Comment by xxpor

My understanding is the biggest driver of still having mandatory password rotation is PCI (the payments security requirements, not the bus)