Most businesses under a hundred people do not have an IT budget. They have a set of recurring charges that nobody has looked at in two years, plus whatever emergency came up last quarter. That works until it doesn't — usually at the exact moment a decision needs to be made quickly and there is no framework for making it.
This is how to put a real one together, structured so an owner can read it and a bookkeeper can maintain it.
Split the budget into four buckets
The single most useful thing you can do is stop treating IT as one number. Four buckets, because they behave completely differently and get cut differently when money is tight:
| Bucket | What is in it | Behaviour |
|---|---|---|
| Run | Licences, connectivity, support contract, hosting, phones | Predictable, recurring, scales with headcount |
| Protect | Security tooling, backup, MFA, monitoring, audits, training | Recurring; the bucket that gets cut first and shouldn't |
| Replace | Hardware refresh, end-of-life servers, appliance renewals | Lumpy but forecastable years ahead |
| Improve | New systems, automation projects, migrations | Discretionary; the only genuinely optional bucket |
Sanity-check the total per employee
Published benchmarks vary widely by industry, and any single percentage-of-revenue figure you find online should be treated as a rough orientation rather than a target. A professional services firm and a light manufacturer with the same revenue have very different needs.
The more useful internal check is cost per employee per month, tracked over time against your own history. What matters is not hitting somebody else's number but knowing yours, seeing it move, and being able to explain why.
If you are comparing quotes, normalise everything to per-user-per-month before you compare. Providers bundle differently, and a cheaper headline with per-incident charges on top is frequently the more expensive option once you model a realistic year.
Watch for this in managed IT quotes
Ask what is explicitly excluded, what an after-hours callout costs, whether project work is billed separately, and what happens to the price if headcount grows 20%. The exclusions list tells you more than the price does.
Forecast the Replace bucket three years out
This is the bucket that generates emergencies, and it is the easiest one to predict. Every device and appliance has a known useful life and, in most cases, a published end-of-support date.
Build a simple list: what you own, when you bought it, when support ends, and roughly what replacement costs. Spread those across the coming years and the surprises largely disappear.
- Workstations and laptops: typically planned on a three to five year cycle.
- Servers and network appliances: usually five years, but driven by the vendor's end-of-support date rather than by age.
- Firewalls and security appliances: watch the subscription renewal date as well as the hardware, since an out-of-subscription firewall stops receiving threat updates.
- Anything running an operating system that is approaching end of life — that is a hard deadline, not a preference.
Protect the Protect bucket
When budgets tighten, security spending gets cut first, because it is the only bucket whose return is invisible when it is working. This is a well-understood trap and it is worth naming it explicitly in the budget document so the conversation is deliberate rather than accidental.
A reasonable way to frame it: what would a week of downtime cost this business in lost revenue, staff time and client confidence? Then ask whether the annual protect budget is a sensible fraction of that. It usually is, by a wide margin, and that comparison is far more persuasive to an owner than a list of tools.
Line items people routinely forget
- Software licences bought on someone's card and never brought into procurement.
- Per-user costs for the tools you already have, when headcount grows.
- Cyber insurance premiums — and the specific controls the policy requires you to have, which are increasingly audited at claim time.
- Staff training, which is cheap relative to the class of incident it prevents.
- Offboarding and onboarding effort, which is real cost with real security consequences.
- The domain names and certificates that expire quietly and take a service down with them.
Build vs. outsource, honestly
Below roughly forty people, a full-time IT hire is usually hard to justify against a support contract — one person cannot cover holidays, illness, out-of-hours, and the full range of specialisms from networking to security. Above a hundred, an internal hire often makes sense, frequently alongside outside help for the specialist work.
In between is genuinely a judgement call, and it turns on how much bespoke internal systems work you have rather than on headcount alone. Businesses with heavy custom systems tend to want somebody in-house who holds that context; businesses running mostly standard software tend not to.
A budget review rhythm that actually happens
- 1Monthly: check actual spend against the four buckets. Ten minutes.
- 2Quarterly: review licences against headcount, and remove what nobody is using.
- 3Annually: rebuild the three-year replacement forecast and re-test the restore process.
- 4On any headcount change over 10%: revisit per-user costs before they surprise you.
Key takeaways
- Split IT spend into Run, Protect, Replace and Improve — only Improve is truly discretionary.
- Track your own cost per employee per month over time rather than chasing external benchmarks.
- Normalise every managed IT quote to per-user-per-month, and read the exclusions list first.
- Forecast hardware replacement three years out using vendor end-of-support dates.
- Frame security spend against the cost of a week of downtime, not against a tool list.
We publish our managed IT pricing openly so you can build a realistic number without sitting through a sales call.
See pricing guide