regulatory compliance for default credentials