Small Business IT Budget: What to Include, What Gets Missed
A small business IT budget should cover the technology you already use, the support to maintain it, and the upgrades you expect this year, plus cybersecurity, backups, staffing changes, planned projects, and a reserve for urgent repairs. If yours only covers computers, Microsoft 365, and the occasional repair, it is probably missing several costs.
Your business may also be paying for software subscriptions, cloud storage, backups, security tools, internet service, phone systems, websites, network equipment, staff training, and outside IT support. Some of those costs appear every month. Others arrive once a year or only when equipment fails. Without a complete budget, an annual renewal or a dead computer becomes an expense you did not plan for.
A detailed IT budget shows what you pay for now, what will need to be replaced, and which improvements are planned for the year.
How Much Should a Small Business Spend on IT?
There is no standard number. Online benchmarks often suggest a percentage of revenue, but that percentage may have little connection to what your business needs. A ten-person law firm, a retailer, and a manufacturer can have similar revenue and completely different systems. Employee count, locations, devices, cloud services, security requirements, and customer obligations all change the budget.
Consider how much the business depends on each system. If losing internet access would stop customer payments, the internet connection deserves more attention than it would in a business that can keep working offline. If employees handle sensitive financial or health information, security and compliance costs may be higher.
Price the systems your business needs first. Revenue-based benchmarks can then give you context, but they should not set the budget.
Start With a Complete Technology Inventory
You cannot budget properly if you do not know what the business owns and pays for. List your computers, phones, tablets, printers, servers, network equipment, software, cloud services, websites, domains, backup systems, and phone services.
For each item, record who uses it, what it costs, when it renews, who manages it, and how important it is to the business. Include the supplier, contract term, billing frequency, and account owner.
The NIST Cybersecurity Framework 2.0 Small Business Quick Start Guide recommends keeping an inventory of hardware, software, systems, and services, and recording what happens to the business if an important asset becomes unavailable.
Check invoices, company credit cards, bank statements, app stores, and department expenses. Software an employee bought directly may not appear in the main IT records. An inventory often turns up duplicate services, licenses assigned to former employees, equipment that no longer receives updates, and subscriptions nobody uses.
Budget for Computers and Other Equipment Include every device the business expects to buy or replace this year.
A new computer costs more than the computer. Add monitors, docking stations, keyboards, headsets, webcams, carrying cases, warranty coverage, and delivery. The device also has to be prepared before anyone can use it: installing software, applying security settings, creating accounts, transferring data, connecting printers, and testing access to business systems.
Other equipment may include mobile phones, tablets, printers, scanners, payment terminals, security cameras, wireless access points, network switches, firewalls, and battery backup units.
Keep a record of each device's purchase date, warranty status, operating system, and expected replacement date. Replacing a planned number of computers each year is easier to budget for than waiting until several fail at once.
Include spare equipment. A prepared spare laptop cuts downtime when a device is damaged or fails.
Old equipment has a cost too. Business data must be securely removed before a computer, phone, or storage device is sold, recycled, returned, or discarded.
Include Software and Cloud Subscriptions
List every subscription the business uses. These may include email and productivity software, accounting systems, customer management platforms, industry-specific applications, electronic signature services, password managers, security software, backup services, cloud storage, device management, website hosting, and domain registrations.
Check whether each service is billed monthly or annually. Several annual renewals landing in the same month can strain cash flow even when the monthly equivalent looks affordable. Record the renewal date and the current number of licenses. Remove licenses assigned to former employees, unused accounts, and duplicate services, and confirm whether the provider requires a minimum number of users or an annual commitment.
Allow for hiring. A new employee may need more than an email license. They could also need security software, cloud backup, a business phone number, device management, and access to specialist applications.
Watch storage and usage charges. Some cloud services charge more when you store more data, send more messages, add locations, or use advanced features. Review what each subscription includes, because support, backup, security, data retention, and reporting may require a more expensive plan or a separate service.
Account for Employee Onboarding and Offboarding
A new employee may need a computer, accessories, software licenses, security tools, user accounts, phone services, and setup work. A brand-new role may also need more storage, internet capacity, or specialist software.
When someone leaves, their access must be removed, company information transferred, equipment collected, and software licenses canceled or reassigned. The business may need to keep their email or files for operational, legal, or compliance reasons.
Contractors and temporary staff create costs as well. Even on their own equipment, they may still need accounts, secure access, software, and support.
Estimate how many people you expect to hire and lose this year. Include both the technology and the work required to manage each change.
Set Aside Money for Cybersecurity
Cybersecurity spending should be a clearly identified line in the budget, even when some of it is included in your software licenses or IT support agreement.
Your cybersecurity budget may include endpoint protection, email filtering, multifactor authentication, password management, device management, security monitoring, software updates, vulnerability checks, staff training, and incident-response planning.
The right controls depend on the systems you use, the information you hold, and the damage an incident could cause. A business that stores customer payment details or confidential client records may need more protection than one that holds little sensitive data. Regulations, customer contracts, and cyber insurance requirements may also dictate what you must have in place.
The NIST Cybersecurity Framework 2.0 covers six areas: governing cybersecurity risk, identifying important systems, protecting them, detecting incidents, responding, and recovering. Use those areas to check whether your budget covers more than preventive software.
Not every small business needs every security product. Ask your IT provider which controls they recommend, which risks each one addresses, and whether it is already included in another service.
Include Backup and Recovery Costs
Budget for the whole backup and recovery process, not only the storage that holds the copies. Costs may include backup software, cloud storage, isolated copies, monitoring, restore testing, and professional help during recovery.
Confirm what is being backed up. Important information may live on employee computers, servers, cloud platforms, accounting systems, websites, mobile devices, and specialist applications. Do not assume every cloud service keeps deleted or damaged information as long as your business needs it. Review the provider's retention periods and recovery features, and if they fall short, include a separate backup service in the budget.
Backups also need testing. A "backup successful" notification shows that a task ran. A restore test confirms the data can actually be recovered and used. The UK National Cyber Security Centre recommends regularly backing up essential information and testing that it can be restored.
Allow for growth. If your business creates more files, emails, recordings, images, or customer records each year, backup costs will rise too.
Budget for Internet and Network Equipment
Include your internet service, routers, firewalls, switches, wireless access points, cabling, and any support or security subscriptions attached to that equipment.
If losing internet access would stop the business from working, price a backup connection and compare it with the revenue, wages, and customer service time an outage would cost. Ask whether the backup uses a different type of service or a different supplier. Two connections can still depend on the same local infrastructure, so one fault could take out both.
Check whether your current connection can handle planned hiring, cloud applications, video calls, backups, and customer Wi-Fi. A service that works for ten employees may not suit the business at twenty.
Network equipment needs software updates and eventual replacement. Record the support status of every router, firewall, switch, and access point, and schedule replacement for anything that no longer receives security updates. Include installation and configuration costs, since new equipment must be secured, connected, documented, and tested before use.
Include Phones and Communication Services
Phone and communication costs may be billed separately from other IT services, but they belong in the technology budget. Include business phone systems, mobile plans, phone numbers, call recording, voicemail, video conferencing, messaging, and contact-center services.
Check whether the service charges per user, phone number, call, recording, or storage amount. International calling, premium support, and add-on features may create separate charges. Include phones and headsets for new employees. If the business records calls, budget for the storage, access controls, and retention settings that requires.
Check when contracts end and whether equipment must be returned. Changing phone providers can involve setup, number transfers, staff training, and a period when both the old and new services run at once.
Include Website, Domain, and Online Service Costs
These can include domain registration, website hosting, security certificates, website maintenance, software updates, plugins, backups, online forms, analytics, and email delivery services.
Confirm who owns the domain and the website accounts. They should be registered to the business, not to an employee, contractor, or web developer. Record domain renewal dates and turn on renewal notifications. Losing control of your domain can interrupt the website, email, and every other service connected to it.
If the website takes payments, bookings, or customer information, include the cost of keeping it secure and testing that it works.
Budget for Staff Training
Employees need training on the systems they use and the security risks they may meet. The budget may include cybersecurity awareness training, phishing simulations, training on new software, and instruction for people who handle sensitive information or approve payments.
Training should also cover what to do when someone receives a suspicious request, loses a device, sends information to the wrong person, or notices unusual activity. The Australian Cyber Security Centre's Small Business Cyber Security Guide includes employee training and awareness as part of protecting a business from email attacks.
Count the time, too. Even when the training platform is inexpensive, staff need time during the workday to use it. New systems may need extra training, so put that in the project budget instead of assuming people will learn the software on their own.
Allow for Compliance, Contracts, and Cyber Insurance
Your industry, location, customer contracts, or insurance policy may require specific technology and security controls. Costs may include security assessments, audits, policy reviews, vulnerability testing, data-retention changes, access reviews, incident-response exercises, or independent certifications.
A customer may ask you to complete a security questionnaire before signing or renewing a contract, and answering it may reveal controls you need to add. Cyber insurance applications may also ask about multifactor authentication, backups, endpoint protection, email security, employee training, and incident-response planning.
Review upcoming renewals and audits before approving the budget. That leaves time to get quotes and finish required work.
Legal and compliance requirements differ between countries and industries. Confirm your obligations with the right legal, compliance, insurance, and IT advisors.
Plan for Technology Projects
Keep planned projects separate from normal operating costs. Projects may include moving offices, opening another location, replacing a server, changing phone systems, improving Wi-Fi, moving data to a new cloud service, or introducing a new business application.
Estimate the complete cost: planning, licenses, equipment, implementation, data transfer, testing, training, temporary services, and support after launch. Some projects need two systems running side by side while information is moved and employees are trained. Budget for that overlap.
Ask department managers what changes they expect this year. A new service in one department can require extra security, storage, integration, backup, and support work elsewhere.
Business.gov.au recommends including both upfront and ongoing costs in a digital budget, so check what each project will cost after the initial work is done.
Review Supplier Contracts and Renewal Dates
For each major supplier, record the contract owner, renewal date, notice period, billing method, and cancellation process. Some services renew automatically. Others need advance notice if you want to reduce licenses or cancel.
Check whether prices can change during the contract and whether the agreement sets minimum quantities. If you expect to reduce staff or stop using a system, make sure the contract lets you reduce licenses.
Confirm how your data can be exported and what happens when the service ends. A cheaper replacement can still involve migration, setup, training, and overlap costs. Our guide on how to cancel a cloud service without losing your data walks through that process step by step.
Do not leave important technology accounts tied to one employee's personal email address or payment card. The business should keep access if that person leaves.
Keep a Reserve for Unplanned IT Costs
A laptop may be damaged, a firewall may fail, an employee may need urgent replacement equipment, or a technical problem may need work outside your support agreement.
No reserve percentage suits every business. Base the amount on realistic costs, such as replacing an essential computer, paying for emergency support, or restoring an important service. Review unplanned IT spending from previous years and use those figures to decide how much to set aside.
Keep the reserve separate from planned replacements. A computer already scheduled for replacement is not an unexpected cost.
Separate Recurring Costs From One-Time Costs
Recurring costs include software subscriptions, support agreements, internet services, phone systems, backup services, security tools, and equipment leases. One-time costs include new equipment, migrations, office moves, installation work, and major upgrades.
Record annual subscriptions separately from monthly ones so you know when larger payments are due.
You may also need to separate operating expenses from capital purchases for accounting and tax purposes. The rules vary by location, so confirm the correct treatment with your accountant.
How to Build Your Small Business IT Budget
Work through these steps in order:
Create an inventory of your hardware, software, services, suppliers, and contracts.
Record current monthly and annual costs, renewal dates, and notice periods.
Identify equipment that needs to be replaced during the budget period.
Estimate hiring, departures, new locations, and other business changes.
Add support, cybersecurity, backup, training, compliance, and recovery costs.
Create separate budgets for planned technology projects.
Add a reserve based on realistic emergency support and replacement costs.
Review the finished budget with your IT provider and accountant.
Record who approved each item and who is responsible for managing it. Review actual spending during the year instead of waiting for the next annual budget.
Use this table to check that no category is missing:
Category | What to record | How it is usually billed |
Equipment | Device, purchase date, warranty, replacement date, spares | One-time |
Software and cloud subscriptions | Service, licenses, renewal date, owner | Monthly or annual |
IT support | What the agreement covers and what is billed separately | Monthly, or per incident |
Cybersecurity | Tools, training, monitoring, incident planning | Mostly recurring |
Backup and recovery | What is protected, retention, restore tests | Recurring, grows with data |
Internet and network | Service, backup connection, equipment support status | Monthly, plus equipment |
Phones and communication | Plans, numbers, recording storage, contract end date | Monthly or per user |
Website and domains | Domain owner, renewal dates, hosting, security certificates | Annual or monthly |
Staff training | Platform cost and employee time | Annual, plus per project |
Compliance and insurance | Audits, questionnaires, insurance requirements | Annual or per audit |
Projects | Full cost including overlap and post-launch support | One-time, then recurring |
Reserve | Based on past unplanned spending | Set aside, drawn as needed |
Review the Budget During the Year
Check the budget at least every quarter. Compare actual invoices with the amounts you expected, and look for new subscriptions, unused licenses, supplier price changes, extra storage charges, and projects that cost more or less than planned.
Update the forecast when you hire, change locations, add services, or sign a contract with new security requirements.
A quarterly review also gives you time to plan for annual renewals. It is much easier to compare providers or change services when the renewal deadline is still months away.
Frequently Asked Questions
How much should a small business spend on IT? There is no reliable percentage that fits every small business. Calculate the cost of the equipment, services, security, support, and projects your business needs. Industry benchmarks can give context, but they should not replace a budget built on your operations and risks.
Should cybersecurity have a separate budget? Cybersecurity costs should be clearly identified, even when some are included in software licenses or an IT support agreement. That makes it easier to see which protections are funded and which improvements still need approval.
How often should the IT budget be reviewed? At least once a year when you prepare the budget, and every quarter during the year. Update it after major hiring, office moves, new systems, supplier changes, or new compliance requirements.
Should equipment purchases and monthly services be combined? Include both in the overall IT budget, but record them separately. That keeps recurring operating costs distinct from one-time purchases and projects.
What costs are commonly left out of an IT budget? Setup work, employee onboarding and offboarding, backup testing, staff training, security reviews, equipment disposal, project work, subscription increases, and urgent replacements.
Who should prepare the IT budget? The business owner or finance team, working with whoever is responsible for IT. Department managers should add information about hiring, new software, planned projects, and changes to operations.
Sources and Further Reading
NIST Cybersecurity Framework 2.0 for Small Business
NIST Cybersecurity Framework 2.0 Small Business Quick Start Guide
Small Organizations Guide to Cyber Security (UK National Cyber Security Centre)
Small Business Response and Recovery Guide (UK National Cyber Security Centre)
Small Business Cyber Security Guide (Australian Cyber Security Centre)
Develop Your Digital Strategy (Business.gov.au)
Where to Go From Here
Ask your IT provider to walk through this list against your current invoices and contracts. If you don't have an IT provider, reach out to Vital IT and we'll help you sort it out, no pressure.
Article used with permission from The Technology Press.
Comments