Admins can set, on the Team page: the networks the organization may be opened from (an IP allow-list, for people and API keys; scheduled runs and webhooks are not affected), how often everyone signs in again (from 30 days down to 8 hours), and a minimum password length (up to 16 characters). People whose password is too short are asked for a new one when they next open the organization.
Everywhere, the most common passwords are no longer accepted, and a new password must differ from the current one.