10 Cyber Essentials Every Arizona Small Business Needs
Small and medium-sized businesses (SMBs) are the backbone of Arizona's economy — and increasingly, they're the front line of the state's cybersecurity risk. In 2025 alone, Arizona ranked 6th in the nation for financial losses tied to phishing, business email compromise, and other online scams, with losses totaling $631 million. That's not an abstract statistic; it's the kind of hit that can permanently sink a small business.
This is the gap SecureAZ was built to close. Founded by a coalition of cybersecurity experts, insurance professionals, and business leaders, SecureAZ is a nonprofit focused squarely on giving Arizona's SMBs practical, affordable tools to reduce cyber risk, remove barriers to cyber insurance, and protect the broader supply chain those businesses support.
To make that concrete, SecureAZ publishes a list of 10 Cyber Essentials — foundational security practices every Arizona SMB should have in place, ordered from easiest to start with to most involved, so businesses can build their security foundation one step at a time.
1. Strong Passwords
Weak or reused passwords remain one of the most common ways attackers gain unauthorized access to business systems. A strong password combines complexity — uppercase and lowercase letters, numbers, and symbols — with being hard to guess but manageable, ideally through a password manager.
Do this: Deploy a business password manager so employees can generate and store unique, complex credentials for every account. Require at least 14 characters and prohibit reusing old passwords.
2. Multi-Factor Authentication (MFA)
MFA requires a second form of verification beyond a password — like a one-time code sent to a phone — before granting access. Even if a password is stolen, an attacker still can't get in without that second factor.
Do this: Turn on MFA everywhere, especially for email, banking, cloud services, and remote access tools. Where possible, use an authenticator app (like Microsoft or Google Authenticator) rather than SMS codes, since app-based codes are harder to intercept.
3. Email Security
Email is the number-one delivery vehicle for phishing, malware, and business email compromise. Attackers impersonate trusted senders to trick employees into clicking malicious links, opening infected attachments, or wiring money.
Do this: Enable SPF, DKIM, and DMARC on your domain to cut down on spoofing, and use a business email platform with built-in spam and phishing filtering. Train staff to verify unexpected requests — especially anything involving payments or credentials — through a separate communication channel before acting.
4. Endpoint Protection
Laptops, desktops, smartphones, and other devices are frequent targets for malware, ransomware, and phishing. Endpoint protection software monitors devices in real time and blocks or quarantines malicious activity before it spreads.
Do this: Install a reputable endpoint detection and response (EDR) tool on every company-owned device, keep it updated with the latest threat definitions, and enable automatic scans. If you don't have dedicated IT staff, a managed service provider can handle this for you.
5. Access Control
Not everyone in your organization needs access to everything. The principle of least privilege limits each person's access to only what their role requires, which shrinks the damage if any single account gets compromised.
Do this: Audit user accounts regularly and remove access immediately when someone leaves. Assign role-based permissions, and keep administrator accounts separate from the accounts staff use for day-to-day work.
6. Periodic Employee Training & Testing
People are both the biggest target and the strongest line of defense. Employees who can recognize phishing and social engineering stop attacks before they start — but that awareness fades without reinforcement.
Do this: Run cybersecurity awareness training at least annually, and consider periodic phishing simulations. Reward employees who report suspicious emails rather than punishing those who fall for a test — the goal is a culture of vigilance, not blame.
7. Vulnerability Management & Software Updates
Unpatched software is a leading cause of successful cyberattacks. Criminals actively scan for known vulnerabilities in operating systems, applications, and firmware, and applying updates promptly closes those gaps before they can be exploited.
Do this: Enable automatic updates across devices, put a patch management policy in place that requires timely application of critical security patches, and periodically scan your network to catch unpatched or misconfigured systems before attackers find them.
8. Incident Response Plan & Testing
A ransomware attack, data breach, or phishing compromise demands a fast, coordinated response. Without a plan, organizations lose valuable time, make costly mistakes, and risk greater regulatory and reputational damage
Do this: Document how your business will isolate affected systems, remediate an incident, restore normal operations, and communicate with customers and regulators. Run a tabletop exercise at least once a year to walk your team through a simulated attack before a real one happens.
9. Data Backup & Recovery
Ransomware, hardware failure, or simple human error can permanently destroy critical business data. Regular, tested backups mean you can restore operations quickly without paying a ransom or losing everything.
Do this: Automate daily backups of critical business data, and actually test that you can restore from them — a backup you've never restored from is an assumption, not a safety net. Encrypted, immutable backups are strongly recommended where possible.
10. Data Encryption
Encryption scrambles data so only someone with the correct key can read it. If a device is lost or stolen, encryption keeps attackers from accessing what's stored on it, which can reduce liability — and it protects data moving across networks, too.
Do this: Enable full-disk encryption on all computers and mobile devices (BitLocker on Windows, FileVault on Mac). Use encrypted communication tools — HTTPS, encrypted email — for sensitive information, and encrypt sensitive files before sharing them.
Learn more about SecureAZ's programs and resources for Arizona SMBs at secureaz.org.
Caroline Lynch, Executive Director, SecureAZ
Caroline Lynch is Executive Director of SecureAZ and Founder & Owner of Copper Hill Strategies. Caroline has three decades of legal and public policy experience in criminal law, national security, cybersecurity, and emerging technologies.
Email: caroline@secureaz.org