Hacker News Reader

If you require PCI DSS compliance it won't fly either.

If you require PCI DSS I hope you're not just blindly following some random post on hackernews for your policy ;)

I'm not, that's why I know PCI DSS requirements off-hand.

No. You can use NIST guidance and are not required to change your password every 90 days