NIST have updated their password advice but it's still not flowed through to other places like PCI, Australian ISM or tons of other standards. If you're settin

NIST have updated their password advice but it's still not flowed through to other places like PCI, Australian ISM or tons of other standards. If you're setting an org-wide policy it should (at least in theory) comply with the intersection of all the other crappy standards you're stuck with.... which means password complexity and pointless expiration requirements for at least a few more years :-/ The paperwork/compliance lag issue mainly affects internal systems and directory, but can flow on to public sites as well.