HUMAN VERIFICATION REQUIREDASVS 6.2.10 No forced periodic rotation
MB-C15ASVS Level 2 Human AssuranceHigh
A user's password stays valid until it is discovered to be compromised or the user rotates it. The application must not require periodic credential rotation.