"internal" and line of business apps are not provided as cloud hosted SaaS yet?

I work on a web based SaaS used mainly by different parts of the government and we are often asked about password policies and rotation, to which we point at the nist & nscs advice