Its like those policies where the password needs to change every 60 days that was found to actually reduce security because of the count-up-by-one passwords people would use. For places where that's been a rule forever it is really get it removed.