At my work they wanted better security, and made the rule of minimum 12 characters, must include all sorts of numbers, special characters, etc, no previously used password and it must be changed every month, 3 attempts then the account is locked and you have to call IT.

The result was that people wrote their passwords on post-its on the screen, so it led to worse security overall and they had ro relax the rules.