WOW, "A security auditor for our servers has demanded the following within two weeks: •A list of current usernames and plain-text passwords for all user accounts on all servers •A list of all password changes for the past six months, again in plain-text"

That right there would be a security breach/issue and for it to be created as part of an audit is unbelievable.

I have never met any security auditor who has done that or ever would and having done audits myself for FTSE 100 companies, well if I did that I'd be out of a job. Certainly audit the passwords, though there should be rules to prevent silly passwords and that is what should be audited.

In such a situation I would not panda to such a auditor and would approach a director about the security risk the auditor was and good night veanna for them. Such people should not be doing audits, ever and clearly not qualified in the role/task they have been given.

It would be a security issue too carry on supporting or allowing such a person to carry on auditing as they are clearly a security risk without a doubt.