Security Policy Draft

1. All users must create unique email-based logins which are authenticated via secure protocols.
2. Passwords should contain a mix of uppercase, lowercase, numeric and special characters and be a minimum length.
3. Email verification should be used to confirm the user's email address.
4. Password reset functionality should be implemented.
5. Passwords should be stored using a secure hashing algorithm such as bcrypt.
6. Passwords should be encrypted at rest.
7. User data must be encrypted during transmission.
8. Account lockout policy will be implemented after a limited number of failed logins.
9. Multifactor authentication is encouraged and should be implemented where necessary.