Auditors.. Its always the damn auditors.. SOX, SAS, HIPAA, PCI, etc.. Horrible, 20 year old password requirements, that the auditor doesn't even understand, but they ask the question, because they asked it last year....