IXON does not allow forced password expirations for users in a company.
Current research and best practices show that expiring passwords harm security instead of improving it.

Is password expiration required for NIS2?

No, the European NIS2 directive does not mandate password expiration. Instead, it requires an organization to apply basic cyber hygiene practices (Article 21 point g).

Applying the best practices from the following reputable organizations and cybersecurity authorities is a good way to comply with this requirement.

Password expiration best practices

Microsoft
“Password expiration requirements do more harm than good, as they make users select predictable passwords, composed of sequential words and numbers that are closely related to each other. In these cases, the next password can be predicted based on the previous password. Password expiration requirements offer no containment benefits because cybercriminals almost always use credentials as soon as they compromise them.“

NCSC (UK Gov)
“Regular password changing harms rather than improves security. Many systems will force users to change their password at regular intervals, typically every 30, 60 or 90 days. This imposes burdens on the user and there are costs associated with recovering accounts.”

NIST (US Gov)
“Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.”