Many small and mid-sized firms set their IT budget by taking last year's spend and adding a little. That usually covers the laptops and the Microsoft 365 bill, but not the annual renewal nobody remembered, the licences still assigned to people who left, or the firewall that failed in the middle of the year. A complete budget shows what you pay for now, what will need replacing, and what you plan to change.
Why there is no standard figure
You will find benchmarks online that tie IT spending to revenue. They make poor targets. Two firms with similar revenue can run very different systems: a firm handling confidential client information needs more than a small design studio, even if the headcount is the same.
What drives the budget is how much the business depends on each system and what it holds. If an internet outage stops client work, connectivity deserves more attention. If you handle confidential client or financial data, security and compliance will cost more. Build the budget from what your business actually needs.
Start with an inventory
You cannot budget for what you cannot see. List everything the business owns or pays for:
- Computers, phones, tablets, printers and any servers
- Network equipment: routers, firewalls, switches, wireless access points
- Software and cloud services, including Microsoft 365, accounting, CRM and industry applications
- Websites, domains, backup services and phone services
For each item, note who uses it, who manages it, the supplier, the billing frequency, the renewal date and how much it would hurt if it stopped working. Check card statements and expense claims too: software bought by staff rarely appears in IT records. Expect to find duplicate tools and unused subscriptions.
What the budget should cover
Subscriptions and licences
Most of our clients run on Microsoft 365, so start there. Microsoft explains that you buy a set number of licences, assign one to each person, and can buy more as you grow or reassign them when someone leaves. Check in the Microsoft 365 admin centre that the number you pay for matches the people you have, and that your plan includes what you need, since what you get depends on the product you bought.
Do the same for every other subscription. Record whether it bills monthly or annually, whether it has a minimum number of users or a fixed term, and whether storage or usage charges rise as you grow.
Devices and their replacement cycle
Budget for the devices you expect to buy or replace this year, plus monitors, docks, headsets, warranty and the time to set each one up securely. Keep a record of each device's purchase date, warranty and support status so you can replace a planned number each year rather than several at once. We cover how to judge when a computer is due in when to replace business laptops and desktops.
Include a spare laptop if downtime is costly, and secure wiping of old devices.
Support
Whether you use a managed IT provider, in-house staff or pay as you go, be clear about what is included. A managed service agreement may cover help desk, monitoring, updates and user administration, while projects, office moves and after-hours work are often billed separately. If you pay as you go, look back at recent invoices, including emergency call-outs, not just routine work.
Security
Give security its own line, even when some of it is already included in your Microsoft 365 plan or support agreement. That might cover endpoint protection such as Microsoft Defender, email filtering, multi-factor authentication, device management, monitoring, patching and incident response planning.
NIST's Cybersecurity Framework 2.0 groups security work into six functions: govern, identify, protect, detect, respond and recover. Use them to check you are not funding only preventive tools. Check whether your client contracts or cyber insurance ask for particular controls before you finalise the budget.
Backup and recovery
Budget for the whole process, not just storage: backup software, a separate copy, monitoring and time to test restores. Do not assume Microsoft 365 or any other cloud service keeps deleted data for as long as you need; check the retention settings and add a dedicated backup if they fall short. The UK's National Cyber Security Centre advises making regular backups of essential information and regularly testing that you can restore from them.
Connectivity and phones
Include the internet service, network equipment and any support subscriptions attached to it. If losing the connection would stop work, consider a backup line from a different provider or technology. In Hong Kong office buildings, installation lead times depend on the building and the provider, so plan early. Phone systems, mobile plans, Teams calling and call recording belong in the IT budget too.
Projects
Keep projects separate from running costs. An office move, a server replacement or a new business application needs its own budget covering planning, equipment, data migration, testing, training and a period of running old and new systems side by side. Ask department heads what they plan for the year.
Training
Allow for security awareness training, training on new systems, and the staff time to complete it. Staff who approve payments or handle client data need specific guidance on how to deal with suspicious requests.
A contingency
Set aside a reserve for the unplanned: a damaged laptop, a failed firewall, or urgent work outside your support agreement. Base it on your own history of unplanned spending and what it would take to replace a critical device. Keep it separate from planned replacements; a laptop already due for renewal is not an emergency.
How to plan it
Build a renewal calendar
Put every renewal date and notice period on one calendar. Several annual renewals landing in the same month can strain cash flow, and some contracts need notice well ahead if you want to reduce licences or leave. Make sure accounts, domains and subscriptions are registered to the business, not to one employee's personal email or card.
Separate one-off from recurring costs
Record recurring costs (subscriptions, support, connectivity, backup) apart from one-off costs (new equipment, migrations, office moves). Your accountant may also need capital purchases separated from operating expenses; the treatment depends on where you are, so ask them.
Plan for joiners and leavers
Estimate how many people will join and leave during the year. A new starter needs a device, a Microsoft 365 licence, security tools and setup time. A leaver means removing access, keeping any mailboxes or files you must retain, collecting equipment and reassigning the licence.
Review it every quarter
Compare actual invoices with the plan each quarter. Look for new subscriptions, unused licences, price changes and projects running over. It also gives you time to compare options before the next big renewal.
Frequently asked questions
How much should a small business spend on IT?
There is no reliable figure that suits every firm. Add up the equipment, services, support, security and projects your business needs, based on how it works and the risks it carries.
Should cybersecurity have its own budget line?
Yes. Even if some protection is included in your Microsoft 365 plan or support agreement, a separate line makes it clear what is funded and what still needs approval.
Who should prepare the IT budget?
The owner or finance lead, working with whoever is responsible for IT. Department heads should add their hiring plans, new software and projects.
How often should we review it?
Build it once a year and review it every quarter, plus after significant hiring, an office move or a new system.
Sources and further reading
- Understand subscriptions and licenses in Microsoft 365 for business (Microsoft Learn)
- NIST Cybersecurity Framework 2.0 for small business (NIST)
- Small Business Guide: Response and Recovery, Step 1: Prepare for incidents (UK National Cyber Security Centre)
- HKCERT: security guidelines for Hong Kong businesses, including an incident response guideline for SMEs
- Cyber Security Agency of Singapore: advisories and resources for organisations in Singapore
If you would like a second opinion on next year's plan, our IT consulting team can review your inventory, renewals and priorities with you, and our managed IT services can take the day-to-day running off your hands. Talk to our team.
