The new requirements for using the service online, including synchronizing references, is that we will need to change our passwords every 180 days. I recommend against this. I work on government and military contracts, where the lowest level of requirement is listed in NIST standard 800-171. Between 2009 and 2015, they determined that the most common reason someone’s password was compromised was that they changed it. As a result, since 2015, this standard no longer suggests changing passwords frequently. When we recently set up a secure server so that we could store information that the government defines as “controlled, unclassified information” (one step below classified), the directions on passwords included that they should be changed only when necessary – such as when the password database was compromised. NIST’s most recent guidance on this, SP 800-63, confirms this idea, but also does point out that password database breaches are relatively common; it suggests various methods of avoiding this problem.
As I implied, if not stated, I recommend that the requirement for changing passwords every 180 days be removed, with more effort being put into securing the password database instead.