“It tells us to stop rotating passwords, and stop putting in those annoying special characters as requirements in password policies.”
The memo bans forced password rotation and special-character rules, deprecates VPNs, and demands SSO with MFA. The government is now ahead of most corporate IT departments, which still make you add an exclamation point every 90 days. The author sells zero-trust access tools, so she is happy. On this one she is also right.