I would have considered "the system" to also include password reset policies.