Which of the following account management practices should the security engineer use to mitigate the identified risk?