As NIST's guidelines change, it's imperative that organizations understand password rotation, but how and why?