How to Build an IT Budget That Actually Covers Everything

Most small business IT budgets start with computers, Microsoft 365, and a vague line for repairs. That gets you through the obvious stuff, but it leaves out a surprising amount - software renewals, security tools, onboarding costs, backup testing, and the occasional emergency that arrives without warning. When those gaps show up, they tend to arrive as unplanned expenses the business hasn't prepared for.

Building a complete IT budget isn't complicated, but it does require going through the business systematically rather than working from memory. Here's how to do it.

Start with a full technology inventory

You can't budget for something you've forgotten you're paying for. Before any numbers go into a spreadsheet, pull together a complete list of everything the business owns and subscribes to: computers, phones, tablets, printers, servers, network equipment, software, cloud services, websites, domain names, backup systems, and phone services.

For each item, record who uses it, what it costs, when it renews, who manages it, and how important it is to the business. Check invoices, company credit cards, bank statements, and app store accounts. Software purchased directly by a staff member may not appear in the main IT records at all.

This inventory will often surface things worth acting on straight away - licenses assigned to people who have left, subscriptions nobody uses, equipment that stopped receiving security updates, or duplicate services doing the same job. It also gives you the foundation everything else in the budget is built on.

Computers and physical equipment

The device itself is rarely the full cost. A new laptop also means a monitor, docking station, keyboard, headset, webcam, carry case, and warranty coverage. Before anyone can use it, an engineer needs to install software, apply security settings, create user accounts, transfer data, connect printers, and test access to business systems. That setup work takes time and costs money whether you're paying for it through a support agreement or separately.

Other equipment to account for includes mobile phones, printers, scanners, payment terminals, wireless access points, network switches, firewalls, and battery backup units. Keep a record of each device's purchase date, warranty status, and expected replacement date. Replacing a planned number of machines each year is much easier to absorb than waiting until several become unreliable at the same moment.

A spare laptop prepared and ready to use can also reduce downtime when a device is damaged or fails. And when old equipment leaves the business, data must be securely removed before it's sold, recycled, returned, or disposed of. That's a real cost that's easy to overlook — and one reason to read up on what to check before buying a used laptop for your business if you're considering secondhand hardware.

Software and cloud subscriptions

List every subscription the business uses. This typically includes email and productivity software, accounting systems, customer management platforms, industry-specific applications, electronic signature services, password managers, security software, backup services, cloud storage, device management, website hosting, and domain registrations.

Check whether each service is billed monthly or annually. Several annual renewals landing in the same month can affect cash flow even when the monthly equivalent looks affordable. Remove licenses assigned to former staff, unused accounts, and anything duplicated across services.

Also check what each subscription actually includes. Support, backup, security, data retention, and reporting features may require a more expensive plan or a separate service entirely. A new staff member may need more than an email license - they might also need security software, cloud backup, a business phone number, device management, and access to specialist applications. Allow for that when estimating hiring costs during the budget period.

Staff changes

Onboarding and offboarding are both real technology costs that rarely appear in a budget unless someone has specifically added them.

When someone starts, they need equipment, software licenses, security tools, user accounts, phone services, and setup work. If it's a new role, the business may also need additional storage, internet capacity, or specialist software.

When someone leaves, their access must be removed promptly, company information transferred or preserved, equipment collected, and licenses cancelled or reassigned. Email and files may need to be retained for operational, legal, or compliance reasons under the NZ Privacy Act 2020.

Contractors and temporary staff create similar costs even when they use their own equipment. Estimate the expected number of starters and departures across the budget period and include both the technology and the work involved in managing those changes.

IT support

Whether you use a managed IT provider, pay for support when needed, or have someone internal, the cost needs to be in the budget clearly.

If you're on a managed services agreement, confirm exactly what's covered. It may include help desk support, monitoring, software updates, device management, user administration, security tools, and routine maintenance - but projects, after-hours work, office moves, major upgrades, and support for specialist applications may sit outside that agreement and be billed separately. Understanding the full scope is especially relevant if you're thinking about changing IT provider in Christchurch and comparing what different agreements actually include.

If you pay for support as needed, look back at two or three years of invoices. Include emergency work, not just routine maintenance. Factor in what was spent after equipment failures, account problems, internet outages, and security incidents.

If you have internal IT staff, include salaries, benefits, recruitment, training, certifications, and cover during leave. A single internal person may still need outside help for specialist projects or serious incidents.

Cybersecurity

Cybersecurity spending should be clearly identified in the budget, even when some of it is wrapped into software licenses or a support agreement. If it's invisible, it's easy to assume it's covered when it isn't.

Depending on the business, this may include endpoint protection, email filtering, multifactor authentication, password management, device management, security monitoring, software updates, vulnerability assessments, staff training, and incident-response planning. The right combination depends on what systems you use, what information you hold, and what a security incident would cost the business.

A practice holding confidential client records or health information needs more protection than a business that holds little sensitive data. Requirements may also come from cyber insurance policies, customer contracts, or regulatory obligations - all worth checking before the budget is finalised. If you're not sure where your gaps are, the ITstuffed cybersecurity page covers what most Canterbury businesses should have in place.

The NCSC NZ at ncsc.govt.nz also provides practical guidance on cybersecurity controls suited to small and medium businesses.

Backups and recovery

Budget for the complete backup and recovery process, not only the storage that holds the copies. Costs may include backup software, cloud storage, isolated copies, monitoring, restore testing, and professional help during a recovery event.

Confirm what's actually being backed up. Important information may be spread across employee computers, servers, cloud platforms, accounting systems, websites, mobile devices, and specialist applications. Don't assume every cloud service retains deleted or damaged data for as long as your business needs - check the provider's retention periods and recovery options.

Backups also need to be tested. A successful backup notification tells you the task ran. A restore test confirms the data can actually be recovered and used. Include that testing in the budget, along with allowance for storage growth as the business creates more files, emails, recordings, and customer records over time.

Internet and network equipment

Include the internet connection, routers, firewalls, switches, wireless access points, cabling, and any support or security subscriptions attached to that equipment.

If losing internet access would stop the business from working, consider whether a backup connection is worth the cost. Compare that against the revenue, wages, and customer service time that could be lost during an outage. Check whether the backup uses a genuinely different type of service or supplier - two connections sharing the same local infrastructure may both fail from the same fault. It's worth understanding why business networks keep playing up before you assume a second connection alone is enough.

Network equipment requires software updates and eventual replacement. Record the support status of each device. Equipment that no longer receives security updates should be scheduled for replacement, not left running because it still seems to work.

Phones and communication

Phone and communication costs are often billed separately but still belong in the technology budget. Include business phone systems, mobile plans, phone numbers, call recording, voicemail, video conferencing, and messaging platforms.

Check how the service is charged - per user, per number, per call, per recording, or per amount of storage. International calling and additional features may carry separate charges. If the business records calls, budget for the storage, access controls, and retention settings required. Check contract end dates and whether equipment must be returned if the provider changes.

Website, domain, and online services

Include domain registration, website hosting, security certificates, website maintenance, software updates, plugins, backups, online forms, analytics, and email delivery services.

Confirm that the domain and website accounts are registered to the business rather than an employee, contractor, or web developer. Record renewal dates and set appropriate reminders. Losing control of a business domain can interrupt the website, email, and other services connected to it. If the website accepts payments, bookings, or customer information, include the cost of maintaining its security.

Staff training

Employees need training on the systems they use and the security risks they may encounter. The budget may include cybersecurity awareness training, phishing simulations, training for new software, and guidance for staff who handle sensitive information or approve payments.

Training should also cover what staff should do when they receive a suspicious message, lose a device, send information to the wrong recipient, or notice unusual activity. Include the time required for staff to complete training during the working day - even when the platform is inexpensive, the staff time is a real cost. New systems may need additional training; build that into the project budget rather than assuming people will work it out.

Compliance and cyber insurance

Your industry, customer contracts, or insurance policy may require specific technology and security controls. Costs may include security assessments, policy reviews, vulnerability testing, access reviews, incident-response exercises, or data-retention changes.

Cyber insurance applications commonly ask about multifactor authentication, backups, endpoint protection, email security, staff training, and incident-response planning. A customer may also ask your business to complete a security questionnaire before signing a contract, and the answers may reveal gaps that need to be addressed. Review upcoming renewals and audits before approving the budget so there's enough time to obtain quotes and complete any required work.

Obligations under the NZ Privacy Act 2020 are worth confirming with your legal or compliance adviser, particularly if the business holds health information or personal client data.

Technology projects

Keep planned projects separate from normal operating costs. Projects might include moving offices, opening another location, replacing a server, changing phone systems, upgrading Wi-Fi, migrating data to a new cloud service, or introducing a new business application.

Estimate the complete project cost: planning, licenses, equipment, implementation, data transfer, testing, training, temporary services, and support after launch. Some projects require two systems to run in parallel while information is moved and staff are trained - include that overlap cost. Ask department managers what changes they expect during the year; a new service introduced by one team may create additional security, storage, integration, and support requirements for the rest of the business.

Supplier contracts and renewal dates

Record the contract owner, renewal date, notice period, billing method, and cancellation process for each major supplier. Some services renew automatically; others require advance notice if you want to reduce licenses or cancel. Check whether prices can change during the contract and whether there's a minimum user count.

Confirm how data can be exported and what happens when a service ends. A cheaper replacement may still involve migration, setup, training, and temporary overlap costs that reduce the saving. Don't leave important technology accounts tied to one person's personal email or payment card - the business should retain access if that person leaves.

A reserve for unplanned costs

A laptop gets damaged, a firewall fails, an employee needs urgent replacement equipment, or a technical problem requires work outside the support agreement. These things happen.

There's no universal reserve percentage. Base the amount on realistic costs for your business - replacing an essential computer, obtaining emergency support, or restoring an important service. Look back at unplanned IT spending from previous years and use those figures. The reserve should be separate from planned replacements; a machine already scheduled for replacement isn't an unexpected cost. For context on what unplanned outages can actually cost, it's worth understanding what IT downtime is really costing your business beyond the immediate repair bill.

Keeping the budget current through the year

Review the budget at least quarterly rather than waiting until the next annual cycle. Compare actual invoices with expected amounts. Look for new subscriptions, unused licenses, supplier price increases, additional storage charges, and projects that cost more or less than planned.

Update the forecast when the business hires staff, changes locations, introduces new services, or signs a contract with new security requirements. A quarterly review also gives you time to act on upcoming annual renewals while there's still room to compare providers or renegotiate terms.

The ITstuffed managed IT service includes a regular review of technology costs and upcoming renewals as part of ongoing support, so nothing catches the business off guard.

If you'd like ITstuffed to go through your current IT environment and help you identify what belongs in your budget, book a 15-minute IT Fit Check at itstuffed.co.nz/booking.