Every time I participate in a security audit for some enterprise contract I have to explain and defend why we don't enforce complexity and rotation rules. Late

Every time I participate in a security audit for some enterprise contract I have to explain and defend why we don't enforce complexity and rotation rules. Lately citing the NSA's change in position has been convincing enough and we don't get nearly as much push back.