This is an automated archive.
The original was posted on /r/sysadmin by /u/lighthills on 2024-01-22 15:36:18+00:00.
For years, NIST has recommended against requiring password changes on an arbitrary schedule. However, there are caveats requiring controls on the quality of the passwords (beyond just upper/lower/special character etc.) and you are required to have methods in places to detect compromised passwords so you will immediately know when the password needs to be changed due to a breach. If you don't have that in place, you still need to rotate the passwords regularly when following NIST.
I heard that PCI no longer requires maximum password age limits. What's still left?