How to Plan an IT Budget for Businesses Under 20 Employees

Ask most owners of a company under 20 employees what their IT budget covers, and the answer is a laptop replacement list. Bookkeeping asks “how many machines do we swap this year” and the planning stops there. Hardware is usually only about a fifth of what a company actually spends on IT. The rest is spread quietly across licensing, security, backup, and support — and because none of it gets budgeted, it shows up at month-end as “unexpected cost.”

An IT budget is a set of line items, not a shopping list

A small company’s annual IT spend breaks into seven categories, even if none of them show up on one invoice:

• Hardware depreciation: computers, servers, network gear — replaced every 3-5 years
• Software and licensing: operating system, office suite, accounting/ERP software
• Security: antivirus/EDR, firewall, email filtering
• Backup and disaster recovery: cloud backup, immutable storage
• Support and maintenance contract: helpdesk, remote monitoring, on-site visits
• Infrastructure: internet line, VPN, cloud hosting
• Training: employee security awareness, data protection training

An owner can’t answer “how much do we spend on IT” until they see these seven categories separately. The number usually quoted is the hardware invoice total; the real figure can be two to three times that.

How much should a company under 20 users set aside?

International IT budget benchmarks put businesses under 50 employees at roughly 6-7% of revenue on IT, while larger organizations run closer to 3-4% because of economies of scale. A small company has no scale advantage, so the ratio runs relatively higher.

Business profile	Suggested IT share (revenue)	Notes
5-10 users, office work	5-7%	Cloud-heavy, minimal hardware
10-20 users, mixed	5-8%	Closer to the top if running a server/ERP
Regulated (health, finance, legal)	8-12%	Compliance cost adds on top
Manufacturing (OT-IT mixed)	4-6%	Hardware-heavy, software-light

Per employee, the sector average lands around $1,000-$3,500 a year, with 20-40% of that going directly to security. Currency and supply costs shift the absolute number in any given market, but the ratio logic holds: treating security as the line item to cut when the budget is tight makes the rest of the budget pointless.

A concrete example: a trading company with 15 users and roughly 20 million TL in annual revenue, a size most Turkish SMEs would recognize as mid-sized. A 6% share works out to 1.2 million TL. About a third of that goes to the maintenance contract, a quarter to licensing, and the rest to security, backup, and hardware depreciation. A company that complains “IT costs too much” without running this breakdown usually doesn’t know what it’s comparing against.

Separate the fixed costs from the variable ones

The most common budgeting mistake is lumping everything into one “IT expense” line. Two categories behave differently:

Fixed costs — the same every month or year: the flat fee on a maintenance contract, license renewals, the internet line. These are predictable and can be written into the budget ahead of time.

Variable costs — event-driven: hardware failure, capacity upgrades, equipment for a new hire, incident response after a security event. Set aside roughly 15-20% of the annual budget as a contingency for these. Skip it, and a single server failure comes straight out of that month’s margin.

We covered maintenance contract pricing models in more detail separately; whether it’s billed per user or per device changes this fixed-cost math directly.

In-house or outsourced: where does the budget actually go?

A company under 20 employees that hires one full-time IT person carries salary, payroll tax, and leave coverage on top of the base wage — and still needs outside help for anything that one person doesn’t specialize in, security or cloud architecture being the usual gaps. Nobody covers every domain alone. A managed IT service turns the same need into a fixed monthly fee tied to a predictable SLA, backed by a team rather than one individual.

The right question isn’t “which is cheaper” but “which is actually budgetable.” In a single-person in-house model, the budget stops being predictable the moment that person takes leave or resigns; in an outsourced model, continuity is written into the contract.

The model we see most often in the field is a mix of both. A 15-20 user company often keeps a part-time in-house resource for daily tasks — password resets, printer setup, mailbox provisioning — and hands server, security, and backup work to a managed provider. That split clarifies the budget too: in-house cost sits on payroll, outsourced cost sits on one monthly invoice.

Frequently asked questions

Who should build the IT budget — bookkeeping or the IT provider? Both, together. Bookkeeping knows revenue and cash flow; the IT provider knows what needs renewing and when. A budget built by bookkeeping alone usually misses hardware depreciation; one built by the provider alone can miss what the company can actually afford.

Where can a small business cut its security budget? Nowhere — but it can prioritize. Email security and backup should stay at the top even under a tight budget; without them, a single ransomware incident consumes the entire year’s IT spend at once.

Should the budget stay the same every year? No. Headcount, cloud usage, and compliance load all shift the ratio over time. An annual review folded into the maintenance contract renewal doesn’t add a separate meeting to the calendar.

Let’s build your IT budget line by line together — get in touch to work out the share that actually fits your business.