Article Summary: Your IT budget should include the technology you already use, the support required to maintain it and the upgrades you expect to make during the year. It should also cover cybersecurity, backups, employee changes, planned projects and a reserve for urgent repairs or replacements.

If your IT budget only covers computers, Microsoft 365 and the occasional repair, it is probably missing several costs.

Your business may also be paying for software subscriptions, cloud storage, backups, security tools, internet services, phone systems, websites, network equipment, staff training and outside IT support.

Some of those costs appear every month. Others arrive once a year or only when equipment needs to be replaced. Without a complete budget, an annual renewal or failed computer can become an expense the business did not prepare for.

A detailed IT budget shows what you are paying for now, what will need to be replace, and which improvements are planned for the year.

There Is No Standard IT Budget for Every Small Business

Online benchmarks often suggest spending a certain percentage of revenue on technology. That percentage may have little connection to what your business needs.

A ten-person law firm, a retailer and a manufacturing business can have similar revenue but completely different systems. The number of employees, business locations, devices, cloud services, security requirements and customer obligations all affect the budget.

Consider how much the business depends on each system. If losing internet access would stop customer payments, the internet connection needs more attention than it would in a business that can continue working offline. If employees work with sensitive financial or health information, security and compliance costs may be higher.

Calculate the cost of the systems your business needs first. Revenue-based benchmarks can then provide context but they should not determine the budget.

Start With a Complete Technology Inventory

You cannot budget properly if you do not know what the business owns and pays for.

Create an inventory of computers, phones, tablets, printers, servers, network equipment, software, cloud services, websites, domains, backup systems and phone services.

Record who uses each item, what it costs, when it renews, who manages it and how important it is to the business. Include the supplier, contract term, billing frequency and account owner.

The NIST Cybersecurity Framework 2.0 Small Business Quick Start Guide recommends maintaining an inventory of hardware, software, systems and services. It also recommends recording the effect on the business if an important asset becomes unavailable.

Check invoices, company credit cards, bank statements, app stores and department expenses. Software purchased directly by an employee may not appear in the main IT records.

The inventory may reveal duplicate services, licenses assigned to former employees, equipment that no longer receives updates or subscriptions that no one uses.

Budget for Computers and Other Equipment

Include every physical device the business expects to purchase or replace during the year.

The cost of a new computer may also include monitors, docking stations, keyboards, headsets, webcams, carrying cases, warranty coverage and delivery.

The device will need to be prepared before an employee can use it. Setup may include installing software, applying security settings, creating user accounts, transferring data, connecting printers and testing access to business systems.

Other equipment may include mobile phones, tablets, printers, scanners, payment terminals, security cameras, wireless access points, network switches, firewalls and battery backup units.

Keep a record of each device’s purchase date, warranty status, operating system and expected replacement date. Replacing a planned number of computers each year is easier to budget for than waiting until several become unreliable at the same time.

Remember to include spare equipment. A prepared spare laptop can reduce downtime when a device is damaged or fails.

Old equipment also creates costs. Business data must be securely removed before a computer, phone or storage device is sold, recycled, returned or discarded.

Include Software and Cloud Subscriptions

List every subscription used by the business.

These may include email and productivity software, accounting systems, customer management platforms, industry-specific applications, electronic signature services, password managers, security software, backup services, cloud storage, device management, website hosting and domain registrations.

Check whether each service is billed monthly or annually. Several annual renewals arriving in the same month can affect cash flow even when the monthly equivalent appears affordable.

Record the renewal date and current number of licenses. Remove licenses assigned to former employees, unused accounts and duplicate services. Confirm whether the provider requires a minimum number of users or an annual commitment.

Allow for hiring during the year. A new employee may need more than an email license. They could also require security software, cloud backup, a business phone number, device management and access to specialist applications.

Storage and usage charges also need attention. Some cloud services charge more when the business stores additional data, sends more messages, adds locations or uses advanced features.

Review what is included in each subscription. Support, backup, security, data retention and reporting may require a more expensive plan or a separate service.

Account for Employee Onboarding and Offboarding

A new employee may need a computer, accessories, software licenses, security tools, user accounts, phone services and setup work. If the role is new, the business may also need additional storage, internet capacity or specialist software.

When someone leaves, their access must be removed, company information transferred, equipment collected and software licenses canceled or reassigned. The business may need to preserve email or files for operational, legal or compliance reasons.

Contractors and temporary staff also create costs. Even when they use their own equipment, they may still need accounts, secure access, software and support.

Estimate the expected number of new starters and departures during the budget period. Include both the technology and the work required to manage those changes.

Decide How You Will Pay for IT Support

Your business may use a managed IT provider, employ internal IT staff, pay for support when needed or combine these approaches.

For managed IT services, confirm exactly what the monthly agreement covers. It may include help desk support, monitoring, software updates, device management, user administration, security tools, vendor support and routine maintenance.

Ask which services are billed separately. Projects, after-hours work, office moves, major upgrades, equipment installation and support for specialist applications may sit outside the regular agreement.

If you pay for support as needed, review the previous two or three years of invoices. Include emergency work instead of just routine maintenance. Check how much was spent after equipment failures, account problems, internet outages and security incidents.

Internal IT costs may include salaries, benefits, recruitment, training, certifications and cover during holidays or illness. A single internal employee may still need outside help for specialist projects or serious incidents.

Set Aside Money for Cybersecurity

Cybersecurity spending should be clearly identified in the budget even when some services are included in your software licenses or IT support agreement.

Your cybersecurity budget may include endpoint protection, email filtering, multifactor authentication, password management, device management, security monitoring, software updates, vulnerability checks, staff training and incident-response planning.

The correct controls depend on the systems you use, the information you hold and the damage a security incident could cause.

A business that stores customer payment details or confidential client records may need more protection than one that holds little sensitive data. Regulations, customer contracts and cyber insurance requirements may also affect what must be implemented.

The NIST Cybersecurity Framework 2.0 covers six areas: governing cybersecurity risk, identifying important systems, protecting them, detecting incidents, responding and recovering. Use those areas to check whether the budget covers more than preventive security software.

Not every small business needs every security product. Ask your IT provider to explain which controls are recommended, which risks they address and whether they are already included in another service.

Include Backup and Recovery Costs

Budget for the entire backup and recovery process instead of only the storage used to hold backup copies.

Costs may include backup software, cloud storage, isolated copies, monitoring, restore testing and professional help during recovery.

Confirm what is being backed up. Important information may be stored on employee computers, servers, cloud platforms, accounting systems, websites, mobile devices and specialist applications.

Do not assume every cloud service retains deleted or damaged information for as long as your business requires. Review the provider’s retention periods and recovery features. If those options do not meet your needs, include a separate backup service in the budget.

Backups also need to be tested. A successful backup notification shows that a task ran. A restore test confirms that the data can be recovered and used.

The UK National Cyber Security Centre recommends regularly backing up essential information and testing that it can be restored.

Allow for storage growth. If your business creates more files, emails, recordings, images or customer records each year, backup costs may increase as well.

Budget for Internet and Network Equipment

Include your internet service, routers, firewalls, switches, wireless access points, cabling and any support or security subscriptions attached to that equipment.

If losing internet access would stop the business from working, consider the cost of a backup connection. Compare that cost with the revenue, wages and customer service time that could be lost during an outage.

Ask whether the backup connection uses a different type of service or supplier. Two connections may still depend on the same local infrastructure which means one fault could affect both.

Review whether your current connection can support expected hiring, cloud applications, video calls, backups and customer Wi-Fi. A service that works for ten employees may not be suitable after the business grows.

Network equipment requires software updates and eventual replacement. Record the support status of routers, firewalls, switches and wireless access points. Equipment that no longer receives security updates should be scheduled for replacement.

Include installation and configuration costs. New equipment must be secured, connected to existing systems, documented and tested before it is ready to use.

Include Phones and Communication Services

Phone and communication costs may be billed separately from other IT services but they still belong in the technology budget.

Include business phone systems, mobile plans, phone numbers, call recording, voicemail, video conferencing, messaging and contact-center services.

Check whether the service charges per user, phone number, call, recording or storage amount. International calling, premium support and additional features may create separate charges.

Include phones and headsets for new employees. If the business records calls, budget for the required storage, access controls and retention settings.

Check when contracts end and whether equipment must be returned. Changing phone providers may also involve setup, number transfers, staff training and temporary overlap between the old and new services.

Include Website, Domain and Online Service Costs

These can include domain registration, website hosting, security certificates, website maintenance, software updates, plugins, backups, online forms, analytics and email delivery services.

Confirm who owns the domain and website accounts. They should be registered to the business rather than an employee, contractor or web developer.

Record domain renewal dates and enable appropriate renewal notifications. Losing control of a business domain can interrupt the website, email and other services connected to it.

If the website accepts payments, bookings or customer information, include the cost of maintaining its security and testing that it works.

Budget for Staff Training

Employees need training on the systems they use and the security risks they may encounter.

The budget may include cybersecurity awareness training, phishing simulations, training for new software and instructions for employees who handle sensitive information or approve payments.

Training should also cover what employees must do when they receive a suspicious request, lose a device, send information to the wrong person or notice unusual activity.

The Australian Cyber Security Centre’s Small Business Cyber Security Guide includes employee training and awareness as part of protecting a business from email attacks.

Include the time employees need to complete training. Even when the training platform is inexpensive, staff still need time during the working day to use it.

New systems may require additional training. Include that cost in the project budget instead of assuming employees will learn the software without support.

Allow for Compliance, Contracts and Cyber Insurance

Your industry, location, customer contracts or insurance policy may require specific technology and security controls.

Costs may include security assessments, audits, policy reviews, vulnerability testing, data-retention changes, access reviews, incident-response exercises or independent certifications.

A customer may ask your business to complete a security questionnaire before signing or renewing a contract. Answering it may reveal controls that need to be introduced.

Cyber insurance applications may also ask about multifactor authentication, backups, endpoint protection, email security, employee training and incident-response planning.

Review upcoming renewals and audits before approving the budget. This gives the business time to obtain quotes and complete required work.

Legal and compliance requirements differ between countries and industries. Confirm your obligations with the appropriate legal, compliance, insurance and IT advisers.

Plan for Technology Projects

Keep planned projects separate from normal operating costs.

Projects may include moving offices, opening another location, replacing a server, changing phone systems, improving Wi-Fi, moving data to a new cloud service or introducing a new business application.

Estimate the complete project cost. Include planning, licenses, equipment, implementation, data transfer, testing, training, temporary services and support after launch.

Some projects require two systems to run at the same time while information is moved and employees are trained. Include that overlap in the budget.

Ask department managers what changes they expect during the year. A new service introduced by one department may require additional security, storage, integration, backup and support work.

Business.gov.au recommends including both upfront and ongoing costs when preparing a digital budget. Check what the project will cost after the initial work is complete.

Review Supplier Contracts and Renewal Dates

Record the contract owner, renewal date, notice period, billing method and cancellation process for each major supplier.

Some services renew automatically. Others require advance notice if you want to reduce licenses or cancel the agreement.

Check whether prices can change during the contract and whether the agreement includes minimum quantities. If the business expects to reduce staff or stop using a system, make sure the contract allows the licenses to be reduced.

Confirm how data can be exported and what happens when the service ends. A cheaper replacement may still involve migration, setup, training and temporary overlap costs.

Do not leave important technology accounts tied to one employee’s personal email address or payment card. The business should retain access if that person leaves.

Keep a Reserve for Unplanned Costs

A laptop may be damaged, a firewall may fail, an employee may need urgent replacement equipment or a technical problem may require work outside the support agreement.

There is no reserve percentage that suits every business. Base the amount on realistic costs such as replacing an essential computer, obtaining emergency support or restoring an important service.

Review unplanned IT spending from previous years. Use those figures when deciding how much to set aside.

The reserve should be separate from planned replacements. A computer already scheduled for replacement is not an unexpected cost.

Separate Recurring Costs from One-Time Costs

Recurring costs include software subscriptions, support agreements, internet services, phone systems, backup services, security tools and equipment leases.

One-time costs include new equipment, migrations, office moves, installation work and major upgrades.

Record annual subscriptions separately from monthly ones so that the business knows when larger payments are due.

You may also need to separate operating expenses from capital purchases for accounting and tax purposes. The rules vary by location so confirm the correct treatment with your accountant.

How to Build Your Small Business IT Budget

• Create an inventory of your hardware, software, services, suppliers and contracts.
• Record current monthly and annual costs, renewal dates and notice periods.
• Identify equipment that needs to be replaced during the budget period.
• Estimate hiring, departures, new locations and other business changes.
• Add support, cybersecurity, backup, training, compliance and recovery costs.
• Create separate budgets for planned technology projects.
• Add a reserve based on realistic emergency support and replacement costs.
• Review the completed budget with your IT provider and accountant.

Record who approved each item and who is responsible for managing it. Review actual spending during the year instead of waiting until the next annual budget.

Review the Budget During the Year

Check the budget at least every quarter.

Compare actual invoices with the amounts expected. Look for new subscriptions, unused licenses, supplier price changes, additional storage charges and projects that cost more or less than planned.

Update the forecast when the business hires employees, changes locations, introduces new services or signs a contract with new security requirements.

A quarterly review also gives you time to plan for upcoming annual renewals. It is easier to compare providers or change services when the renewal deadline is still several months away.

Frequently Asked Questions

How much should a small business spend on IT?

There is no reliable percentage for every small business. Calculate the cost of the equipment, services, security, support and projects your business needs. Industry benchmarks can provide context but they should not replace a budget based on your operations and risks.

Should cybersecurity have a separate budget?

Cybersecurity costs should be clearly identified even when some are included in software licenses or an IT support agreement. This makes it easier to see which protections are funded and which improvements still require approval.

How often should the IT budget be reviewed?

Review it at least annually when preparing the budget and quarterly during the year. Update it after significant hiring, office moves, new systems, supplier changes or new compliance requirements.

Should equipment purchases and monthly services be combined?

Include both in the overall IT budget but record them separately. This makes recurring operating costs easier to distinguish from one-time purchases and projects.

What costs are commonly left out of an IT budget?

Setup work, employee onboarding and offboarding, backup testing, staff training, security reviews, equipment disposal, project work, subscription increases and urgent replacements are commonly overlooked.

Who should prepare the IT budget?

The business owner or finance team should work with the person responsible for IT. Department managers should also provide information about hiring, new software, planned projects and changes to business operations.

Sources and Further Reading

• NIST Cybersecurity Framework 2.0 for Small Business
• NIST Cybersecurity Framework 2.0 Small Business Quick Start Guide
• Small Organisations Guide to Cyber Security: UK National Cyber Security Centre
• Small Business Response and Recovery Guide: UK National Cyber Security Centre
• Small Business Cyber Security Guide: Australian Cyber Security Centre
• Develop Your Digital Strategy: Business.gov.au