I'm quite confused about what is the current state in 2017 for the idea of password expiration/rotation especially related to security certifications as ISO, PCI, etc. I keep reading that password expiration is not very useful, but I've found several slides where it still seems to be part of the policies/rules (for ISO and PCI).
There is one specific part that seems a bit unnatural to me, and this is (assuming that you have a strong password policy in place, which we already have) the need to store the old password hashes in your database to prevent users from setting an old password when the current expires.
I have always (wrongly) assumed that the expiration was approaching the issue using a social angle, a way to tell users that passwords were important. So, the new password had to be different from the current, but without checking historically previous records.
I had the intuition that this wasn't safe, but it seems that big corporations use it know to provide UI hints (although I think it's fair to assume that these organisations may have a much better control of their backups than smaller companies do, where mistakes could be more likely).
I've read an article in which it would seem that NIST will no longer enforce password expiration. Anyway, now that my system is going to have password expiration due to requirements, I was thinking that it would make sense to match, to some extent, the requirements present in these certifications.
What is the state of password expiration/rotation in these certifications (ISO, PCI, etc) in 2017?. Is it still part of them?.
Do they target/mention a number/period of old passwords that you have to store?.
I don't have access to any original documentation as we are not in any adoption process, but it would be good to know even generally speaking.