Describe the intermediate system security measures for Authentication and Authorisation.

Requirements for Authentication and Authorization are: Remove or disable accounts upon loss of eligibility: Accounts which are no longer needed must be disabled in a timely fashion using an automated or documented procedure. Separate user and administrator accounts: Administrator accounts must not be used for non-administrative purposes. System administrators must be provisioned with non-administrator accounts for end-user activities, and a separate administrator account that is used only for system-administration purposes. Use unique passwords for administrator accounts: Privileged accounts must use unique passwords that are not shared among multiple systems. Credentials which are managed centrally, such as the NetID/password combination, are considered a single account, regardless of how many systems they provide access to. Throttle repeated unsuccessful login-attempts: A maximum rate for unsuccessful login attempts must be enforced. Account lockout is not required, but the rate of unsuccessful logins must be limited. Enable session timeout: Sessions must be locked or closed after some reasonable period. Enforce least privilege: Non-administrative accounts must be used whenever possible. User accounts and server processes must be granted the least-possible level of privilege that allows them to perform their function. Security Audits: Regular audits of roles assigned to various accounts and access assigned to these users. Security Logs: Regular logging of user activity in the system and review of activity related to security change and identification of unauthorized attempts to access privileged information.