You checked the box in October. Now somebody has to write the plan.

The renewal of your preparer identification number opens in the middle of October, and near the bottom there is a line about data security. You check the box, because you are aware, and then you pay and get back to work. What that line points at is a real document — a written information security plan — and the people who require it are not the people you are renewing with.

It is also shorter than almost anyone expects. In a firm of six, a plan is a handful of pages saying who is responsible for this, what taxpayer information you hold, where it actually sits, who can reach it, and what you would do on the morning nothing opens. You know most of the answers. They have just never been in one place.

Who actually requires it

The law behind it is the Gramm-Leach-Bliley Act, which is mostly about banks and lenders. Under that law, anyone who prepares returns for other people counts as a financial institution — which sounds wrong the first time somebody says it out loud, and is the case anyway. The Federal Trade Commission wrote the rule that follows from it: the Safeguards Rule.

The renewal is only where the question gets asked. The line says you are “aware of your legal obligation to have a data security plan and to provide data and system security protections for all taxpayer information.” Aware — nobody asks you to attach anything, and nobody reads it. You do sign the form, though, which makes October a sensible week to read your own plan.

The rule is also gentler on an office your size than anyone selling you something will mention. Hold information on fewer than five thousand people, and four of its heavier parts fall away: a written risk analysis, a written plan for the morning of a breach, routine testing, and a yearly report to a board you probably do not have. The plan itself stays.

What goes in one, and why the file from 2022 is not it

Almost none of it is technical. Like the security questionnaire a client sends, a plan is mostly a description of how your office behaves, written down once so that nobody has to remember it. In a firm of six, five things:

• Who is responsible for this, by name, and who that person tells when something happens.
• What taxpayer information you hold, and everywhere it actually sits — the system you prepare returns in, the mail, the folder that fills up with scans, the cabinet, the laptop that goes home.
• Which of your people can reach which of it, and which of them cannot.
• The second step everybody uses to sign in, and anywhere you have decided something else is good enough — that decision belongs in writing.
• How copies are kept, how a return reaches a client, how long you keep one, and what you require of anybody you hire to help.

The second and third of those take the longest, because nobody has ever written them down. Most of the firms we walk into find a folder with four years of scanned returns in it, put there by somebody who has since left, and open to everyone. Finding that is most of the value of the exercise.

Which is why the file somebody downloaded in 2022 has probably aged out. The line on the renewal has read much the same since 2019, so nothing on the form will tell you. What moved is underneath it: most of the current requirements took effect in June 2023, and the sample plan the Internal Revenue Service publishes was rewritten in the summer of 2024.

What changed most is the shape. The old templates ask you to designate an employee or employees to coordinate; the current rule wants one named person. The newer plans also ask where a second step at sign-in applies, how you protect information that sits still and information that travels, and what you require of whoever looks after your computers. Little of that means starting again.

What designating a person means when there are six of you

It means a name, not a role. The rule asks for a qualified individual, which reads as though it wants a credential, and it does not. Qualified is measured against the size of your firm — in an office of six, that is usually the owner, and occasionally the person who has quietly run the place for eleven years.

You are allowed to hire the job out, and plenty of firms do. Two things stay with you when you do: you remain the one answerable for the plan, and somebody senior inside the building has to be named as the person who directs whoever you hired. In a firm of six, that is you.

The year that follows is smaller than it sounds — read the plan before the renewal, add and take away access when somebody joins or leaves, be the one who gets called first. Most of the firms we walk into are closer to that than the owner believes. If you would like somebody to sit with what you already have, a review is ninety minutes on site, and the written report is yours either way.