> One, has forced password changes at 6 month intervals (not as good as 90 days, but better than many!) Forcing password changes reduces overall security, espe

> One, has forced password changes at 6 month intervals (not as good as 90 days, but better than many!) Forcing password changes reduces overall security, especially for infrequently accessed services. It only normalizes the reset workflow, and enables easier social engineering. The NIST standard (800-53?) was updated to reflect this reality, and it no longer requires periodic password rotation.