Password Complexity rules
Password Policy
login attempts ( user lock )
Restrict User to change password after some duration limit\
User will not access application until password change.
Notify user to change password before reaching to duration limit
Forgot Password
Recieving encrypted link in the Email for password changes
Link Expiry in one hour
Link expiry after password change