See CC6.2 Creation and Removal of User Credentials and CC6.6 External Protections, but if you don't work in a regulated environment, world's your oyster!