Zero trust framework actually no longer calls for routine password changes, it’s considered an ITIL best practice not to now, because it encourages people to write them down. Instead solid MFA for password situations and, properly, getting rid of passwords in the next few years.

But a lot of places are still outdated in this.