Trying to adopt NIST password guidelines

I have been trying to get my org to change the password change requirements from 90 days to a year in order to be more in line with NIST framework. This would prevent users from having issues all the time with password changes and hopefully cause less writing passwords down and storing in plain text from users.

Anyways, one of NISTs recommendations is to screen passwords against commonly breached password lists. What sort of tools are you all using to …

change cybersecurity down framework guidelines nist nist framework nist password guidelines order org password passwords requirements writing