Password Law

Does anyone have any information on a password law either fereral or state that says businesses must force user to change their password every 30, 60, 90 days etc.

Thanks