The IT Costs That Never Make It Into the Budget

Most small business IT budgets get built from last year’s invoices. That captures the recurring bills and misses almost everything else.

Buying a laptop is easy to forecast. Setting it up is not. Neither is its license, security software, backup, support, accessories, or the replacement three years out.

Ignore the percentage-of-revenue benchmarks

Plenty of advice suggests a fixed share of revenue. It rarely survives contact with a real business.

A ten-person law firm, a retailer, and a small manufacturer can post similar revenue on entirely different systems. Headcount, locations, devices, cloud services, and security obligations drive the number. Revenue does not.

Price the systems you need first. Benchmarks can provide context afterward.

Everything starts with the inventory

You cannot budget for what you do not know you own.

Build a list. Hardware first, then the intangibles: licenses, subscriptions, domains, hosting, backup, telephony. Against each, record the user, cost, renewal date, supplier, contract term, and how badly losing it would hurt.

NIST’s Cybersecurity Framework 2.0 Small Business Quick Start Guide asks for the same, including a note on business impact when a key asset goes unavailable.

Check beyond the IT records. Invoices, company cards, bank statements, app stores, departmental expenses. Software an employee signed up for directly appears nowhere else.

The categories people forget

Hardware is the visible line item. These are the ones that get missed.

• Setup work. Installing software, applying security settings, creating accounts, moving data, testing access. Every new machine needs it.
• Accessories and coverage. Monitors, docks, keyboards, headsets, cases, warranty, delivery.
• Spare equipment. A prepared spare laptop turns a failure into an inconvenience.
• Disposal. Data has to come off properly before anything is sold, recycled, or returned.
• Onboarding and offboarding. A new hire needs more than an email license, and every departure needs access removal, data transfer, equipment collection, and license reassignment.
• Storage and usage growth. Plenty of cloud services charge more as you store more or add locations.

Software renewals need dates, not just totals

List every subscription: productivity and email, accounting, CRM, industry-specific tools, e-signature, password management, security, backup, storage, device management, hosting.

Then record whether each bills monthly or annually, and when it renews. Several annual renewals landing in one month is a cash flow problem even when the monthly average looks fine.

Check seat counts against actual staff, and confirm whether minimums apply before planning any reduction.

Be explicit about security and backup

Cybersecurity spending should be visible even when bundled into licenses or your support agreement: endpoint protection, email filtering, MFA, password and device management, monitoring, patching, training, incident-response planning.

NIST’s framework runs from govern and identify through to respond and recover. Use those areas to check whether your budget reaches past preventive software into detection and recovery.

Backup deserves its own line, and it is more than storage. Budget the software and the capacity, an isolated copy, someone watching the jobs, restore testing, and paid help on the day you actually recover.

A successful backup notification means a job ran. A restore test means the data comes back usable. The UK NCSC’s advice pairs the two deliberately: keep copies of what matters, then prove you can bring them back.

Do not assume cloud services retain deleted data as long as you need. Check the retention periods, and budget a separate backup service where they fall short.

The rest of the list

Internet and network. The circuit, routers, firewalls, switches, access points, cabling. If an outage halts trading, price a backup connection against what a day costs you, and check whether both circuits run over the same local infrastructure. Network gear ages out of security support too.

Phones. Systems, mobile plans, numbers, recording, conferencing, billed per user, number, call, or gigabyte.

Website and domains. Registration, hosting, certificates, maintenance, plugins, backups. Confirm the domain is registered to the business rather than a developer or former employee, because losing it takes your email with it.

Training. Security awareness, phishing simulations, and the staff hours to sit through it.

Compliance and insurance. Assessments, audits, access reviews. Cyber insurance applications increasingly ask about MFA, backups, and training, and honest answers surface work you have not funded.

Projects, kept separate from operations. Office moves, server replacement, migrations. Include planning, implementation, data transfer, testing, training, and the parallel-running period.

A reserve. Base it on real numbers, like one essential machine plus emergency support, kept apart from planned replacements.

You are probably already paying for things you do not use

That is what the inventory turns up first. MVP Network Consulting builds IT budgets with businesses across Buffalo and Western New York, starting with a full inventory of what you own, what renews when, and what nobody has logged into for a year. The savings often cover a good share of what you should be spending elsewhere. Ask us to run the inventory.