How Much Should a Small Business Budget for IT? A Bethesda Guide

Ask ten business owners what they spend on IT and you will get ten numbers that are not measuring the same thing. One counts only the support contract. Another includes software licenses. A third forgot the phone system, the website, and the laptops bought on a credit card in a panic. Before you can decide whether you are spending the right amount, you have to count honestly, and then you need benchmarks that fit your industry and size. Here is a practical framework, with typical market ranges, tuned for the kind of businesses that fill Bethesda's office buildings: law firms, financial and wealth advisors, medical and dental practices, associations, consultancies, and the biotech and research orbit around NIH and Walter Reed.

First, count everything

A real IT budget has five buckets. If your current number only covers the first one, your spend is higher than you think:

• Support and management. Your MSP contract or internal IT salaries, plus any hourly or project billing on top.
• Software and cloud. Microsoft 365 or Google Workspace, your practice management or line-of-business system, accounting, e-signature, storage, and the long tail of per-seat subscriptions that grows every year.
• Security. EDR, email filtering, backup platforms, security training, and your cyber insurance premium. Some of this is bundled into an MSP fee; make the bundle explicit so you can compare providers.
• Hardware. Laptops, monitors, network gear, printers, conference room equipment, whether purchased or leased.
• Connectivity and communications. Internet service, phone system, mobile plans the business pays for.

The benchmarks: percent of revenue and per employee

Two yardsticks are worth using together, because each catches errors the other misses.

Percent of revenue

Across small and mid-sized businesses, total IT spending typically lands between 2% and 6% of revenue. The spread is mostly industry: businesses that are essentially information businesses (law, finance, healthcare, consulting, research) cluster in the 4% to 7% range, while businesses whose revenue is tied to physical goods or labor often run leaner, at 1% to 3%. Smaller companies also tend to spend a higher percentage than larger ones, because a baseline of decent security and support does not shrink proportionally with headcount. These are typical market ranges, not research findings, and the right number for you depends on how much of your value lives in systems and data. For most Bethesda professional firms, the honest answer is: nearly all of it.

Per employee, per month

The second yardstick is monthly spend per employee, which is how MSP pricing is usually quoted anyway. Typical market ranges:

Add it up and a well-run professional office typically spends somewhere between $250 and $600 per employee per month all-in. A 20-person firm at the midpoint is around $100,000 a year, which surprises owners who thought of IT as the $3,000 monthly support bill. It should not be alarming; it is roughly the cost of one mid-level salary, buying the infrastructure every other salary depends on.

Adjusting the number for Bethesda realities

Benchmarks are a starting point. Several factors common in Bethesda push the right number up or down:

• Regulated and confidential work. Law firms carry client confidentiality duties and increasingly face security questionnaires from corporate clients. Advisory and financial firms answer to FINRA or SEC expectations around data retention and supervision. Medical and dental practices carry HIPAA. All of this pushes the security bucket toward the top of the ranges, and it overlaps almost perfectly with what carriers now demand; see our guide to cyber insurance IT requirements before you trim it.
• The NIH and federal orbit. Firms that subcontract on federal or research work inherit compliance requirements from those contracts. If defense work is in the mix, budget for the roadmap in our CMMC guide as a project line, not an operating line.
• High cost of downtime. When your billing unit is the partner-hour, an outage costs multiples of what it costs a retail shop. That argues for spending on resilience (better backup, redundant internet) and for tighter response commitments in your contract; our SLA buyer's guide covers what those should say.
• Hybrid work. Most Bethesda offices now equip people twice: laptop-first setups, home connectivity, collaboration tooling. That structurally raised per-employee spend relative to the desktop era, and budgets that never caught up show it in shadow-IT credit card charges.

The ratio inside the number matters more than the number

Two firms can each spend 5% of revenue and get wildly different value. The failure pattern is spending reactively: old hardware kept alive with hourly fees, emergencies at premium rates, no security layer until the insurance renewal forces it. The healthy pattern allocates roughly along these lines: about half to steady operations (support, licenses, connectivity), a quarter to security and resilience, and a quarter to improvement, meaning hardware refreshes on a 3 to 4 year cycle and one or two deliberate projects a year instead of a decade of deferred everything. If more than about 15% of your annual IT spend is unplanned emergency work, you do not have a spending problem, you have a structure problem, and the fix is usually moving from reactive support to a managed model. Our break-fix versus managed services comparison walks through that math honestly, including when break-fix still wins.

Where owners overspend and underspend

The overspending is usually quiet: unused licenses that were never cancelled after departures, three tools doing one job, premium software tiers nobody asked for, and hourly project billing from a provider who is also the only one auditing the necessity of the projects. An annual license audit routinely claws back meaningful money in an afternoon. The underspending is usually structural: backups nobody has tested, a firewall from two ownership changes ago, no security training, and no offboarding process, each invisible until the week it is very visible. When budgets get cut, cut the convenience layer, never the resilience layer.

Turning a number into a budget

1. Inventory current spend across all five buckets, including the credit card subscriptions. This takes an afternoon with your bookkeeper and is the highest-value hour in this whole exercise.
2. Compare against the yardsticks. Percent of revenue and per-employee, against the ranges above, adjusted for your industry factors.
3. Set the operating budget as a monthly per-employee figure, so it scales automatically as you hire.
4. Plan projects separately. Refreshes, migrations, and compliance pushes are capital-style spending with start and end dates. For larger efforts, structured oversight pays for itself; that is what our IT project management service does.
5. Rebid when the market has moved. If your support contract has not been competitively tested in three or more years, you are probably paying an incumbency premium, and a lightweight RFQ will tell you quickly whether the number is still fair.

The goal is not to spend as little as possible. It is to spend a defensible amount, on the right things, on purpose.