+          :opt-un [::new-password-file]))
+
+; Refer to "docs/CredentialRotation.md" for specifics 
+
+(defn-spec maybe-add-new! nil?
+  [config ::cred-rot]
+  (when-let [{:keys [new-password-file]} config]
+    (domain/add-new-password! new-password-file)))
+
+(defn-spec replace-old-password! nil?
+  []
+  )
diff --git a/src/dda/backup/cred_rot/domain.clj b/src/dda/backup/cred_rot/domain.clj
new file mode 100644
index 0000000..f05ce35
--- /dev/null
+++ b/src/dda/backup/cred_rot/domain.clj
@@ -0,0 +1,18 @@
+(ns dda.backup.cred-rot.domain
+  (:require
+   [orchestra.core :refer [defn-spec]]
+   [clojure.spec.alpha :as s]))
+
+(s/def ::new-password-file string?)
+
+; Refer to "docs/CredentialRotation.md" for specifics 
+
+(defn-spec add-new-password! nil?
+  [new-password-file ::new-password-file]
+  ; TODO
+)
+
+(defn-spec replace-old-password! nil?
+  []
+  ; TODO
+)
\ No newline at end of file