nist.govについて、ここに記述してください。
https://pages.nist.gov/800-63-3/sp800-63b.html
5.1.1.2. Memorized Secret Verifiers
Verifiers SHOULD NOT impose other composition rules (mixtures of different character types, for example) on memorized secrets.
Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically) unless there is evidence of compromise of the authenticator or a subscriber requests a change.