Five failed attempts locks the account for fifteen minutes. Every attempt, successful or not, is written to an audit log that cannot be edited or deleted.