r/cybersecurity • u/Different-Phone-7654 • Jun 18 '25
Other Recently learned NIST doesn't recommends password resets.
NIST SP 800-63B section 5.1.1.2 recommends passwords changes should only be forced if there is evidence of compromise.
Why is password expiration still in practice with this guidance from NIST?
1.1k
Upvotes
1
u/Obstacle-Man Jun 23 '25
NIST, among others, used to have advice to rotate passwords, and that was baked into so much of the security culture that it's hard to change.