Password Security - External Auditor Questions

This is related to a question our auditors are asking about specific to password policy for our Oracle EPM environment. We have two questions. First, how many times can a user mess up their password before they are locked out? And second, how often does each user have to change their password? We have reviewed the policy on Oracle's website ( https://docs.oracle.com/en/cloud/saas/applications-common/24c/faser/password-policy.html ) but were unable to find the answers to these two questions. We've also found in Oracle Cloud Services that we have activated the "Default Sign-On Policy" and so we would like answers to the above two questions. Specific articles,