You should point your IT policy people at http://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c02.pdf in particular section 2.4, page 18 of the PDF / 34 of the book :-)

Yup, we protested along those lines, but sadly these things are dictated from afar - i.e. the USA - where such subtleties are not understood.

Having said all of this, it appears that the mandatory reset frequency has been reduced recently, which is most welcome. (Although as there was no announcement, it's most likely this is a configuration error rather than a positive decision.)

Sadly, the single reference that cites supporting the argument matches up to some bibliography which isn't included in the PDF.

You could always look at Ross's home page to find out what other chapters of the book are available for free. http://www.cl.cam.ac.uk/~rja14/Papers/SEv2-biblio.pdf

[1008] B Patterson, letter to Communications of the ACM v 43 no 4 (Apr 2000) pp 11 – 12

Unfortunately, that's not a good, peer-reviewed study.

(I did jump up a level on that URL, and got an Apache directory listing in the face.)