Your IT budget is missing lines. Here’s which ones.

An IT budget that lists laptops, Microsoft 365 or Google Workspace, and “repairs” isn’t a budget. It’s a partial inventory of the easy-to-remember costs, and it’s why an annual renewal or a dead firewall keeps showing up as a surprise. Your business is almost certainly also paying for cloud storage, backup tools, security software, internet, phones, a website, network gear, and some amount of outside help. A budget’s job is to make all of it visible before it’s due.

Ignore the percentage-of-revenue benchmarks

A ten-person law firm, a retailer, and a machine shop can post similar revenue and have wildly different technology needs. What drives the number is dependence: if losing internet stops you from taking payments, connectivity deserves real money; if you hold client financial or health data, security and compliance cost more. Price the systems your business actually depends on first. Let benchmarks be trivia, not targets.

Start with an inventory, because you can’t budget what you can’t see

List every computer, phone, printer, server, network device, software subscription, cloud service, domain, and phone line, with its cost, renewal date, owner, and how badly its loss would hurt. NIST’s small-business guidance makes asset inventory the starting point for a reason. Then audit the places costs hide: company cards, department expenses, app-store receipts. Most first-pass inventories turn up duplicate services, licenses still assigned to people who left, and gear that quietly aged out of security updates. That cleanup alone frequently pays for the effort.

Hardware: the device is the down payment

A new laptop’s real cost includes the monitor, dock, headset, warranty, and, the part everyone forgets, the setup labor: software, security baseline, accounts, data transfer, testing. Track each device’s purchase date and planned replacement year so refreshes spread across budget cycles instead of arriving as one ugly quarter. Budget for a configured spare or two, and for proper disposal. Data has to be verifiably destroyed before hardware is sold or recycled.

Subscriptions: watch the renewal calendar, not just the monthly total

List every subscription with its billing cadence. Three annual renewals landing in the same month can bruise cash flow even when the monthly math looked fine. Prune licenses for departed employees, check minimum-seat commitments, and note which services charge more as data or usage grows. Then budget for hiring: a new employee isn’t one license. It’s email, security tooling, backup, device management, possibly a phone number and specialist apps. Offboarding costs too: access removal, data handover, license reassignment, and any email you’re obliged to preserve.

Support, security, and backups each get their own line

Support: whether you use a managed provider, internal staff, or hourly help, know exactly what the monthly agreement covers and what bills separately. Projects, office moves, after-hours work, and specialist apps commonly sit outside the base scope. If you pay as you go, pull two or three years of invoices including the emergencies, not just the maintenance.

Security: identify cybersecurity spending explicitly even when it’s bundled into other agreements: endpoint protection, email filtering, MFA, monitoring, training, incident planning. Visibility is the point. You can’t decide whether a control is funded if it’s smeared invisibly across three invoices. Not every business needs every product; it needs to know what it has and what it’s deliberately skipping.

Backups: budget the whole discipline: software, storage, isolated copies, monitoring, and restore testing. A “backup succeeded” email proves a job ran; only a restore test proves you can recover. And don’t assume your cloud services retain deleted data as long as you need; check, and add a separate backup service where they don’t. Storage grows every year, so should this line.

The lines almost everyone forgets

• Network and internet. Routers, firewalls, switches, access points, plus their updates and eventual replacement. If an outage stops revenue, price a backup connection and make sure it doesn’t ride the same local infrastructure as the primary.
• Phones and communications. Per-user charges, recording storage, contract end dates, and the migration overlap when you switch providers.
• Website and domains. Hosting, certificates, maintenance, and ownership. Domains and web accounts should be registered to the business, never to a departed developer’s personal email.
• Training. Security awareness, phishing simulations, and, the hidden cost, the paid hours employees spend taking it.
• Compliance and insurance. Customer security questionnaires and cyber-insurance applications both have a habit of revealing controls you don’t have yet. Around here that’s especially true: San Diego’s defense, biotech, and healthcare supply chains pass security requirements downstream to vendors of every size. Look at upcoming renewals and audits before you finalize the budget, while there’s still time to get quotes.

Projects and the reserve: keep both separate

Office moves, server replacements, new business applications: these are projects, budgeted apart from operations, and costed completely. Planning, licenses, implementation, data migration, training, and the overlap period when two systems run at once. Ask department heads what they’re planning; the tool one team adopts in March becomes IT’s integration and backup problem by June.

Separately, hold a reserve for genuine surprises: the cracked laptop, the failed firewall, the incident that needs outside help. Size it from your own history of unplanned spending, not a rule of thumb. A computer already scheduled for replacement doesn’t count as a surprise.

Then actually look at it during the year

Review quarterly: invoices against forecast, new subscriptions nobody approved, price creep, licenses to reclaim. Update the forecast when you hire, move, or sign a contract with new security strings attached. A quarterly look also means you see annual renewals coming months out, which is when you still have the leverage to renegotiate or switch. A budget you only open in December is a scorecard. One you open quarterly is a steering wheel.