The information security team wants to make itharder for bots and unauthorized users to create...

Set "Who can register accounts" to "Visitors," and check "Enable password strength indicator"

Set the personal contact form for new users to disabled, and set email verification to use the personal contact form method.

Set the Registration and Cancellations settings to "Require email verification when a visitor creates an account."

Set "Who can register accounts" to "Administrators only," and assign the task of new account creation to site admins.