3 - Strong password policies should be implemented along with Multi-factor authentication.
Purpose:
A documented Information Security Policy helps focus on a set of security priorities specific to the business.
Best Practices:
Set a minimum 10-character password
Examples:
NIST Multi factor guidance
https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/multi-factor-authentication
4 - Access should be granted based on roles and responsibilities to adhere to the principle of least privilege
Purpose:
Support from leadership helps motivate all to care about security
Best Practices:
Remove any access that is not needed when roles change