If the entity being assessed is a service provider:
Identify the customer/user documentation that requires non-consumer user passwords to be temporarily locked out after not more than six invalid access attempts.
Describe how the observed processes confirm that non-consumer user passwords are temporarily locked out after no more than six invalid access attempts.