(1) From management letter (ML2012), SBG's management responded that "the company will set Password Change Intervals for SAP application as 180 days".
(2) From management letter (ML2011), SBG's management responded that "the company will set Account lockout threshold for SAP application as 5 invalid loggon attempts".