I do it for the sake of educating our management. For now 10 years, I refuse to acknowledge the finding of the consulting company which flags the password sche

I do it for the sake of educating our management. For now 10 years, I refuse to acknowledge the finding of the consulting company which flags the password scheme I use (passphrases) because the norm they use (a national one) talks about czps, symbols etc. I refuse to sign off and note that our company is a scientific one and to the difference of the auditors, we understand math taught to 16 yo children. This goes to the board who gets back to me, I still refuse on ethical gtounds and we finally pass. This is sad that some auditors are stupid when some other are fantastic and that you depend on which one you get assigned. A good read: https://serverfault.com/q/293217/78319 https://serverfault.com/q/293217/78319