At the time the Administrative Safeguards were enacted, NIST was recommending passwords should be forcibly changed every sixty to ninety days. However, the agency subsequently revised its advice when it was found users were regularly amending only one character every password change – an unsafe practice if the original password is ever compromised. The current guidance is that passwords are only changed if there is evidence of compromise – which aligns with the Administrative Safeguards because the text of the clause doesn´t require forced periodic password changes.