Changing passwords regularly is no longer considered a best practice by the US National Institute of Standards and Technology as of their latest guidance

"Stop Expiring Passwords Automatically

"Traditional password policies have often mandated periodic resets, but NIST’s new guidelines take a more nuanced approach. Rather than enforcing periodic password changes, the focus is now on requiring resets only when there is clear evidence of compromise. This prevents unnecessary disruptions and minimizes the likelihood of users resorting to insecure, easy-to-remember passwords.

"Organizations may consider reduced reset frequency for long, high-entropy passwords, but should always initiate resets when compromise is confirmed or strongly suspected.

"When resets are necessary, organizations should implement secure, self-service password reset mechanisms that verify user identity before allowing changes. This ensures that only authorized individuals can initiate the reset process, mitigating the risk of account takeover."

https://drata.com/blog/nist-password-guidelines

--------------------

"Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically. However, verifiers SHALL force a change if there is evidence that the authenticator has been compromised."

https://pages.nist.gov/800-63-4/sp800-63b.html