Stop Changing Passwords Every 90 Days: What Modern Password Security Actually Looks Like

Every few weeks someone asks us to loosen a password policy. Can we stop passwords from expiring? Can we drop the two-step login for a couple of people who find it a hassle? Can we make the password rule simpler so the front desk stops calling for resets?

The requests are reasonable. A few people are frustrated, work slows down, and relaxing the rule looks like an easy win. We usually say no anyway, and here's the honest reason.

Most of the time you're asking us to relax the wrong rule. The password policy people hate, the 12-character mix of symbols that has to change every 90 days, was never very good to begin with. It's annoying and weak at the same time. It trained everyone to pick "Summer2025!" then "Summer2026!" and to reuse that password everywhere. The good news is that the modern guidance already agrees with your instinct. Password security got easier over the last few years, not harder. It just got easier in a different direction than most companies expect.

What good password guidance looks like now

The clearest reference point for this is NIST, the National Institute of Standards and Technology. Their digital identity guidance, SP 800-63B, was updated to Revision 4 and finalized in July 2025. It's written primarily for federal systems, so no private business is legally bound to it, but we use it as our benchmark because it reflects where the research actually landed. Here's what it says, and most of it runs opposite to the rules people still carry around in their heads.

Length beats complexity. NIST now treats length as the main driver of password strength and says the old composition rules (one capital, one number, one symbol) tend to produce weaker passwords, not stronger ones, because people game them in predictable ways. The current floor is 15 characters when a password is the only thing guarding an account, and systems should accept at least 64 so people can use full passphrases. When the password sits behind multi-factor login, the minimum drops to 8, because the second factor carries the load.

Stop forcing scheduled resets. NIST says not to expire passwords on a calendar. Force a change only when there's real evidence the password may be exposed. Routine 60 or 90 day rotation just pushes people toward small, guessable tweaks and more reuse. If you're still running a quarterly expiration, that's the old model, and it's costing you help-desk calls for no security gain.

Screen for known-bad passwords. Instead of complexity theater, check new passwords against a blocklist of common and previously breached ones and reject the bad matches. That's the step that actually keeps weak passwords out, and users barely notice it.

Let people paste, and let them use a password manager. The guidance says password fields should allow paste and work with password managers. Blocking paste only ever punished the people using the safest tool available.

Use multi-factor authentication, and know that the type matters. NIST pushes MFA hard and, at higher assurance levels, calls for phishing-resistant methods. It brings passkeys into the standard and downgrades SMS text codes and email one-time codes, because both can be intercepted or phished. More on that below, because it's the part worth getting right.

Notice that almost none of this is more work for your people. A passphrase you can remember, no quarterly reset scramble, a manager that fills logins in for you. The current best practice is less annoying than the thing it replaced.

The risk you're actually weighing

The friction is real. So is what happens when authentication fails, and the data has shifted in a way worth being precise about.

For years, stolen credentials were the number one way attackers got into businesses. That changed in 2026. Verizon's latest Data Breach Investigations Report found that vulnerability exploitation is now the top initial access vector at 31 percent, and credential abuse dropped to 13 percent as the way-in. That's the first time in the report's history that stolen credentials lost the top spot.

Do not read that as "passwords matter less now." Read the rest of the report. When Verizon counts credential abuse anywhere in the attack, not just the first step, it shows up in 39 percent of breaches, more than any other single factor. Attackers still need valid logins to move through your network, reach the good data, and stay in. The front door changed. The hallway didn't.

Reuse is what makes stolen passwords so useful to them. A 2025 study pulled together more than 19 billion leaked passwords and found only about 6 percent were unique values across that pile. The rest were duplicates and repeats. That's a dataset measurement, not proof that 94 percent of people are careless, but the direction is clear enough: the same passwords turn up over and over, which is exactly why an attacker will try a password leaked from some random website against your email and your payroll.

Then there's malware. Infostealers, the class of malware built to grab saved logins, had a heavy year. Modern browsers do encrypt saved passwords now. Chrome uses app-bound encryption on Windows, and Edge encrypts credentials on disk and ties them to the device. That's a real improvement over the old days. What it doesn't stop is malware running as the signed-in user, which is precisely the situation infostealers create. Once something is executing as you on your machine, it can often reach what your browser can reach. Browser-stored passwords are a smaller target than they used to be, but they're still a target, and they still travel with the browser profile.

If you do defense or government work, some of this isn't optional

This part matters most for our manufacturing and defense-adjacent clients, and it's where "we'd rather not" stops being a real answer.

If your company handles federal contract information or controlled unclassified information, you fall under CMMC, the Cybersecurity Maturity Model Certification, which is built on the NIST SP 800-171 controls. The DFARS rule that puts CMMC into defense contracts became effective November 10, 2025. Self-attestation without outside verification is on its way out.

The level you're held to decides how strict the login rules get. CMMC Level 1 covers the less sensitive federal contract information. For authentication it mostly wants unique identities and basic authentication, no shared logins. It does not mandate MFA. If that's your scope, the general guidance in this article is a fine target.

CMMC Level 2 is a different world. It covers controlled unclassified information and maps to the full 110 requirements in NIST SP 800-171 Revision 2. The control written as IA.L2-3.5.3 requires multi-factor authentication for local and network access to privileged accounts and for network access to regular accounts. This is the one people ask us to waive, and it's close to the worst one to waive. MFA carries heavy weight in CMMC scoring, and high-value requirements like it generally can't be pushed onto a "we'll fix it later" plan the way minor items can. So when a defense client asks us to drop MFA for a few users, the honest answer is that it can put the certification, and the contract behind it, at risk.

One wrinkle worth naming plainly. The 800-171 controls behind CMMC Level 2 were written around the older, complexity-heavy password model, while NIST's newest identity guidance moved toward length and breach-screening. You can satisfy both. Long passphrases, a password manager, and phishing-resistant MFA in front of anything sensitive clear the modern bar and the compliance bar together. For the exact application to your environment, that's a conversation for your assessor and your IT team.

A note on our role, because it's easy to get wrong. CybertronIT is a Registered Provider Organization, an RPO. We help you prepare for CMMC and get your controls in shape. We are not a C3PAO, so we don't run the official certification assessment. We get you ready. An authorized third party does the certifying.

What we actually recommend

When the request to loosen things lands on your desk, the useful move is to change the question. The goal isn't looser security. It's a secure path that's easy enough that nobody wants to route around it. That's usually cheaper than the friction you're trying to remove.

For most businesses, that comes down to a short list. Use passphrases instead of passwords, four or more words with some length, like "copper otter lantern drift," which beats "P@ssw0rd7" and is easier to remember. Put a dedicated password manager in place, not the browser's save prompt. The point of a password manager isn't that it's magically immune once a laptop is compromised. It's that it generates a different strong password for every account, keeps them out of the browser profile, and gives you central policy, controlled sharing, and an audit trail you can't get from twenty separate browser vaults. Never reuse a password across accounts, which the manager makes painless. And turn on MFA everywhere it will go.

If the real complaint is that there are too many logins, the fix is single sign-on, so people authenticate once with strong protection instead of juggling twenty passwords. If the complaint is that the login dance is annoying, passkeys are often faster than typing a password and happen to be phishing-resistant. If the complaint is that passwords expire too often, stop expiring them and require length plus MFA instead. Every one of those makes your people happier and your company harder to breach.

On the MFA point, the type is worth a sentence. A text-message code beats nothing, but it can be phished. An attacker stands up a fake login page, you enter your password and the code, and a tool relays both to the real site in real time. Push prompts have the cousin problem: spam someone with approvals until they tap "yes" to make it stop. Passkeys and hardware security keys close that door because they're tied to the real site's address. Land on a lookalike and the key just won't work. There's no code to steal and nothing to approve by mistake. You don't have to get there overnight. Get MFA on everything first, prefer an authenticator app over text codes, and move your most sensitive accounts to passkeys as you go.

If you want to see where your own authentication stands, or you're staring down a CMMC deadline and need your controls in shape, that's the kind of thing we do. Better to look now than to let an attacker find the gaps for you.

Sources

• NIST SP 800-63B (full document, digital identity guidelines): https://pages.nist.gov/800-63-4/sp800-63b.html
• NIST SP 800-63B, Strength of Passwords appendix: https://pages.nist.gov/800-63-4/sp800-63b/passwords/
• NIST SP 800-63-4 final publication record (finalized July 31, 2025): https://csrc.nist.gov/pubs/sp/800/63/4/final
• NIST 800-63B Rev 4 summary, Enzoic: https://www.enzoic.com/blog/nist-sp-800-63b-rev4/
• Verizon 2026 Data Breach Investigations Report findings: https://www.helpnetsecurity.com/2026/05/20/verizon-2026-dbir-findings/
• Verizon DBIR 2026 credential-abuse analysis, Descope: https://www.descope.com/blog/post/verizon-dbir-2026
• 19 billion leaked passwords, about 6 percent unique values, Cybernews (2025): https://cybernews.com/security/password-leak-study-unveils-2025-trends-reused-and-lazy/
• Infostealer malware and credential theft (2025), DeepStrike: https://deepstrike.io/blog/infostealer-malware-credential-theft-2025
• Chrome app-bound encryption for stored credentials, Chromium security FAQ: https://chromium.googlesource.com/chromium/src/+/main/docs/security/faq.md
• Microsoft Edge password manager security: https://learn.microsoft.com/en-gb/deployedge/microsoft-edge-security-password-manager-security
• CMMC Level 2 and NIST SP 800-171 (32 CFR 170.14): https://www.law.cornell.edu/cfr/text/32/170.14
• CMMC POA&M scoring rules (32 CFR 170.21): https://www.law.cornell.edu/cfr/text/32/170.21
• NIST 800-171 control 3.5.3, CSF Tools: https://csf.tools/reference/nist-sp-800-171/r2/3-5/3-5-3/
• CMMC ecosystem roles, RPO vs C3PAO, CyberAB: https://cyberab.org/CMMC-Ecosystem/Ecosystem-Roles
• DFARS CMMC rule effective date (Nov 10, 2025), DoD DPAP change notices: https://www.acq.osd.mil/dpap/dars/archive/2025/change_notices.html