>that NIST has killed in competent circles

Just because this is my favorite soapbox - anyone that has to deal with passwords should go read NIST SP800-63B:

https://pages.nist.gov/800-63-3/sp800-63b.html

I was kind of shocked by just how gosh-darned reasonable it is when it came out a couple of years ago. It's my absolute favorite thing to cite during audits.

"Are you requiring password resets every 90 days?"

"No. We follow the federal government's NIST SP800-63B guidelines which explicitly states that passwords should not be arbitrarily reset."

I've been pleasantly surprised that I haven't really had an auditor push back so far. I'm sure I eventually will, but it's been incredibly effective ammunition so far.