An information systems owner has decided to create a more stringent password policy based on recent reports that systems are being compromised with current user credentials. The current policy has password complexity, reuse, and history measures in place; however, attackers are repeatedly gaining access to the systems after passwords have been changed. Which of the following would be the BEST method to add to the password policy to prevent compromise?

1. Password recovery
2. Account expiration
3. Password length
4. Account lockout