Change your password every 30 days, and never reuse one, and don't use a password manager, and don't write it down anywhere, and...

15 character minimum passwords that expire every 90 days and require MFA to remote in from home with 3 separate login sessions just to get to your PC, along with stripped down rights for everyone, even IS. The rights are so strict that if you wanted to, for instance, update a trusted application like Notepad++ because a recent exploit was found which would be a security concern, you can't use the auto-update feature of the application; you have to download it manually from their repository, and run it using a special admin account created for you that doesn't have an associated email address but also has a 90 day password requirement. But you wouldn't been able to use their repository 6 months ago because we block any IP address outside the US and their previous service was located in UK, so if you wanted to keep that piece of software up-to-date with security and vulnerability patches (which they've harped on a number of times before) you'd have to find alternative download services located in the US regardless of how shady.

I wish I was joking.

My current employer actually just changed our password policy to greatly extend the password expiration date. We have cranked up the password requirements a tad, every login has 2FA and permissions are locked down to the size of a gnats asshole. Users seem to like it better since they don't have to come up with a new password as often and we are telling ourselves it's harder to brute force.