As a...
– user
I want to...
– change my password every 90 days
so that...
– in the event my password is compromised, my account will be safely protected. Well, eventually protected. Assuming the compromise wasn’t exploited immediately. Which it probably was. I'll just add a '1'.