What should your small business IT budget include?

Start with your needs, not a benchmark

Benchmarks often suggest spending a set percentage of turnover on IT, but two businesses with similar turnover can have completely different systems. Work out what you need first, based on how much you depend on each system and how sensitive your data is, then use benchmarks for context only. Begin with a full inventory of your devices, software, cloud services, network equipment, websites, domains and phone services. For each item, record the cost, renewal date, supplier, contract term and account owner. Check invoices, company cards and department expenses for software bought outside IT. You'll often find duplicate services, unused subscriptions or licences still assigned to former staff.

IT Support

Whether you use a managed provider, in-house staff or pay-as-you-go support, know exactly what's covered. Projects, out-of-hours work and office moves often sit outside managed agreements. If you pay as you go, look at the last few years of invoices, emergency work included. In-house staff may still need outside help with specialist projects or serious incidents.

Cybersecurity, Backups and Compliance

Identify security spending clearly, even where some of it comes bundled with other services. This might cover endpoint protection, email filtering, multi-factor authentication, monitoring, updates, staff training and incident-response planning. NIST CSF 2.0's six areas (govern, identify, protect, detect, respond and recover) are a useful check that you're covering more than prevention.

Budget for the whole backup process, not just storage, and don't assume cloud services keep deleted data as long as you need. The UK National Cyber Security Centre recommends regularly testing that backups can be restored. Contracts, customer security questionnaires and cyber insurance may also require specific controls, assessments or certifications such as Cyber Essentials. Review upcoming renewals and audits before you approve the budget.

Connectivity, phones and online services

Where possible, use mobile device management (MDM) or mobile application management (MAM) to separate business information from personal data. Depending on the system, this can allow you to:

• Internet and network: If an outage would stop the business, consider a backup connection from a different supplier. Replace equipment that no longer gets security updates.
• Phones: Include phone systems, mobile plans, numbers, call recording and video conferencing. If you're switching provider, allow for number porting and a period of overlap.
• Website and domains: Make sure domains are registered to the business, not to an individual, and set renewal reminders. Losing a domain can take down both your website and your email.

How to Build Your IT Budget

• Inventory your hardware, software, suppliers and contracts.
• Record costs, renewal dates and notice periods.
• Identify equipment due for replacement and expected staff changes.
• Add support, security, backup, training and compliance costs.
• Budget separately for projects and a realistic reserve.
• Review the budget with your IT provider and accountant, then check it quarterly against actual spending.

Employees should understand and accept the policy before accessing company systems.

Frequently Asked Questions