forcing users to change their password every 90 days does…
forcing users to change their password every 90 days does not make you secure, it makes everyone go from Summer2024! to Summer2024!! and write it on a sticky note. NIST dropped this advice in 2017. your IT policy is doing security cosplay, not security