Explain "Authentication and Authorization" requirements under Immediate System Security measures, which are applied to Medium Criticality and High Criticality systems.

Immediate System Security Measures define the security measures that must be applied to Medium Criticality and High Criticality systems. The requirements covered under Authentication and Authorization are: Remove or disable accounts upon loss of eligibility: Accounts which are no longer needed must be disabled in a timely fashion using an automated or documented procedure. Separate user and administrator accounts: Administrator accounts must not be used for non-administrative purposes. System administrators must be provisioned with non-administrator accounts for end-user activities, and a separate administrator account that is used only for system-administration purposes. Use unique passwords for administrator accounts: Privileged accounts must use unique passwords that are not shared among multiple systems. Credentials which are managed centrally, such as the NetID/password combination, are considered a single account, regardless of how many systems they provide access to. Throttle repeated unsuccessful login-attempts: A maximum rate for unsuccessful login attempts must be enforced. Account lockout is not required, but the rate of unsuccessful logins must be limited. Enable session timeout: Sessions must be locked or closed after some reasonable period. Enforce least privilege: Non-administrative accounts must be used whenever possible. User accounts and server processes must be granted the least-possible level of privilege that allows them to perform their function.