In July 2025, NIST released the final edition of SP 800-63B, its core digital authentication guideline. Section 3.1.1.2 now states that verifiers and CSPs SHALL NOT require subscribers to change passwords periodically, upgrading the previous soft recommendation to a firm prohibition.
In April 2026, FSTEC approved a methodological document requiring passwords in government information systems and critical information infrastructure objects to be rotated at least every 90 days. Mobile devices face a stricter 30-day limit, and reuse of any of the last 12 passwords is forbidden.
Order No. 117 itself contains zero references to passwords. The order lists high-level protection measures, while concrete parameters such as length, complexity, and rotation periods are defined in subordinate methodological documents.
Three-layer document structure
The binding requirement appears only in the third document: the April 2026 methodological guide titled “Composition and Content of Information Protection Measures.” Measure IAF.3 explicitly mandates a minimum 12-character password, a 70-character alphabet, five failed attempts before lockout, 15-minute lockout duration, and rotation no later than 90 days. Measure ZMU.1 sets the 30-day mobile rule.
- Order No. 117 (April 2025, effective March 2026): no password mentions
- November 2025 KZI assessment methodology: checks complexity only
- April 2026 methodological document: full rotation requirements in IAF.3 and ZMU.1
Point 68 of Order No. 117 makes the methodological documents mandatory by requiring operators to implement measures “using FSTEC methodological documents.” Ignoring the guide therefore violates the registered order itself.
Commercial organizations outside government systems and CII subjects are not bound by the 90/30-day rules and may choose policies based on their own threat models, provided they document the rationale.
