Requirement:

The asset owner shall have policies and procedures related to denying login access to user accounts for a specified length of time or until unlocked by an authorized administrator after the configured number of consecutive unsuccessful login attempts have occurred.

Guidance: