Standards group recommends removing periodic password change requirements amongst other common sense suggestions.