Managed IT Services in Phoenix, AZ

Arizona has its own breach notification statute, and it applies to your Phoenix business whether or not any federal rule does. Here is what A.R.S. 18-552 and A.R.S. 18-551 say.

• It applies to your size of business. The statute covers any person that conducts business in Arizona and owns, maintains, or licenses unencrypted and unredacted computerized personal information. Section 18-551 defines person broadly enough to include partnerships, associations, and any other commercial entity. There is no employee-count floor and no revenue floor, so a two-person shop is covered on the same terms as a large one.
• The deadline is 45 days, and it runs from the determination, not the incident. Notification is required within 45 days after the determination that a breach occurred. The statute separately expects a prompt investigation to reach that determination, so a slow investigation does not buy a longer runway.
• Notifying more than 1,000 individuals adds three more recipients. If a breach requires notifying more than 1,000 individuals, the business must also notify the three largest nationwide consumer reporting agencies, the Arizona Attorney General, and the director of the Arizona Department of Homeland Security, in writing. Check whether the breach checklist you are working from names that last one, because it is specific to Arizona.
• Personal information is broader than Social Security numbers. Alongside the usual elements, the definition covers a user name or email address combined with a password or a security question and answer that allows access to an online account. A compromised customer login list can trigger the statute on its own.
• Encryption sits inside the definition of a breach. The statute defines a breach around unencrypted and unredacted data, so properly encrypted information falls outside it. That is the most practical reason to encrypt what you store.

On penalties: A.R.S. 18-552(L) lets the Arizona Attorney General impose a civil penalty not to exceed the lesser of $10,000 per affected individual or the total economic loss sustained by affected individuals, with a maximum of $500,000 from a breach or a series of related breaches. Reporting to the AG is done through a notification form the Arizona Attorney General publishes, and submissions are confidential under A.R.S. 44-1525 and exempt from Arizona public records disclosure with limited exceptions, so filing is not the same as publishing.

Two carve-outs matter. Businesses complying with the notification requirements of the federal Gramm-Leach-Bliley Act (GLBA), which governs financial institutions, and HIPAA covered entities along with their business associates, are outside 18-552 and follow their federal rules instead. Separately, notification is not required if the business, an independent third-party forensic auditor, or a law enforcement agency determines after a reasonable investigation that the breach has not resulted in and is not reasonably likely to result in substantial economic loss to affected individuals. That determination has to rest on a documented investigation.

There is a second Arizona statute worth knowing if you keep paper. A.R.S. 44-7601 prohibits knowingly discarding records containing personal identifying information without redacting or destroying the information first, with civil penalties of up to $500 for a first violation, $1,000 for a second, and $5,000 for a third or later one, per violation. It applies only to paper records and paper documents, and GLBA, HIPAA, and Fair Credit Reporting Act entities are excluded. Written disposal procedures that everyone follows, shredding or redacting before anything goes in the bin, are what the statute asks for.

What we do about all of it: encryption on the data that would otherwise put you inside the definition, logging and monitoring so a determination can be made from evidence rather than guesswork, an incident response plan that names who calls whom on day one, and the documentation an investigation needs. That work sits in our compliance services and our security services. This section is a plain-language summary of the statutes for planning purposes and is not legal advice.

Three fixed bundles, priced per user per month on the assumption of one computer per person, with the Microsoft 365 license inside the price:

• Trailhead, $166 per user per month. Essential IT. Managed help desk from 7am to 7pm on weekdays, endpoint protection, patching, workstation backup, and file-level offsite backup for servers, with Microsoft 365 Business Premium included in the price. Server and network device management are included too.
• Ridgeline, $241 per user per month. Business Security. Everything in Trailhead, plus a help desk staffed 24 hours every day, managed detection and response, an onsite backup appliance that recovers a failed server far faster than restoring files over the internet, security awareness training, and identity and access management. This is where most small businesses land.
• Summit, $271 per user per month. Full-Stack IT. Everything in Ridgeline, plus Microsoft 365 E5, a 24/7 security operations center (analysts watching alerts at 3 a.m.), cloud security monitoring, and virtual CIO advisory (the technology planning role you would otherwise hire for), included up to 6 hours a month.

The three figures are fixed bundle prices rather than the sum of their parts, so the step between tiers is not the same as the price of what the tier adds. The monthly floor is $1,400. Below 9 users on the entry bundle you pay the floor rather than the per-user figure, which is worth knowing before you compare anything. Volume discounts come off the managed monthly and step at set headcounts: 4 percent at 25 users, 10 percent at 100, continuing upward, with a custom agreement above 300 users. The full schedule and a calculator that applies it live on our pricing page.

A worked example. A 12-person Phoenix office on Ridgeline: 12 times $241 is $2,892 a month. That clears the $1,400 floor and sits under the 25-user discount threshold, so no adjustment lands in either direction. If that office runs a server, a firewall, and a couple of switches, the figure does not move: managing them is already in the price.

A second one, where the discount bites. A 30-person office on Trailhead: 30 times $166 is $4,980. The 4 percent break at 25 users removes $199.20, leaving $4,780.80 a month, an effective $159.36 per user.

Managing your servers, firewalls, switches, and access points is inside the per-user price. We do not bill per device for it. What sits outside the monthly figure is short: discovery and onboarding, the one-time work of taking your environment on, which we scope and quote rather than publish because it varies with what the audit finds (as a planning figure it commonly runs two to three times the first monthly invoice); 24-hour SIEM monitoring if you want it, at $130 per server, $100 per firewall, $50 per switch, and $35 per access point per month; employee onboarding at $150 and offboarding at $75, charged when someone starts or leaves rather than as a per-head fee for switching; hardware purchases; and project work such as a cloud migration, an office move, or a network redesign, which we scope and quote per engagement.

For how these figures compare against the wider 2026 market, and how to normalize a quote you are already holding, see our breakdown of managed IT cost per user per month. To model your own team against the cost of hiring, the IT cost calculator does that math. Or tell us your headcount and we will send a written quote.