A company's regulatory controls require all management accounts used by individuals with access to data stored on storage systems must comply with password strength and active duration policy.

What should be used to meet this requirement?