1) Long passwords - govt loves these - think 12 characters or longer. Think "EhKx~9RDmPMCW7"
2) Failures to specify allowable characters or blocked characters - very annoying.
3) Hard lockouts (rather than more nuanced rate limiting etc) requiring password resets.
4) Password reset options are weak and not protected.
The backdoor is usually the password reset option.
Ie, agency will do crazy long password + SMS code to login, but you can then reset your password with just SMS. So the long passwords are often just for show.
They often also don't time delay anything. So they'll do things like immediate reset. For high value apps you should have a 4 - 24 hour delay on reset to allow legit user to react.
They'll also often not have good ways to report bad password reset attempts other than via phone which goes no where.
They also often actively block password managers and cutting and pasting passwords. So annoying.
The IRS is currently requiring 90 day password rotations as well which are a nightmare. Coupled with hard account lockouts you have another nightmare.
The list goes on. For the millions to billions they spend you really wonder who is giving them advice.