It may have been as password rotation was a requirement thrown around, but to my knowledge it's not come up in assessments for a long time.