As per new GDPR requirements, all web-enabled applications must have strong password and security protocols. You can manage your platform's security/password strength levels via Admin > Settings > Company Details

Users will by default get Suspended if they fail to login to the platform after 5 attempts. Their access will be blocked for about 30 minutes, after which you can simply Activate the user from Admin > Organisation by filtering on Suspended users.