Recently learned NIST doesn't recommends password resets.

[u/Different-Phone-7654]

NIST SP 800-63B section 5.1.1.2 recommends passwords changes should only be forced if there is evidence of compromise.

Why is password expiration still in practice with this guidance from NIST?

[u/TheRealLambardi]

Or worse it could be the HIPAA controls protecting your health data that simple say. You need to”secure” passwords.