If your IT budget only covers computers, Microsoft 365, and the occasional repair, it’s probably missing several costs.
Your business may also be paying for software subscriptions, cloud storage, backups, security tools, internet services, phone systems, websites, network equipment, staff training, and outside IT support. Some of those costs appear every month. Others arrive once a year, or only when equipment needs replacing. Without a complete budget, an annual renewal or a failed computer can quietly become an expense the business never prepared for.
A detailed IT budget shows what you’re paying for now, what will need to be replaced, and which improvements are planned for the year ahead. It’s exactly the kind of structure a good Managed IT provider should be helping you build.
There Is No Standard IT Budget for Every Small Business
Online benchmarks often suggest spending a certain percentage of revenue on technology. That percentage may have little real connection to what your business actually needs.
A ten-person law firm, a retailer, and a manufacturing business can have similar revenue but completely different systems. The number of employees, business locations, devices, cloud services, security requirements, and customer obligations all affect the budget.
Consider how much the business depends on each system. If losing internet access would stop customer payments, the internet connection needs more attention than it would in a business that can keep working offline. If employees handle sensitive financial or health information, security and compliance costs may be higher too.
Calculate the cost of the systems your business actually needs first. Revenue-based benchmarks can provide context afterward — but they shouldn’t determine the budget.
Start With a Complete Technology Inventory
You can’t budget properly if you don’t know what the business owns and pays for.
Create an inventory of computers, phones, tablets, printers, servers, network equipment, software, cloud services, websites, domains, backup systems, and phone services.
Record who uses each item, what it costs, when it renews, who manages it, and how important it is to the business. Include the supplier, contract term, billing frequency, and account owner.
The NIST Cybersecurity Framework 2.0 Small Business Quick Start Guide recommends maintaining an inventory of hardware, software, systems, and services, and recording the effect on the business if an important asset becomes unavailable.
Check invoices, company credit cards, bank statements, app stores, and department expenses. Software purchased directly by an employee may not appear in the main IT records at all.
The inventory may reveal duplicate services, licences assigned to former employees, equipment that no longer receives updates, or subscriptions nobody’s actually using anymore.
Budget for Computers and Other Equipment
Include every physical device the business expects to purchase or replace during the year.
The cost of a new computer may also include monitors, docking stations, keyboards, headsets, webcams, carrying cases, warranty coverage, and delivery.
The device will need preparing before an employee can use it. Setup may include installing software, applying security settings, creating user accounts, transferring data, connecting printers, and testing access to business systems.
Other equipment may include mobile phones, tablets, printers, scanners, payment terminals, security cameras, wireless access points, network switches, firewalls, and battery backup units.
Keep a record of each device’s purchase date, warranty status, operating system, and expected replacement date. Replacing a planned number of computers each year is far easier to budget for than waiting until several become unreliable all at once.
Remember to include spare equipment. A prepared spare laptop can reduce downtime significantly when a device is damaged or fails.
Old equipment also creates costs. Business data must be securely removed before a computer, phone, or storage device is sold, recycled, returned, or discarded.
Include Software and Cloud Subscriptions
List every subscription used by the business.
These may include email and productivity software, accounting systems, customer management platforms, industry-specific applications, electronic signature services, password managers, security software, backup services, cloud storage, device management, website hosting, and domain registrations.
Check whether each service is billed monthly or annually. Several annual renewals arriving in the same month can affect cash flow even when the monthly equivalent would have seemed perfectly affordable.
Record the renewal date and current number of licences. Remove licences assigned to former employees, unused accounts, and duplicate services. Confirm whether the provider requires a minimum number of users or an annual commitment.
Allow for hiring during the year. A new employee may need more than just an email licence — they could also require security software, cloud backup, a business phone number, device management, and access to specialist applications.
Storage and usage charges also need attention. Some cloud services charge more when the business stores additional data, sends more messages, adds locations, or uses advanced features.
Review what’s actually included in each subscription. Support, backup, security, data retention, and reporting may require a more expensive plan or a separate service entirely.
Account for Employee Onboarding and Offboarding
A new employee may need a computer, accessories, software licences, security tools, user accounts, phone services, and setup work. If the role is new, the business may also need additional storage, internet capacity, or specialist software.
When someone leaves, their access must be removed, company information transferred, equipment collected, and software licences cancelled or reassigned. The business may need to preserve email or files for operational, legal, or compliance reasons.
Contractors and temporary staff also create costs. Even when they use their own equipment, they may still need accounts, secure access, software, and support.
Estimate the expected number of new starters and departures during the budget period. Include both the technology and the work required to manage those changes.
Decide How You Will Pay for IT Support
Your business may use a Managed IT provider, employ internal IT staff, pay for support as needed, or combine these approaches.
For managed IT services, confirm exactly what the monthly agreement covers. It may include help desk support, monitoring, software updates, device management, user administration, security tools, vendor support, and routine maintenance.
Ask which services are billed separately. Projects, after-hours work, office moves, major upgrades, equipment installation, and support for specialist applications may sit outside the regular agreement.
If you pay for support as needed, review the previous two or three years of invoices. Include emergency work, not just routine maintenance. Check how much was spent after equipment failures, account problems, internet outages, and security incidents.
Internal IT costs may include salaries, benefits, recruitment, training, certifications, and cover during holidays or illness. A single internal employee may still need outside help for specialist projects or serious incidents.
Set Aside Money for Cybersecurity
Cybersecurity spending should be clearly identified in the budget, even when some services are included in your software licences or IT support agreement.
Your cybersecurity budget may include endpoint protection, email filtering, multifactor authentication, password management, device management, security monitoring, software updates, vulnerability checks, staff training, and incident-response planning.
The correct controls depend on the systems you use, the information you hold, and the damage a security incident could cause.
A business that stores customer payment details or confidential client records may need more protection than one that holds little sensitive data. Regulations, customer contracts, and cyber insurance requirements may also affect what must be implemented.
The NIST Cybersecurity Framework 2.0 covers six areas: governing cybersecurity risk, identifying important systems, protecting them, detecting incidents, responding, and recovering. Use those areas to check whether your budget covers more than just preventive security software.
Not every small business needs every security product. Ask your IT provider to explain which controls are recommended, which risks they address, and whether they’re already included in another service.
Include Backup and Recovery Costs
Budget for the entire backup and recovery process, not only the storage used to hold backup copies.
Costs may include backup software, cloud storage, isolated copies, monitoring, restore testing, and professional help during recovery.
Confirm what’s actually being backed up. Important information may be stored on employee computers, servers, cloud platforms, accounting systems, websites, mobile devices, and specialist applications.
Don’t assume every cloud service retains deleted or damaged information for as long as your business requires. Review the provider’s retention periods and recovery features. If those options don’t meet your needs, include a separate backup service in the budget.
Backups also need to be tested. A successful backup notification shows that a task ran. A restore test confirms that the data can actually be recovered and used — which is a different thing entirely.
The UK National Cyber Security Centre recommends regularly backing up essential information and testing that it can be restored.
Allow for storage growth too. If your business creates more files, emails, recordings, images, or customer records each year, backup costs may climb right along with it.
Budget for Internet and Network Equipment
Include your internet service, routers, firewalls, switches, wireless access points, cabling, and any support or security subscriptions attached to that equipment.
If losing internet access would stop the business from working, consider the cost of a backup connection. Compare that cost with the revenue, wages, and customer service time that could be lost during an outage.
Ask whether the backup connection uses a different type of service or supplier. Two connections may still depend on the same local infrastructure, which means one fault could affect both.
Review whether your current connection can support expected hiring, cloud applications, video calls, backups, and customer Wi-Fi. A service that works fine for ten employees may not be suitable once the business grows.
Network equipment requires software updates and eventual replacement. Record the support status of routers, firewalls, switches, and wireless access points. Equipment that no longer receives security updates should be scheduled for replacement.
Include installation and configuration costs. New equipment must be secured, connected to existing systems, documented, and tested before it’s ready to use.
Include Phones and Communication Services
Phone and communication costs may be billed separately from other IT services, but they still belong in the technology budget.
Include business phone systems, mobile plans, phone numbers, call recording, voicemail, video conferencing, messaging, and contact-centre services.
Check whether the service charges per user, phone number, call, recording, or storage amount. International calling, premium support, and additional features may create separate charges.
Include phones and headsets for new employees. If the business records calls, budget for the required storage, access controls, and retention settings.
Check when contracts end and whether equipment must be returned. Changing phone providers may also involve setup, number transfers, staff training, and temporary overlap between the old and new services.
Include Website, Domain, and Online Service Costs
These can include domain registration, website hosting, security certificates, website maintenance, software updates, plugins, backups, online forms, analytics, and email delivery services.
Confirm who owns the domain and website accounts. They should be registered to the business rather than an employee, contractor, or web developer.
Record domain renewal dates and enable appropriate renewal notifications. Losing control of a business domain can interrupt the website, email, and other services connected to it — more easily than most owners realise.
If the website accepts payments, bookings, or customer information, include the cost of maintaining its security and testing that it works.
Budget for Staff Training
Employees need training on the systems they use and the security risks they may encounter.
The budget may include cybersecurity awareness training, phishing simulations, training for new software, and instructions for employees who handle sensitive information or approve payments.
Training should also cover what employees must do when they receive a suspicious request, lose a device, send information to the wrong person, or notice unusual activity.
The Australian Cyber Security Centre’s Small Business Cyber Security Guide includes employee training and awareness as part of protecting a business from email attacks.
Include the time employees need to complete training. Even when the training platform is inexpensive, staff still need time during the working day to actually use it.
New systems may require additional training. Include that cost in the project budget instead of assuming employees will just figure out the software unsupported.
Allow for Compliance, Contracts, and Cyber Insurance
Your industry, location, customer contracts, or insurance policy may require specific technology and security controls.
Costs may include security assessments, audits, policy reviews, vulnerability testing, data-retention changes, access reviews, incident-response exercises, or independent certifications.
A customer may ask your business to complete a security questionnaire before signing or renewing a contract. Answering it may reveal controls that need to be introduced.
Cyber insurance applications may also ask about multifactor authentication, backups, endpoint protection, email security, employee training, and incident-response planning.
Review upcoming renewals and audits before approving the budget. This gives the business time to obtain quotes and complete required work.
Legal and compliance requirements differ between countries and industries. Confirm your obligations with the appropriate legal, compliance, insurance, and IT advisers.
Plan for Technology Projects
Keep planned projects separate from normal operating costs.
Projects may include moving offices, opening another location, replacing a server, changing phone systems, improving Wi-Fi, moving data to a new cloud service, or introducing a new business application.
Estimate the complete project cost. Include planning, licences, equipment, implementation, data transfer, testing, training, temporary services, and support after launch.
Some projects require two systems to run at the same time while information is moved and employees are trained. Include that overlap in the budget.
Ask department managers what changes they expect during the year. A new service introduced by one department may require additional security, storage, integration, backup, and support work.
Business.gov.au recommends including both upfront and ongoing costs when preparing a digital budget. Check what the project will cost once the initial work is complete.
Review Supplier Contracts and Renewal Dates
Record the contract owner, renewal date, notice period, billing method, and cancellation process for each major supplier.
Some services renew automatically. Others require advance notice if you want to reduce licences or cancel the agreement.
Check whether prices can change during the contract, and whether the agreement includes minimum quantities. If the business expects to reduce staff or stop using a system, make sure the contract allows the licences to be reduced.
Confirm how data can be exported and what happens when the service ends. A cheaper replacement may still involve migration, setup, training, and temporary overlap costs.
Do not leave important technology accounts tied to one employee’s personal email address or payment card. The business should retain access if that person leaves.
Keep a Reserve for Unplanned Costs
A laptop may be damaged, a firewall may fail, an employee may need urgent replacement equipment, or a technical problem may require work outside the support agreement.
There’s no reserve percentage that suits every business. Base the amount on realistic costs — replacing an essential computer, obtaining emergency support, or restoring an important service.
Review unplanned IT spending from previous years and use those figures when deciding how much to set aside.
The reserve should be separate from planned replacements. A computer already scheduled for replacement is not an unexpected cost.
Separate Recurring Costs From One-Time Costs
Recurring costs include software subscriptions, support agreements, internet services, phone systems, backup services, security tools, and equipment leases.
One-time costs include new equipment, migrations, office moves, installation work, and major upgrades.
Record annual subscriptions separately from monthly ones so the business knows exactly when larger payments are due.
You may also need to separate operating expenses from capital purchases for accounting and tax purposes. The rules vary by location, so confirm the correct treatment with your accountant.
How to Build Your Small Business IT Budget
- Create an inventory of your hardware, software, services, suppliers, and contracts.
- Record current monthly and annual costs, renewal dates, and notice periods.
- Identify equipment that needs to be replaced during the budget period.
- Estimate hiring, departures, new locations, and other business changes.
- Add support, cybersecurity, backup, training, compliance, and recovery costs.
- Create separate budgets for planned technology projects.
- Add a reserve based on realistic emergency support and replacement costs.
- Review the completed budget with your IT provider and accountant.
Record who approved each item and who is responsible for managing it. Review actual spending during the year instead of waiting until the next annual budget.
Review the Budget During the Year
Check the budget at least every quarter.
Compare actual invoices with the amounts expected. Look for new subscriptions, unused licences, supplier price changes, additional storage charges, and projects that cost more or less than planned.
Update the forecast when the business hires employees, changes locations, introduces new services, or signs a contract with new security requirements.
A quarterly review also gives you time to plan for upcoming annual renewals. It’s far easier to compare providers or change services when the renewal deadline is still several months away, rather than scrambling at the last minute.
Frequently Asked Questions
How Much Should a Small Business Spend on IT?
There’s no reliable percentage for every small business. Calculate the cost of the equipment, services, security, support, and projects your business needs. Industry benchmarks can provide context, but they should not replace a budget based on your own operations and risks.
Should Cybersecurity Have a Separate Budget?
Cybersecurity costs should be clearly identified, even when some are included in software licences or an IT support agreement. This makes it easier to see which protections are funded and which improvements still require approval.
How Often Should the IT Budget Be Reviewed?
Review it at least annually when preparing the budget, and quarterly during the year. Update it after significant hiring, office moves, new systems, supplier changes, or new compliance requirements.
Should Equipment Purchases and Monthly Services Be Combined?
Include both in the overall IT budget, but record them separately. This makes recurring operating costs easier to distinguish from one-time purchases and projects.
What Costs Are Commonly Left Out of an IT Budget?
Setup work, employee onboarding and offboarding, backup testing, staff training, security reviews, equipment disposal, project work, subscription increases, and urgent replacements are commonly overlooked.
Who Should Prepare the IT Budget?
The business owner or finance team should work with the person responsible for IT. Department managers should also provide information about hiring, new software, planned projects, and changes to business operations.
Sources and Further Reading
NIST Cybersecurity Framework 2.0 for Small Business — NIST’s framework overview for small business cybersecurity.
NIST Cybersecurity Framework 2.0 Small Business Quick Start Guide — practical guidance on asset inventory and risk.
Small Organisations Guide to Cyber Security: UK National Cyber Security Centre — NCSC guidance for small organisations.
Small Business Response and Recovery Guide: UK National Cyber Security Centre — recovery planning guidance.
Small Business Cyber Security Guide: Australian Cyber Security Centre — ACSC’s guide for small businesses.
Develop Your Digital Strategy: Business.gov.au — guidance on budgeting for digital projects.
Whether you’re running a lean operation in Mackay or scaling up across Brisbane, a proper IT budget turns surprise expenses into planned ones — and that alone is worth the afternoon it takes to build.
Ask your IT Support provider to review the budget before you approve it. And if you don’t have one, check out our cybersecurity services, or get in touch with us and we’ll help you sort it out.
—
