Must not contain user's first name, last name, or login username Must not be one of the last 24 passwords used Accounts will be locked in the future after 5 unsuccessful attempts to log in..