Why is a password's maximum expiration time set to 90 days?

Passwords for the ARMS System are CJIS compliant and as such are defaulted to expire 90 days from the date of creation. This is the maximum number of days that a password can be valid in the ARMS System. 

Admins can configure passwords to expire sooner (30 or 60 days), but not later than 90 days.