GDS isn't enforcing weird password policies across government.
This is the advice GDS publishes on passwords: https://www.gov.uk/service-manual/user-centred-design/resour...