I have found a tonne of information on password policy all over the Internet and several best practices checklists. However from a username point of view I could not find much. I thought it would be really helpful to have something like this to prevent harvesters from being able to build dictionaries or username enumeration as well as other preventive steps where the username can be used by an attacker.

Could someone link me to some relevant documents and information?