NIST itself has been actively discouraging password rotation since 2016: https://pages.nist.gov/800-63-3/sp800-63b.html#memorizedsecr...

But then how will Cyberark make money?

I expect you have 3M lobbying on the other side of the issue in the interest of post-it sales.

I am so sending this to our district IT people the next time they make us change our passwords at school.

NIST discourages it, but most of the US government still requires it. In fact, I used to have a 60-day password rotation policy with such brilliant requirements as "no more than three characters of one class sequentially."

I soon realised that "ShitFuck!", thus, was a valid password -- and off I went. Meanwhile, a teammate who had previously been a technical writer contracting with the NSA told of the "waterfall method" -- not of software developments, but of passwords. It was common in his world, apparently, and you could always hear he was typing his password by the staccato of QazWsxEdc123, etc.

It's always amuses me what a domain name with a number in it ticks '3 of 4'.

The PCI-DSS website itself requires that you change password every 12 months. At the same time the period for recertifying PCI-DSS is ... every 12 months. I have a systematic way to create a new password each time, which probably isn't secure.

I have to rotate my password at work every 3 months. Without a system, it wouldn’t be sustainable.

Got into a quarrel about this with our IT director at a previous company. I wish there was a security best practices FAQ I could link to for this sort of stuff.

As a peer post of yours pointed out, NIST changed guidance to discourage password changes years ago:

https://pages.nist.gov/800-63-3/sp800-63b.html#memorizedsecr...