And the person responsible is not the guy without password, bit a coward who didn&#x27;t push for 5x 9 SLA.
Yes, this includes hard real life access time analysis. If failing to remember a silly password takes longer than k minutes, it should be a breach of contract. Likewise if total disruption due to password changes is too high.
It&#x27;s silly to implement a horde of govt rules while neglecting the basics.