Does anyone know of any regulatory guidance out there (I found some from Microsoft) which dictates account policy settings. For example, max ages of passwords before they are changed, password lengths, account lockout settings?

I'm off to seach the FFIECs Info. Security booklets now...but figured I would ask because maybe someone has something handy.

Thanks.

Did you ever find anything on this? I am looking too and so far I have not found anything.

As I recall the FFIEC has guidance for the banks (your staff) but not customers. You have guidance on multifactor authentication for them, but that is all I am aware of. Prudent guidelines on your part would address this as to passwords, length, words, frequency of change, etc. I don't think they have found enough problems to require banks to do more than multifactor.

Thanks!