What Cybersecurity Does an Arizona Nonprofit Need, and Can Grants Pay for It?

Here are the top 5 cybersecurity and compliance challenges for charitable Arizona organizations.

1. The “Donor Data” Dilemma (Prop 211 vs. Privacy)

Arizona’s “Voters’ Right to Know Act” (Prop 211) has created a complex data environment for organizations involved in advocacy. It applies once an organization spends more than $50,000 on campaign media in a statewide cycle (or $25,000 in other races), and the Arizona Supreme Court left it in effect in June 2026.

• The Challenge: You may be legally required to disclose top donors for political spending publicly, but you are simultaneously required to protect the private data (addresses, credit cards) of those same donors from hackers.
• Arizona Context: High-net-worth donors in Scottsdale and Paradise Valley are increasingly targeted by “Whaling” attacks (phishing targeted at wealthy individuals). If a breach at your non-profit exposes their private emails, you don’t just lose data; you lose the trust of your biggest benefactors.
• The Risk: Navigating the line between “Public Disclosure” and “Data Breach” requires precise data segmentation. A simple spreadsheet error could expose anonymous donors, leading to lawsuits and a collapse in future funding.

2. CEO Fraud & “Urgency” Scams

Non-profits are a favorite target for “Social Engineering” because their culture is built on helpfulness and urgency.

• The Challenge: Attackers spoof the email of the Executive Director (ED) or Board Member, sending a message to the finance manager: “I’m at a fundraiser and need a check wired immediately to secure the venue.”
• Arizona Context: During the busy “Gala Season” (Spring and Fall in Phoenix/Tucson), staff are overwhelmed and guards are down. Attackers time their campaigns to coincide with major local events, such as the Phoenix Open or charity golf tournaments.
• The Impact: We have seen Arizona charities lose $50,000+ in a single afternoon because a well-meaning volunteer paid a fake vendor invoice without verifying it.

3. The “Accidental” HIPAA Violation

Many Arizona social service agencies don’t realize they are, in fact, healthcare providers under the law.

• The Challenge: If your non-profit provides counseling, addiction recovery, or housing support (like many in the ‘Valley of the Sun’), you are likely to collect medical info or SSNs.
• The Trap: If your organization is a HIPAA covered entity, using free tools like Google Sheets or standard Gmail to track “client intake” without a signed BAA (Business Associate Agreement) is a violation. Substance use programs are also bound by 42 CFR Part 2, which is stricter still.
• Compliance Impact: A breach of this data triggers federal OCR investigations. For a non-profit operating on thin margins, the resulting penalties and response costs can be a “lights out” event.

4. Third-Party Platform Risks (The “Blackbaud” Effect)

Arizona non-profits rarely host their own servers; they rely on massive donation platforms (Classy, Bloomerang, DonorPerfect).

• The Challenge: You trust these vendors with your entire database. But when they get hacked (like the massive Blackbaud breach), you are still responsible for notifying your Arizona donors.
• Arizona Law: Under A.R.S. § 18-552, if your vendor leaks data, the 45-day clock to notify your donors (and the Arizona Attorney General, if more than 1,000 Arizonans are affected) starts ticking for you, not just the vendor.
• Action Required: You must have an “Incident Response Plan” that dictates exactly how you will communicate with your donors if your CRM goes down, ensuring you control the narrative, not the hackers.

5. Missing Out on “Free” Security Money (NSGP Grants)

One of the biggest tragedies in the Arizona non-profit sector is leaving federal security money on the table.

• The Opportunity: The federal Nonprofit Security Grant Program (NSGP), administered in Arizona by the Arizona Department of Homeland Security, provides funds specifically to harden “soft targets” against attack, for nonprofits at high risk of terrorist or extremist attack. This includes funding for cybersecurity upgrades, not just cameras and fences. The federal program has allowed up to $200,000 per site; Arizona also runs a smaller state program (AZ-NSGP).
• The Hurdle: To win these grants, you must submit a formal “Vulnerability Assessment.” Most small non-profits don’t know how to write one, so they don’t apply.
• Our Role: We help Arizona non-profits perform the required Risk Assessments to apply for NSGP funding, effectively helping you get the government to pay for your cybersecurity upgrades.

A Practical Security Plan for an Arizona Nonprofit

Five steps, in the order that removes the most risk per dollar.

1. Lock down every account

Turn on multi-factor authentication for email, the donor CRM, payment processors and online banking. Remove shared logins and the accounts of departed staff, volunteers and board members, which are the easiest way in.

2. Put a call-back rule on money

No new payee, changed bank account, wire or gift card request is paid until someone confirms it by phone at a number already on file. Add a second approver above a set amount. This one rule stops most CEO fraud.

3. Separate public donor data from private donor data

Use role-based access in the CRM so only the people who need full donor records can see or export them, and keep any Prop 211 disclosure list apart from the complete database.

4. Protect client records the way the law expects

If you run counseling, housing, recovery or health programs, keep client data in platforms covered by a signed BAA, encrypt laptops and phones, and log who opens what. Spreadsheets and personal email are where these breaches start.

5. Plan for the vendor breach before it happens

Keep a list of every platform that holds donor or client data, and an incident response plan with the A.R.S. 18-552 timeline and a donor message drafted in advance. When a platform like Blackbaud is breached, the organizations with a plan keep their donors.

What Does It Cost, and How Can Grants Help?

Coeus publishes the same pricing for nonprofits as for every client: fully managed IT typically runs $150 to $250 per user per month and co-managed IT $105 to $205, roughly $4,500 to $10,000 a month for a 30 to 40 person organization. Organizations eligible for NSGP can offset one-time security upgrades with grant funds; the application needs a vulnerability assessment for each site. Details: How much does managed IT cost in Phoenix?

Related Reading

• Managed cybersecurity and vCISO services
• Compliance advisory services for Phoenix organizations
• Is $200 per user per month a fair price for managed IT in Phoenix?

Frequently Asked Questions

Can Nonprofit Security Grant (NSGP) money pay for cybersecurity?

Yes, for eligible organizations. FEMA describes NSGP as funding facility hardening and physical and cybersecurity improvements for nonprofits at high risk of terrorist or other extremist attack. In Arizona you apply through the Arizona Department of Homeland Security (AZDOHS). The federal program has allowed up to $200,000 per site and up to three sites; Arizona also runs a separate state program (AZ-NSGP) with a lower cap. Every site needs its own vulnerability assessment, and amounts change each grant year, so check the current AZDOHS guidance.

Does Prop 211 apply to our nonprofit?

Only if you spend on campaign media. Arizona’s Voters’ Right to Know Act applies to organizations that spend more than $50,000 on campaign media in a statewide election cycle, or more than $25,000 in other races, and requires disclosing the original sources of contributions of $5,000 or more. The Arizona Supreme Court left the law in effect in June 2026. If it applies to you, keep the disclosure list separate from your full donor records.

Does HIPAA apply to a nonprofit?

It does if you are a covered entity, for example a counseling or health provider that bills insurance electronically, or a business associate handling health data for one. Substance use disorder programs also fall under 42 CFR Part 2, which is stricter. Organizations outside HIPAA still owe Arizona breach notice under A.R.S. 18-552 for Social Security numbers, financial account numbers and similar personal information.

How much does managed IT cost for an Arizona nonprofit?

Coeus publishes the same ranges for every client: fully managed IT typically runs $150 to $250 per user per month and co-managed IT $105 to $205, so a 30 to 40 person organization is roughly $4,500 to $10,000 a month. Only staff and volunteers who need their own accounts count as users.

What should we do if our donor platform is breached?

Find out from the vendor exactly which records and fields were exposed, then follow your incident response plan. Under A.R.S. 18-552 the 45-day notice duty sits with your organization as the owner of the data, not only with the vendor, and more than 1,000 affected Arizonans also means notifying the credit bureaus and the Attorney General. Contact major donors personally before they read about it.

How do we stop CEO fraud and fake invoice scams?

With a call-back rule: no new payee, changed bank account, wire or gift card purchase is paid until someone confirms it by phone at a number already on file, never one in the email. Add a second approver above a set dollar amount and turn on multi-factor authentication for every mailbox, including board members who use the organization’s email.

About Coeus Consulting

Coeus Consulting is a Phoenix-based managed IT services provider and MSSP serving small and mid-sized businesses across managed IT, cybersecurity, cloud, and compliance. We help organizations make practical technology decisions that improve resilience without losing sight of business reality. Coeus is BBB A+ rated and based at 531 E Thomas Rd, Suite 102, Phoenix, AZ 85012. Call (602) 93-COEUS or book time with Coeus Consulting.

Protect Your Donors. Protect Your Mission.

In the age of Prop 211 and “Whaling” attacks, a single data breach can shatter the trust of your biggest benefactors. Don’t let a spreadsheet error or a spoofed email cost you your reputation.

Secure Your Donor Data Today. We help Arizona non-profits balance transparency with privacy, securing donor lists and stopping “CEO Fraud” before money leaves the bank.