Although password routine expiry is not a recommended strategy now, it'a really good indication of how this can look. For a long time, people like insurance co

Although password routine expiry is not a recommended strategy now, it'a really good indication of how this can look. For a long time, people like insurance companies had an "enforceable standard" for 60/90 day password rotation. And in every single business I looked at, they "had a password rotation policy", but then three key executives didn't like it so "do not expire password" got ticked on their accounts as some "accepted exemption". This sort of thing always passed audits, and marketing always wrote information about how the business had a strict password expiry policy. And those executives were the most likely to be compromised. I think if you go too far down a "minimum standard" path, that's the sort of thing you're going to see.