[andrewmcwatters]

One thought is that it is explicitly mentioned in NIST recommendations.

If you were attempting formal compliance, that would be how to do it.