The rule you can delete

Upper case, lower case, a number, a symbol, and a new password every ninety days.

The federal standard for passwords now says don’t. The cheapest security upgrade on your list this year may be a deletion.

Last time, a control pointed at the wrong people. This time, one that outlived its reason.

In 2017, NIST, the federal standards body, said logins should not require mixtures of character types or force passwords to change arbitrarily.¹ In Revision 4, published in July 2025, “should not” became shall not: mandatory for federal systems, a benchmark for everyone else. No character-mix rules. No calendar expiration. A required change when there is evidence a password has been compromised.²

Meanwhile login pages still want a capital letter, a digit and a symbol, which is how the world arrived at Password1! — and, ninety days later, at Password2!. We did not make passwords harder to guess. We made them easier to predict.

What replaces the rule is the part that gets skipped. The same guidance requires fifteen characters where a password stands alone, recommends allowing at least sixty-four, and requires screening new passwords against a blocklist of commonly used, expected and compromised ones.² Length and screening do the work the character rules only pretended to do. Multi-factor authentication does the rest, ideally a phishing-resistant kind; text-message codes and push approvals can be phished.

Dealers already have that last part in writing. The FTC Safeguards Rule, 16 C.F.R. § 314.4, requires multi-factor authentication for anyone accessing an information system unless the Qualified Individual approves an equivalent control in writing, and the section imposes no character rules or expiration.³

Better still, need fewer passwords. Passkeys remove the shared secret: nothing to reuse, nothing to rotate, nothing for a fake login page to capture. CISA has called FIDO/WebAuthn, the standard passkeys are built on, the only widely available phishing-resistant authentication.⁴ NIST keeps passkeys that sync across devices out of its highest-security tier,² and a password left behind as a fallback is still a password to phish. For most sign-ins, though, passkeys end the rotation debate by ending the password.

Before you delete it, two checks. If you take card payments, PCI DSS sets password requirements of its own. And if a customer questionnaire still asks for ninety-day rotation, answer with the citation, not the checkbox.

Why is the rule still in force? Not for technical reasons. Standards get written and almost never unwritten. Removing a control takes the same authority as adding one, and nobody is promoted for deletion. The rule sits there, costing help-desk hours and producing exactly the passwords it was written to prevent.

When did your organization last remove a control? If the answer is never, you do not have a standards library. You have sediment.