Implement strict settings on access control of systems containing confidential data (minimum length of passwords, frequency of change, not reuse, closing accounts on multiple attempts failed, tests of non trivial password, etc..).