Identity protection starts with planning