Cyber insurance
Cyber Insurance Requirements for Small Businesses in Arizona: A Plain-English Checklist
By Austin Thompson · Founder, Valley CISO · Published · 7 min read
Valley CISO is not an insurance agency or broker, and this is not legal advice.
Short answer
In Arizona, cyber insurance "requirements" usually come from the carrier, not from state law. Before they quote or renew, most carriers commonly expect multi-factor authentication (MFA) on email and remote access, endpoint detection and response (EDR) on every computer, backups that are offline or immutable and have been restore-tested, timely patching, email security, staff security training, and a written incident response plan. Answer every application question truthfully and keep proof. If you have a breach, Arizona's notification law (A.R.S. 18-552) gives you 45 days after you determine a breach occurred to notify affected residents.
On this page
- What do cyber insurance carriers require from small businesses?
- The checklist: controls carriers commonly ask about
- What do underwriters typically ask on the application?
- Does Arizona law add any requirements?
- Why are carriers asking more questions now?
- How can a small business get insurance-ready in 30 days?
- How does Valley CISO help?
What do cyber insurance carriers require from small businesses?#
Every carrier writes its own application, but the core list is consistent. The broker Marsh publishes 12 key cybersecurity controls and says some have "become a minimum requirement of insurers." The same controls appear in CISA's #StopRansomware Guide.
The checklist: controls carriers commonly ask about#
| Control | What carriers usually mean | Proof to keep on file |
|---|---|---|
| MFA | MFA is enforced for every user on email, remote access (VPN, remote desktop, remote-support tools), and admin accounts, not just "available" | An MFA enforcement policy plus a report of any users without MFA |
| EDR | A managed detection and response product on every laptop, desktop, and server. Many carriers don't accept basic antivirus as EDR | A device inventory matched against the EDR console, showing coverage |
| Backups | Backups are encrypted, kept offline or immutable so a hacked admin account can't delete them, and restore-tested | A dated restore-test record and the backup job history |
| Patching | Critical updates go on within a set window, especially on internet-facing systems | Patch-compliance reports from your management tool |
| Email security | Spam and malware filtering, plus SPF, DKIM, and DMARC on your domain | Your published DNS records and filter settings |
| Security awareness training | Recurring training, usually with phishing simulations | Completion records by employee and simulation results |
| Incident response (IR) plan | A written plan that names who decides, who to call (including the carrier's claims hotline), and what triggers it | The plan itself, plus notes from a tabletop exercise |
| Admin and remote access | Separate admin accounts, no remote desktop open to the internet, and limits on who can install software | An admin account list and an external scan showing no exposed RDP |
| Old (end-of-life) systems | No unsupported Windows or server versions, or isolate them if you can't replace them yet | An inventory with operating system versions |
| Payment verification | Bank or vendor payment changes are confirmed by calling a known number, never the number in the email | A written callback procedure your bookkeeper has signed |
CISA recommends "offline, encrypted backups of critical data," tested regularly, because many ransomware variants try to delete or encrypt any backups they can reach (#StopRansomware Guide). It also recommends phishing-resistant MFA for email, VPNs, and critical systems.
What do underwriters typically ask on the application?#
Expect versions of these yes/no questions:
- Do you enforce MFA for email, remote access, and admin accounts?
- Is EDR installed on all endpoints? Which product?
- Are backups encrypted, kept offline or immutable, and tested? How often?
- How quickly do you apply critical patches?
- Do you use any end-of-life software or operating systems?
- Is remote desktop (RDP) exposed to the internet?
- Do employees get security awareness and phishing training?
- Do you have a written incident response plan?
- Do you verify payment and bank-detail changes by phone?
- How many records (customer, patient, or employee) do you store, and are they encrypted?
Your answers are representations to the carrier. If a "yes" turns out to be untrue when you file a claim, the carrier may have grounds to dispute the claim or the policy, depending on the policy wording. Answer "no" or "in progress" when that is the truth. Our cyber insurance questionnaire guide explains the eight questions that trip up small businesses most.
Assume underwriters can see what your business exposes to the internet, such as an open remote desktop port or a missing DMARC record. Check yours with our free external scan; it reads only public information and is not a security assessment or insurance decision.
Does Arizona law add any requirements?#
Arizona doesn't dictate which security tools you use, but its breach-notification law affects how fast you must act, and it rewards encryption.
- Who it covers: Anyone conducting business in Arizona that owns, maintains, or licenses unencrypted and unredacted computerized personal information (A.R.S. 18-552). "Personal information" includes a name combined with items such as a Social Security number, driver license number, financial account number with its access code, health insurance ID, or medical information. It also covers a username or email address combined with a password (A.R.S. 18-551).
- Investigate promptly: When you become aware of a security incident, you must investigate to determine whether a breach occurred.
- 45 days: Once you determine there was a breach, you have 45 days to notify affected individuals.
- More than 1,000 people: You must also notify the three largest nationwide credit reporting agencies, the Arizona Attorney General, and the director of the Arizona Department of Homeland Security. The Attorney General's office has a data breach reporting page.
- Penalties: For knowing and willful violations, the Attorney General may seek civil penalties of up to the lesser of $10,000 per affected individual or the total economic loss, capped at $500,000 for a breach or series of related breaches.
- Exemptions: Businesses subject to the Gramm-Leach-Bliley Act and HIPAA covered entities or business associates follow their federal rules instead.
The practical takeaway: the law is written around unencrypted data, so full-disk encryption on laptops and encrypted backups count for a lot. Your IR plan should also include the 45-day clock. Talk to an attorney about your specific obligations.
Why are carriers asking more questions now?#
The FBI's 2025 Internet Crime Report records $3,046,598,558 in reported business email compromise losses nationwide in 2025. Arizona ranked sixth among states for total reported losses, at $630,700,609. Email fraud, ransomware, and stolen logins are what MFA, EDR, backups, and training are meant to stop.
How can a small business get insurance-ready in 30 days?#
- Week 1: Inventory. List every computer, server, and cloud account (Microsoft 365, Google Workspace, banking), and who has admin rights.
- Week 2: Close the big three. Enforce MFA for every user, install EDR on every device, and confirm you have one backup copy that is offline or immutable.
- Week 3: Prove it. Run and document a restore test. Export your MFA and EDR coverage reports. Publish or tighten SPF, DKIM, and DMARC.
- Week 4: Write it down. Draft a one-page IR plan, start training, adopt the payment-callback rule, and walk through one "what if" scenario with your team.
Keep it all in one folder so renewal answers come from evidence, not memory.
How does Valley CISO help?#
Valley CISO is a small practice in Gilbert, Arizona, with US-based staff in Arizona and California. We help businesses in Gilbert, AZ, and in Santa Ynez, Solvang, and Buellton, CA, during Arizona business hours (7 AM–5 PM).
- Managed IT + Cyber Insurance Readiness, $250/month. This is the $200/month help desk plus MFA coverage tracking, backup verification with restore-test evidence, EDR status evidence, security awareness training tracking, SPF/DKIM/DMARC upkeep, a monthly external rescan, a written insurance questionnaire answer sheet refreshed at renewal, and an incident response plan kept current. See pricing and services.
- Cyber insurance questionnaire working session, $145 (60 minutes, one-time). We go through your carrier's form with you line by line. Book it on the contact page.
- Free external scan. It shows what your domain already exposes. A full report with a fix plan is a one-time $49 unlock, credited toward your first month if you start a plan.
- Quick Help, $49. One question or issue, handled in a private message thread. See Quick Help.
We don't sell policies, bind coverage, or file claims. Your broker and carrier decide eligibility. Learn more on our cyber insurance help page, or email athompson@valleyciso.com.
Frequently asked questions
Is cyber insurance required by law in Arizona?
Generally, no. Arizona doesn't require most small businesses to buy cyber insurance. The requirements in this article come from carriers as a condition of coverage, and sometimes from contracts with clients, landlords, or partners who ask you to carry it.
Does regular antivirus count as EDR for cyber insurance?
Often it doesn't. Many carriers ask specifically for endpoint detection and response, which monitors behavior, alerts, and can isolate or roll back a device. Check your application's exact wording and confirm with your broker which products count.
Does text-message MFA count?
Many applications accept any MFA, but some carriers ask about stronger methods. CISA recommends phishing-resistant MFA, such as security keys or passkeys, especially for email and admin accounts. Authenticator-app or security-key MFA is a safer default than text messages.
What happens if I answer "yes" to a control I don't actually have?
Application answers are representations the carrier relies on. If one turns out to be untrue, the carrier may dispute a claim or the policy itself, depending on its wording. Answer accurately, then fix the gap and update your broker.
How long do I have to notify customers after a data breach in Arizona?
Under A.R.S. 18-552, you have 45 days after determining a breach occurred. If more than 1,000 Arizona residents need notice, you must also notify the three largest credit reporting agencies, the Attorney General, and the director of the Arizona Department of Homeland Security. Consult an attorney about your situation.
Can Valley CISO sell me a cyber insurance policy?
No. Valley CISO isn't an insurance agency or broker. We implement and document the security controls carriers ask about so you can answer the application accurately. Your broker handles the policy.
How much does it cost to get insurance-ready with Valley CISO?
The Managed IT + Cyber Insurance Readiness plan is $250 per month with no setup fee, month to month after a short written service agreement. A one-time questionnaire working session is $145.
About the author
Founder, Valley CISO
Austin Thompson is the founder of Valley CISO in Gilbert, AZ. A U.S. Coast Guard veteran (2016–2024), he has more than four years of experience in threat hunting and security operations center (SOC) work. Austin holds an M.S. in Cybersecurity and Information Assurance from Western Governors University (WGU, 2025) and a B.S. in Information Technology from the University of Phoenix. His certifications include CompTIA SecurityX (CASP+), CySA+, and PenTest+, and ISC2 Certified in Cybersecurity (CC).
Want a second set of eyes on your setup?
Run the free external security scan, or take the 60-second fit check. Questions by email: athompson@valleyciso.com.