Below is a screen shot showing the new security preferences. All preferences are optional but can be enforced by Admin or Administrative level providers/users. Once implemented, users will be required to update their passwords.
Most of the options are pretty intuitive, but here are clarifications for a couple of the settings: