I have to agree especially as you get some complex password rules now days and some folk think you are cleverly using punctuation to meet that complexity. Usually I say something like:

Your password is "generic2011" all lower case. It starts with a "g" and ends with "1". Do not include the quotation marks.

The problem here is you need an outside audit which they won't agree to as it might introduce liability. An independent audit doesn't mean anything (I used to be an auditor) as the audit firm wants repeat business.

Just like we ruin poor dumb kids lives who commit other dumb crimes they wouldn't have committed if they were older like joining a gang, murdering somebody for a pair of shoes, etc etc.

Basically what I hear in your comment is "How dare middle class suburb kids be expected to follow the law and then be prosecuted when they fail .. the outrage!!!"

No, what is stopping the government from moving to the cloud is crazy NIST requirements in some of the archaic parts of NIST SP800-53. If they can give me a fully certified compliant system you would seem movement in droves.

The only surprise here is he lasted so long. The Federal CIO has zero authority hence it's a thankless exercise in futility. Under both FISMA and CCA all IT authority is with the Agency Head, OMB Director, and NIST. The Mr. Kundra had no authority, no control, no budget, no nothing my guess is the only reason he took the job was he was a former private sector employee and most likely had buyers regret within the week. No sane civil servant would take this position short of as a temp position to a backroom deal which ended with a lateral transfer promotion somewhere else or a high three with the expectation of doing nothing and accomplishing nothing (the only realistic goal under the existing legal/regulatory framework which governs that position) .

As a manager I always let those folk walk away. Nobody is indispensible and I don't need the Generation ADD princess syndrome employee's. It's a job, not a lifestyle.