The NIST 800-63B publication specifies recommendations regarding memorized secrets (passwords)
https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver specifically section "5.1.1 Memorized Secrets"
When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised.
and Appendix A. A.3 Complexity
it is recommended that passwords chosen by users be compared against a “black list” of unacceptable passwords.
Where should the Verifier get such list? How and how often this black list is supposed to be updated? If NIST doesn't provide such list, how can I be sure that the list downloaded from some source is nearly acceptable for use?