My understanding is that most password policies are set by validation orgs to get certs like ISO. Those orgs are notoriously bad at most things aside from maki

My understanding is that most password policies are set by validation orgs to get certs like ISO. Those orgs are notoriously bad at most things aside from making useless checklists.