A company's AUP requires: - Passwords must meet complexity requirements. - Passwords are changed at least once every six months. - Passwords must be at least eight characters long. An auditor is…

Account lockout thresholds control how many failed login attempts are permitted before an account is locked, which addresses brute-force protection but does not enforce periodic password changes.

Account recovery defines the process for regaining access to a locked or compromised account and does not address the requirement for passwords to be changed on a scheduled basis.

Password expiration is the technical control that forces users to change their passwords after a defined maximum period - in this case, every six months (180 days). Without configuring password expiration in the identity/directory system, the AUP requirement for periodic password changes cannot be automatically enforced, leaving it as an unenforced policy rather than a technical control.

Prohibiting password reuse prevents users from cycling back to previously used passwords, which is a complementary control but does not enforce the six-month mandatory change interval identified as missing in the audit.