Regular forced changed of passwords is generally a net-negative for security. There's nothing wrong with changing if you think it's been breached or just 'caus

Regular forced changed of passwords is generally a net-negative for security. There's nothing wrong with changing if you think it's been breached or just 'cause you feel like it, but a system forcing change every 90 days is likely to be a bad idea. This is due to the fact that when most user groups are forced into periodic change they will stick an enumerator at the end (e.g. password1, password2 etc) which ruins any benefit you might have got from it. That's why we've (finally) started to see good official guidelines saying forced password rotation is a bad idea (e.g. https://www.ncsc.gov.uk/guidance/password-guidance-simplifying-your-approach https://www.ncsc.gov.uk/guidance/password-guidance-simplifyi... and https://nakedsecurity.sophos.com/2016/08/18/nists-new-password-rules-what-you-need-to-know/ https://nakedsecurity.sophos.com/2016/08/18/nists-new-passwo... )