Yes, if you’re not actually doing the “compare password against breach lists” part of SP 800-63B regularly they likely won’t accept it.
I hope forced expiry will be gone from next PCI revision anyway.
I hope forced expiry will be gone from next PCI revision anyway.
My startup is implementing most of the NIST rec’s with the help of projects like zxcvbn but we would like to also start doing breach list comparisons so figured I’d ask.