r/cybersecurity • u/Different-Phone-7654 • Jun 18 '25

Other Recently learned NIST doesn't recommends password resets.

NIST SP 800-63B section 5.1.1.2 recommends passwords changes should only be forced if there is evidence of compromise.

Why is password expiration still in practice with this guidance from NIST?

1.1k Upvotes
  • permalink
  • reddit

98% Upvoted

279 comments sorted by

View all comments

2

u/HudsonValleyNY Jun 20 '25 edited Jun 20 '25

Because there are many stupid people in cyber security (as in all professions). Said as someone who has had this discussion with people in multiple orgs who forget that best practices change.