Two Offices, Two State Rules, One Password Policy. Which Version Survived the Audit

The agency had eleven employees, two offices about ninety minutes apart across a state line, and two password policies that nobody had written on purpose. One office rotated credentials every ninety days because a former IT contractor had set the domain that way in 2014. The other had stopped rotating when a newer contractor turned the setting off and enrolled everyone in an authenticator app. Neither manager knew the other's arrangement until a cyber insurance renewal questionnaire asked a single question about password expiration and the two answers came back different. What followed is worth watching, because it separates the parts of password advice that carry legal weight from the parts that are habit wearing the costume of a rule.

The finish nobody inspects until someone asks

Look at a password policy the way you would look at a paint job in raking light. The visible surface here was a two-page document in the employee handbook, updated once, referencing complexity requirements that the actual domain controller no longer enforced. Underneath it, the real settings lived in three places: the Windows domain, the agency management system the carriers required, and a separate portal for one carrier that still capped passwords at sixteen characters. The handbook was cosmetic. The three enforcement points were the finish that mattered, and only one of the three had been touched in five years. That gap, document says one thing and system does another, is the flaw that turns a routine examination into a long afternoon.

The people whose work sits next to your decision

Four people had an opinion about these passwords, and only one of them worked for the agency. The help desk contractor cared about ticket volume, because rotation generates reset calls and reset calls are unbilled after a certain point in the contract. The cyber insurance underwriter cared about multifactor authentication on remote access and email, and treated everything else as secondary. The state examiner cared about whether a written program existed and whether the practice matched it. And a carrier's vendor questionnaire, filled in by someone in a procurement office two time zones away, cared about a checkbox that had been copied from an older standard. Each of them was reading a different rulebook, and each rulebook was current in its own world.

That is the part households and small offices get wrong. The advice you hear is not one voice that changed its mind; it is four or five parties with separate obligations, updating on separate schedules. The National Institute of Standards and Technology is responsible for the federal digital identity guidelines that most modern password guidance descends from, and its shift away from mandatory periodic rotation and toward length, screening against known-breached passwords, and strong second factors is now the reference point for serious practitioners. But a questionnaire written in 2016 does not know that, and the person who has to answer it does not get to argue.

Where the state line actually bites

The two states were not symmetrical, and this is where the case stops being about passwords and starts being about jurisdiction. One office sat in a state with a detailed information security regulation for licensed financial entities, the kind that names multifactor authentication for remote network access and requires a written program with a responsible person attached to it. The other sat in a state whose data protection rule is built around a written information security program covering personal information, with access controls, unique user identifiers, and reasonably designed password selection as named elements. Neither rule commanded ninety-day rotation. Both rules commanded documentation, and both cared enormously about whether the document described reality.

So the agency did not have to reconcile two conflicting technical standards. It had to reconcile two administrative ones, and the higher of the two set the floor. That is nearly always the answer for a business or a household straddling a boundary: you do not average the rules, you adopt the stricter and document once. The examiner who eventually reviewed the file did not ask why the two offices had once differed. She asked when the written program was last reviewed, who owned it, and whether the settings in front of her matched what the page said. Those three questions are the whole exam in miniature.

Which flaws mattered, and which were only cosmetic

Three findings came out of the review, and they were not equally serious. The stale handbook language was cosmetic in the sense that fixing it took an hour, but it was the finding that generated every other question, because a document that misdescribes the system invites the examiner to check everything else. The carrier portal with the sixteen-character cap was a genuine constraint that could not be fixed locally, and the right response was to record it as a known limitation with a compensating control rather than pretend it did not exist. The real flaw, the one worth money, was a shared login for a scanning appliance that four people used and nobody owned.

Shared credentials defeat the entire logic of modern password guidance, because they break attribution: no unique identifier, no meaningful reset, no way to answer the question of who was in the system on a Tuesday. That one was fixed first. Rotation, the setting that had started the whole conversation, was switched off in the remaining office and replaced with longer passphrases, screening against known-compromised credentials, and enforced multifactor on email and remote access. The help desk contractor's ticket volume fell, which was a pleasant side effect and not the reason.

What to take from it

If you are running a household or a small office across any kind of boundary, state, franchise, or carrier network, find out who is actually reading your answer before you decide what your policy is. The underwriter, the examiner, the procurement clerk and your own technician want different things, and only one of them can fine you. Write the stricter version down, make the systems match the page, and give the document a named owner and a review date. The rest of the argument, ninety days or never, is settled by people who publish and revise their reasoning in public, and you are allowed to follow them.