Small Business IT Budget: What to Include & How to Plan It | Team Metalogic

Most small business IT budgets are missing something

If your IT budget covers a few laptops, Microsoft 365 and the occasional repair, it is almost certainly incomplete. Most of the businesses we work with across Caerphilly, Cardiff and South Wales are also paying for cloud storage, backups, security tools, broadband, phone systems, a website, network kit, staff training and outside IT support.

Some of those costs land every month. Others arrive once a year, or only when something breaks. Without a complete picture, an annual renewal or a failed server becomes a bill nobody planned for.

Here at Team Metalogic we have been helping small and medium-sized businesses plan and manage their IT since 2003. This guide walks through what a proper IT budget should include, what usually gets left out, and how to build one you can actually use.

There is no “standard” small business IT budget

You will see benchmarks online suggesting a fixed percentage of turnover for technology. In our experience those figures bear little relation to what a real business needs.

A ten-person solicitors’ firm, a retailer and a manufacturer can have similar revenue and completely different IT. Headcount, number of sites, devices, cloud services, security obligations and client contracts all shape the number.

A better starting point is dependency. If losing broadband would stop you taking payments, connectivity deserves more budget than it would for a business that can work offline for a day. If your team handles financial or health data, expect security and compliance to cost more.

Cost the systems your business actually relies on first. Use benchmarks for context afterwards, not as the target.

Start With a Complete Technology Inventory

You cannot budget for what you do not know you own. Whenever Team Metalogic takes on a new client, the first thing we do is build an inventory, and we recommend every business does the same.

List every computer, phone, tablet, printer, server, network device, software subscription, cloud service, website, domain, backup system and phone line. For each one record who uses it, what it costs, when it renews, who manages it and how important it is.

The NIST Cybersecurity Framework 2.0 Small Business Quick Start Guide recommends exactly this kind of inventory, including a note of what would happen to the business if each asset became unavailable.

Check invoices, company cards and bank statements, not just the IT folder. Software bought directly by a member of staff rarely appears in the main records. Most inventories we build turn up duplicate services, licences still assigned to people who left, and kit that stopped receiving security updates years ago.

Hardware: devices, replacements and the costs around them

A new laptop is the easy line on the budget. The costs around it are the ones that get missed: monitor, dock, headset, carry case, extended warranty, delivery, and the time to set it up, secure it, create accounts and move the user’s data across.

Do not stop at computers. Mobile phones, printers, card terminals, CCTV, Wi-Fi access points, switches, firewalls and UPS units all age out and all need replacing eventually.

Record each device’s purchase date, warranty end, operating system and planned replacement year. Replacing a fixed number of devices each year is far easier to budget for than discovering a third of the office is unreliable at once. As a Dell partner, Team Metalogic can help you plan a rolling refresh cycle rather than a painful one-off spend.

Two extras worth a line of their own: a spare laptop ready to go when one fails, and secure data wiping before old kit is sold, recycled or returned.

Software, cloud and Microsoft 365 subscriptions

List every subscription: Microsoft 365, accounting, CRM, industry-specific apps, e-signature, password manager, security software, backup, cloud storage, device management, web hosting and domain registration.

Note whether each one is billed monthly or annually. Three annual renewals landing in the same month can hurt cash flow even when the monthly equivalent looked fine. Record renewal dates, the current licence count, and whether the contract has a minimum term or minimum users.

Then tidy up. Remove licences for former staff, unused accounts and duplicated tools. Microsoft 365 is the most common place we find waste: the wrong plan, too many seats, or add-ons nobody uses. A Microsoft 365 licensing review is something we do as standard for our managed clients and it regularly pays for itself. (see our Cloud Computing services).

Finally, allow for growth. A new starter needs more than an email licence, and some cloud services charge more as you store more data, add locations or switch on advanced features.

People: starters, leavers and training

Every new starter is an IT cost: a device, accessories, licences, security tools, accounts, a phone number and the setup work to pull it all together. Every leaver is one too: access removed, data transferred, kit collected, licences cancelled or reassigned, and sometimes a mailbox retained for legal or compliance reasons.

Contractors and temps count as well. Even on their own laptops they still need accounts, secure access and support.

Estimate the number of starters and leavers you expect in the year and budget for both the technology and the work. For Team Metalogic managed clients, onboarding and offboarding is covered in the monthly agreement, so this line is predictable rather than a surprise.

Training belongs here too. Budget for cyber awareness training, phishing simulations, training on new software, and the working hours staff need to complete it. The NCSC Small Business Guide lists staff awareness as one of the core defences against email-based attacks, and in our experience it is the cheapest security control with the biggest effect.

Decide how you will pay for IT support

You have three broad options: a managed IT provider, in-house staff, or paying for help when something breaks. Many businesses combine them.

With managed IT support, confirm exactly what the monthly fee covers. At Team Metalogic that means help desk, proactive monitoring, patching, device management, user administration, security tooling and vendor liaison (see our Managed IT services).

Ask any provider which items sit outside the agreement, such as projects, office moves, out-of-hours work or specialist applications, so there are no surprises.

If you pay as you go, look back at two or three years of invoices and include the emergency call-outs, not just routine jobs. That is usually where the real cost hides.

In-house IT means salary, benefits, recruitment, training, certifications and holiday cover. A single IT person will still need outside help for larger projects or serious incidents, so budget for that as well.

Cyber security, backup and recovery

Security spending should be visible as its own line, even when some of it is bundled into Microsoft 365 or your support agreement. Otherwise nobody can see which protections are funded and which still need sign-off.

Typical items include endpoint protection (we use SentinelOne across our client base), email filtering, multi-factor authentication, password management, device management, security monitoring, vulnerability scanning, staff training and an incident response plan. Not every business needs every product. Ask your IT provider which controls are recommended for your risk, what each one protects against, and whether it is already covered elsewhere.

The NIST Cybersecurity Framework 2.0 splits security into six functions: govern, identify, protect, detect, respond and recover. Use that list to check your budget covers more than antivirus.

Backup needs the same treatment. Budget for the whole process, not just storage: backup software, cloud copies, an isolated copy, monitoring, restore testing and professional help if you ever need to recover. Do not assume Microsoft 365 keeps deleted data for as long as you need; check the retention settings and add a separate backup service if they fall short.

A backup is only as good as the restore. The NCSC’s response and recovery guidance recommends backing up essential data regularly and testing that it can actually be restored. We schedule restore tests for our managed clients for exactly that reason.

Connectivity, networking and phones

Include broadband, routers, firewalls, switches, Wi-Fi access points, cabling and any support or security subscriptions attached to them.

If losing internet would stop you working, price a backup connection and compare it with a day’s lost revenue and wages. Make sure the backup uses a different technology or carrier; two lines into the same street cabinet can fail together.

Network kit needs firmware updates and eventual replacement. Anything that no longer receives security patches should be on the replacement list. Team Metalogic designs and installs business networks and Wi-Fi across South Wales, and we always include configuration, documentation and testing in the project cost, because new equipment is not ready the moment it arrives (see Networks & Infrastructure).

Phones belong in the IT budget too, even when they are billed separately. Cover your VoIP system, mobiles, numbers, call recording, video conferencing and handsets for new starters. Check contract end dates, whether equipment must be returned, and whether charges are per user, per number or per feature. If you are switching providers, allow for number porting and a short overlap between old and new.

Compliance, Cyber Essentials and cyber insurance

Your industry, client contracts or insurer may require specific controls, and meeting them costs money. Common items are Cyber Essentials or Cyber Essentials Plus certification, security assessments, policy reviews, penetration testing, access reviews and UK GDPR data-retention work.

Two things tend to trigger unplanned spend. The first is a security questionnaire from a larger customer before they sign or renew a contract. The second is a cyber insurance application asking about MFA, backups, endpoint protection, email security and staff training. Both regularly reveal gaps that need fixing to a deadline.

Check upcoming contract renewals, audits and insurance renewals before you sign off the budget, so there is time to get quotes and do the work. If Cyber Essentials is on the list, Team Metalogic can take you through the assessment and the remediation. We hold Cyber Essentials Plus ourselves, so we know the process from both sides (see Cyber Security and Governance, Risk & Compliance).

Requirements vary by sector, so confirm your obligations with your legal, compliance and insurance advisers as well as your IT provider.

Projects, supplier contracts and a reserve

Keep projects separate from running costs. An office move, a new site, replacing a server, a new phone system, a Wi-Fi upgrade, a cloud migration or a new line-of-business application all deserve their own budget line. Cost the whole thing: planning, licences, hardware, implementation, data migration, testing, training, any overlap period where two systems run at once, and support after go-live. Ask department heads what they are planning, because a tool one team buys often creates security, storage and integration work for everyone else.

Know your supplier contracts. For each major supplier record the renewal date, notice period, billing method and cancellation process. Check whether prices can rise mid-term, whether you can reduce licences if headcount falls, and how you would get your data out. Make sure no critical account is tied to one employee’s personal email or payment card.

Hold a reserve for the unexpected. A damaged laptop, a failed firewall or an urgent fix outside the support agreement will happen at some point. There is no magic percentage; base the reserve on realistic figures such as replacing an essential machine or an emergency call-out, and on what you actually spent on surprises in previous years. Keep it separate from planned replacements.

How to build your small business IT budget: a 10-step checklist

Then review it quarterly, not annually. Compare invoices against the plan, look for new subscriptions, unused licences, price rises and projects running over, and update the forecast whenever you hire, move or sign a contract with new security requirements. A quarterly check also gives you months, not days, to compare providers before a big renewal.

Team Metalogic clients get this review as part of their regular account meetings, so the budget stays current rather than being rebuilt from scratch each year.

Frequently Asked Questions

Need help planning your IT budget?

Team Metalogic has provided managed IT support to small and medium-sized businesses across Cardiff, Newport, Swansea, Bristol and the wider UK since 2003. We translate the tech-speak into plain English, build the inventory, plan the replacements and make sure nothing on this list gets missed. If you would like a second pair of eyes on next year’s IT budget, get in touch or call 0345 521 0618.

Sources and further reading

• NIST Cybersecurity Framework 2.0 for Small Business
• NIST Cybersecurity Framework 2.0 Small Business Quick Start Guide
• Small Organisations Guide to Cyber Security: UK National Cyber Security Centre
• Small Business Response and Recovery Guide: UK National Cyber Security Centre

Article adapted with permission from The Technology Press.