Setting an IT budget feels like guesswork for most small-business owners. Spend too little and you get outages, a security incident, and people fighting their computers; spend too much and you starve the things that actually grow the business. The good news is that technology spending is more predictable than it looks: it follows a few rules of thumb tied to revenue, headcount, and how much your business depends on being up. This guide gives you those benchmarks, a category-by-category breakdown, and a worked example for a 25-person Tulsa firm.
Who this guide is for
Owners, presidents, CFOs, and office managers of businesses with roughly 10 to 100 people who are building an IT budget for the first time, sanity-checking the one they have, or trying to explain to a partner why the number is what it is. It assumes no IT background.
How much should a small business spend on IT?
The most useful rule of thumb is a percentage of annual revenue. Across industry surveys, small and mid-sized businesses typically spend somewhere between 2% and 6% of revenue on technology, and the number rises with how dependent the business is on its systems:
| How dependent you are on technology | Typical IT spend | Examples |
|---|---|---|
| Light — technology is a tool, not the product | 2–3% of revenue | Retail, trades with a small office, hospitality |
| Moderate — the business stops when systems stop | 3–5% of revenue | Professional services, engineering and architecture, manufacturing, contractors |
| Heavy — regulated data or technology-driven work | 5–8% of revenue | CPA and financial firms, medical and dental practices, firms with compliance obligations |
The second check is per person. Add up what a well-run 10-to-100 person business spends on support, security, licensing, and hardware and you land in the neighborhood of $2,500 to $5,000 per person per year — lower for a light-dependency business with a simple stack, higher for a regulated one. If your revenue-based number and your per-person number are wildly different, one of your assumptions is off, and that is worth a conversation.
Two things these benchmarks do not include: a one-off project like an office move, a server replacement, or a phone-system migration (budget those separately), and the cost of your own people’s time when technology doesn’t work — which is real, but belongs in the “why” column rather than the budget line.
What goes in a small-business IT budget?
Seven categories cover almost everything. The ranges are typical for a Tulsa business of 10 to 100 people in 2026; the per-person figures are monthly unless noted.
| Category | What it covers | Typical range |
|---|---|---|
| Support and management | Help desk, monitoring and patching, Microsoft 365 administration, planning reviews — usually a managed IT agreement, or an internal hire plus co-managed support | $100–$175 per person for fully managed IT that includes the security layer; less for essential or co-managed plans |
| Security | Multi-factor authentication, endpoint detection and response, email and DNS filtering, awareness training, security monitoring | Included in a security-first managed plan; $20–$50 per person if bought separately |
| Backup and disaster recovery | Microsoft 365 backup, server backup, off-site copies, restore testing, a written recovery plan | M365 backup often included in managed plans; server backup and DR are usually line items — $100–$400 per server per month |
| Software and licensing | Microsoft 365, accounting, CRM, line-of-business and industry software, e-signature, password manager | Microsoft 365 business plans list at roughly $6–$22 per person; line-of-business software varies enormously and is often the largest single line |
| Hardware | Laptops and desktops on a 3–5 year cycle, monitors, docks, network gear on a 5–6 year cycle, servers if you still have them | A $1,000–$1,800 laptop every four years is $250–$450 per person per year; network refresh $3,000–$10,000 every five to six years for a small office |
| Connectivity and phones | Business internet (and a backup circuit if downtime matters), VoIP phone system | Internet $100–$500 per month per site; VoIP $20–$35 per user |
| Compliance and insurance | Cyber-insurance premium, risk assessments, HIPAA / FTC Safeguards / PCI work if it applies to you | Varies with industry and revenue; regulated practices should expect a meaningful line here |
Then add a contingency of 10–15% for the things you can’t predict — a failed switch, a new hire mid-year, a vendor price increase — and a separate project line for anything you already know is coming (Windows or server end-of-life, a phone system, a move).
A worked example: a 25-person professional services firm in Tulsa
Say the firm bills $3.5 million a year and depends on email, shared files, and two line-of-business applications every day. The revenue rule of thumb (3–5%) says $105,000 to $175,000. Here is what a realistic year looks like:
- Managed IT with security included: 25 × $138 × 12 ≈ $41,400 (mid-range; see the 2026 cost guide for the bands)
- Server backup and DR for one server: about $3,000
- Microsoft 365 (Business Standard/Premium mix): about $5,000
- Line-of-business software (practice management, accounting, e-signature, password manager): $15,000–$30,000 — this is the line that varies most
- Hardware (six laptops replaced this year plus docks and monitors): about $10,000
- Internet and phones: about $12,000
- Cyber-insurance premium: $2,500–$6,000
- Contingency (12%): about $10,000
That lands between roughly $100,000 and $120,000 — inside the 3–5% band and around $4,000–$4,800 per person. If this firm were a CPA practice with client tax data, add a stronger security tier and compliance work and it drifts toward the top of the range; if it were a small trade shop with five office staff, it drops well below.
Reactive vs proactive: the budget you don’t see
The most common small-business IT budget is not a budget at all — it is “we pay someone when something breaks.” That looks cheap in a quiet year and is very expensive in a bad one: emergency hourly rates, rushed hardware, lost billable hours, and, in the worst case, a ransomware recovery that costs more than several years of managed IT. The managed IT vs break-fix comparison goes through this in detail. For budgeting purposes the point is simple: a flat monthly agreement turns your largest unpredictable IT cost into a fixed line, which is what makes the rest of this exercise possible.
Hidden costs that quietly break the budget
- Aging hardware. A five-year-old laptop is slow, out of warranty, and eventually out of security updates. The cost shows up as your people’s time and as a security exposure long before it shows up as a purchase.
- Subscriptions nobody owns. Tools bought by individuals on a company card, duplicate storage services, licenses for people who left. An annual audit of every recurring charge usually pays for itself.
- Unplanned end-of-life. Operating systems, servers, and line-of-business versions all have dates. If they are not on a calendar, they become emergencies.
- The “free” internal IT person. The office manager or the owner’s nephew who “does the computers” is a real cost in salary and in everything they are not doing — and a single point of failure.
- Downtime. Whatever your revenue per day is, that is the price of a day-long outage before you count the overtime to catch up.
How to build the budget: four steps
- Inventory what you spend today. Every recurring technology charge, every device with its age, every contract with its renewal date. Most businesses are surprised by this list.
- Set the baseline. Apply the revenue percentage for your dependency level, then check it against the per-person range. Decide which end of the range you belong at and why.
- Allocate by category and add the two extra lines. Use the seven categories above, a 10–15% contingency, and a project line for anything already on the calendar.
- Review quarterly. Compare actual to plan with whoever manages your IT — a good provider brings this to the planning review — and move the hardware and project lines forward a year each time. An IT budget is a rolling three-year plan with the first year in detail.
Common mistakes
- Budgeting the invoice, not the outcome. The comparison that matters is not this year’s cost against last year’s; it is what a bad week costs against what prevention costs.
- Leaving security to “whatever comes with it.” Cyber-insurance applications now ask specific questions — MFA, EDR, tested backups. Budget for the controls, not just the premium.
- Treating hardware as a surprise. A quarter of your devices reach end of life every year on a four-year cycle. Put it on the calendar.
- Cutting the planning line. The scheduled review with someone senior is where the budget stays honest. Skip it and the contingency becomes the budget.
- Assuming Tulsa is cheaper. Real estate and labor cost less here than on the coasts, but software, hardware, and cloud services are priced nationally. Use national benchmarks; use a local provider for the service.
Where NSN Management fits
NSN Management has helped Tulsa-area businesses plan and run their technology since 2012. Our fully managed plan turns support, monitoring, Microsoft 365 administration, the security layer, and virtual CIO planning into one predictable per-person line — $100–$175 per person per month for most clients — and the quarterly planning review is where we build the rest of this budget with you: hardware cycles, renewals, projects, and what to expect next year. If you would like a second opinion on your IT budget, book a Discovery Call; we will look at what you spend today and tell you plainly where it is high, where it is thin, and what we would change.
Questions Tulsa businesses ask about this
What percentage of revenue should a small business spend on IT?
Most small and mid-sized businesses land between 2% and 6% of annual revenue: about 2–3% when technology is a tool rather than the product, 3–5% when the business stops working if systems stop, and 5–8% for regulated or technology-driven firms such as CPA practices, financial advisers, and medical or dental offices. Cross-check the result against a per-person figure of roughly $2,500–$5,000 per year.
What is an average IT budget per employee?
For a well-run business of 10 to 100 people, roughly $2,500 to $5,000 per person per year covers support and management, security, licensing, and hardware on a normal replacement cycle. Fully managed IT that includes the security layer is the largest recurring piece at $100–$175 per person per month; line-of-business software is the line that varies most between industries.
Should managed IT be in the IT budget or a separate line?
In the IT budget, as the support-and-management category — it usually absorbs help desk, monitoring and patching, Microsoft 365 administration, the security stack, and planning into one predictable per-person number, which is what makes the rest of the budget plannable. Hardware, line-of-business licenses, connectivity, and projects stay as their own lines.
How much should a 10-person business budget for IT?
Apply the same benchmarks: a 10-person professional services firm billing $1.5 million would target roughly $45,000–$75,000 a year (3–5%), or about $3,000–$5,000 per person — a managed IT plan, Microsoft 365, its industry software, two or three laptop replacements, internet and phones, insurance, and a contingency. Very small businesses with a simple stack sit at the low end or below it.
How often should an IT budget be reviewed?
Quarterly against actual spend, ideally in the planning review with whoever manages your IT, and rebuilt annually as a rolling three-year plan with the first year in detail. Hardware cycles, license renewals, and known end-of-life dates should be on the calendar so they never arrive as emergencies.
Are technology costs lower in Tulsa?
Not meaningfully. Software, hardware, and cloud services are priced nationally; what Tulsa offers is a lower cost of doing business generally and local providers whose service is competitively priced. Use national benchmarks for the budget and a local provider for the delivery.