Five failed attempts lock the account for fifteen minutes. Every sign-in is recorded in the audit trail.