Ability to control user password behavior in order be PCI compliant:
- Maximum invalid login attempts
- Lockout effective period
- User passwords expire in
- Accounts will be deactivated if not active for more than
- Enforce password history
- Minimum password length
- Minimum login length
Will need customization for password length to be 8 characters minimum and make the customer wait for 60 minutes after 6 tries and lock them out. Account deactivation, password history, password and login length are custom development and make the customer wait for 60 minutes after 6 tries and lock them out.
Tested with Magento 1.9.2