it doesn’t matter, our insurance company has more strict requirements. all it ever is for FCC, CISA, NIST, etc is someone “attesting” that we meet requirements

It is considered a fail, and then inputting passwords in the form is a super fail.

we do monthly phishing tests and some of our people are so bad that we put in the test email “this is a phishing email, do not click sign in” above and below the sign in box and they still give creds