[Traubenfuchs]

I wonder what will happen if I post a provocative „Why is our IT department violating NIST password recommendations?“ in public slack.

[Prcmaker]

In my experience, you get labelled as not being a team player.

[petepete]

Or a busybody (speaking from personal experience).

About 18 months after me raising this issue and referencing both NCSC and NIST, the rules at the org I'm contracting with were changed.

I have no idea whether my suggestion made any difference.

[rantingdemon]

We use NIST as a baseline. Some organisations actually try to do this properly :)