4 ms·
NIST changed those rules a few years ago, I think. I remember thinking "please, PLEASE let companies follow suit...". And still, very few have :(
by GordonS 6y ago
NIST changed those rules a few years ago, I think. I remember thinking "please, PLEASE let companies follow suit...".
And still, very few have :(
- kipchak 6y agoI think it's new as of the 2019 revision, though it wouldn't surprise me if it's been ignored for a while. I don't think CMMC requirements specifically call out expiration periods, so hopefully a good sign. Microsoft seems to be fairly forward thinking[1] on passwords, doing away with expiration requirements and focusing more on their risk based MFA stuff. [1]https://www.microsoft.com/en-us/research/wp-content/uploads/2016/06/Microsoft_Password_Guidance-1.pdf https://www.microsoft.com/en-us/research/wp-content/uploads/...
- dlgeek 6y agoPCI/DSS hasn't yet, so that's holding up a lot of them.
- downtown_ 6y agoYou are allowed to use the NIST Guidance as a reason to change that to a longer timeframe. I have a couple of clients that are using 365days as of 2019.