Has your org ended password expiration/regular password changes of user passwords?

As you likely know, NIST recommends against the practice of expiring user passwords after a period of time and instead only forcing password changes when there is compromise.

Has your organization actually ended the practice of expiring user passwords? If your organization hasn't, please consider sharing why not. If your organization did, consider sharing what other controls or strengthening your org did to go along with it.

[View Poll](https://www.reddit.com/poll/13l4wbe)

compromise cybersecurity expiration nist org organization password password expiration passwords period practice sharing