Year End Credential Cleanup, and the Records That Justify the Spend Three Years Later

The December pass through a household's or a small firm's credentials used to be a rotation exercise: everything changed, nothing improved, and by February half the staff had a sticky note. That pass still has value, but the reason for doing it has moved. The current guidance from the standards side rewards length, screening against known breached credentials, and a second factor that is not a text message. The seasonal work is now an inventory and an upgrade rather than a reset. It also produces receipts, and those receipts have to survive a review that may arrive three years later.

What the standard actually asks for now

Anyone who has run this drill five or six times has watched the advice invert. Forced expiration on a fixed calendar was withdrawn, because it produced predictable increments rather than new secrets. Composition rules, the one uppercase and one symbol formula, went with it. What replaced them is longer minimums, a check of any new password against lists of credentials already exposed in breaches, and a real second factor. The Federal Trade Commission oversees how companies safeguard customer information, and the direction of its expectations has followed the same path: fewer arbitrary rules, more verifiable controls.

For a firm holding client financial data, the practical translation is short. Multi-factor authentication on every account that touches client records, an inventory of who has access to what, and a written plan that says so. The plan is the part people skip, and it is the part an examiner or an insurer asks for first. It does not need to be long. It needs a date on it, a named person responsible, and evidence that somebody looked at it during the year and either changed something or wrote down that nothing needed changing.

The order that cannot be undone

The sequence matters more than the thoroughness. Start with the email account that receives every reset link, because every other credential in the inventory ultimately answers to it. Upgrade its password, confirm its recovery phone and recovery address, and print or write down its backup codes before touching the second factor. Then work outward: financial accounts, the payroll and bookkeeping logins, the domain registrar, the tax software, and only then the low-value accounts that clutter the list. Doing this in the reverse order is the standard way to spend a Saturday locked out.

Three steps in that sequence are genuinely unforgiving. Removing an old authenticator app from a phone before enrolling the new one erases seeds that cannot be regenerated, and recovery then depends on support tickets and identity documents. Changing a recovery email address to one you cannot yet log into strands the account behind two locked doors. Deleting a former employee's mailbox before transferring the accounts registered to it hands you a set of logins with no reset path. Each of these is reversible only through a vendor's discretion, which is a different thing from being reversible.

The safe pattern, learned the hard way, is to add before you remove. Enroll the new second factor, confirm it works from a different device, then retire the old one. Save the recovery codes somewhere that survives the loss of the phone and the laptop at the same time, which usually means paper in a safe or a sealed envelope with other vital documents. Hardware security keys should be bought in pairs and enrolled together, with the spare stored away from the primary. One key is a single point of failure wearing a security label.

Which of this is deductible, and which is not

The spend divides more cleanly than people expect. A password manager subscription for a business, a hardware key for each person with access to client data, an authenticator-compatible phone line, the cost of an outside consultant to write or review the security plan, and cyber liability premiums are ordinary and necessary costs of running the operation, and they belong on the return in the year paid for a cash-basis filer. Software subscriptions are a straightforward operating expense. Hardware keys, at typical prices, fall under any reasonable de minimis threshold and are expensed rather than depreciated.

The complications are mixed use and personal use. A family plan on a password manager, with the business paying, is not fully deductible; only the business portion is, and the allocation has to rest on something you can describe, usually the number of seats actually used for work. A phone that runs the authenticator app is not deductible because it runs the authenticator app. Time spent on your own credential cleanup is not deductible either, because your own labor never is. Personal accounts, the streaming service and the airline miles, are outside the business entirely.

Where a firm is required to hold a written information security plan as a condition of preparing returns or handling client data, the cost of producing and maintaining that plan is squarely a business expense, including the annual review. Employee training on phishing and credential handling is deductible on the same basis. If a breach occurs, the response costs, forensic work, notification mailings, and credit monitoring offered to affected clients, are deductible as well, though an insurance recovery reduces the deductible amount to whatever you actually bore.

What to keep, and for how long

Keep the invoice, not the credit card line. A statement entry showing a vendor name and an amount establishes that money left, not what it bought, and the distinction is the whole argument three years out when nobody remembers whether that charge was five seats or fifteen. Download the annual invoice as a PDF, file it in the same folder as the rest of the year's records, and note the seat count and the allocation on the face of it. Vendors purge billing history on their own schedule, and a canceled subscription often takes its receipts with it.

Three years from the filing date is the general window, and longer is better where an allocation was involved, because a mixed-use split is exactly the item that invites a question. Alongside the invoices, keep the dated security plan, a one-page memo recording that the annual review happened and what changed, the training attendance record, and the list of who held administrative access during the year. That set answers both the tax question and the compliance question with the same paper, which is the argument for doing the credential pass and the record filing in a single sitting.

Set the calendar entry for the same week next year, and make the first item the inventory rather than the resets. The list of accounts is what changes; the strong ones you built this year will still be strong, and the work becomes an hour of confirmation and a filed invoice instead of a weekend.