I posted this on the Tech@FTC blog this week about why mandatory password changes may be counter productive:

https://www.ftc.gov/news-events/blogs/techftc/2016/03/time-rethink-mandatory-password-changes