11.6.2. For that purpose, the relevant entities shall: (a) ensure the strength of authentication is …

(a)

ensure the strength of authentication is appropriate to the classification of the asset to be accessed;

(b)

control the allocation to users and management of secret authentication information by a process that ensures the confidentiality of the information, including advising personnel on appropriate handling of authentication information;

(c)

require the change of authentication credentials initially, at predefined intervals and upon suspicion that the credentials were compromised;

(d)

require the reset of authentication credentials and the blocking of users after a predefined number of unsuccessful log-in attempts;

(e)

terminate inactive sessions after a predefined period of inactivity; and

(f)

require separate credentials to access privileged access or administrative accounts.