@gibeath @nixCraft that is a load-bearing "if". Most auditors couldn't spell "NIST" if you helped them out with the first few letters. See, for example, the number of times password rotation still gets mandated...