First sign-in requires a password change. Three failed attempts lock the account for fifteen minutes — HR can release it.