IT Budget Planning for Indian SMEs: A Defensible 3-Year Plan

The ₹18 Lakh Surprise That Shouldn't Have Been a Surprise

In March 2025, a 140-person engineering firm in Peenya got hit with a ransomware demand on a Friday evening. Their firewall was a five-year-old Cyberoam CR35iNG that nobody had updated since the vendor was acquired. Their "backup" was a Synology DS218+ with two 4TB drives in RAID 1, sitting on the same VLAN as the file server. The attacker encrypted 11TB of project data, including two years of CAD files for an automotive client.

The recovery bill: ₹18.4 lakh. That covered emergency incident response from a Delhi-based forensics firm (₹4.2 lakh), a rush order for a FortiGate 90G and a pair of 8TB WD Red Pro drives (₹1.9 lakh), 96 hours of billable downtime across 40 engineers (₹9.8 lakh), and the client's penalty clause (₹2.5 lakh). The company's entire IT budget for FY 2024-25 was ₹22 lakh. One incident ate 84% of it.

The finance director's reaction was predictable: "Why wasn't this in the budget?" The honest answer is that nobody had built an IT budget. There was an IT spend, tracked loosely in Tally under "Computer Expenses," but no plan. No hardware refresh calendar. No security line item beyond annual antivirus renewals. No allocation for the inevitable.

This article is about fixing that. Not with a template you download from a vendor blog, but with a structure that survives scrutiny from your CFO, your auditors, and — most importantly — a bad Tuesday.

We've built these plans for over 1,200 organisations since 2001. The ones that hold up share a few things: realistic capex/opex splits, explicit refresh cycles, and a written rationale for every rupee. The ones that fail usually do so because someone tried to benchmark against Infosys instead of against their own revenue.

Why "IT Budget" Means Something Different for an Indian SME

If you're a 50-person logistics company in Bhiwandi, you don't have a CIO. You have a finance head who owns the IT line item, an operations manager who complains when the Tally server is slow, and maybe one IT person who does everything from printer drivers to firewall rules. Budget planning has to fit that reality.

The three biggest mistakes we see:

Mistake 1: Treating IT as pure capex. Buying laptops, servers, and firewalls as one-time purchases and then pretending the ongoing costs don't exist. They do. Software renewals, AMC, cloud subscriptions, and the salary of the person who resets passwords.

Mistake 2: Benchmarking against the wrong peer group. "We spend 1% of revenue on IT, same as Wipro." You are not Wipro. Wipro's IT spend includes R&D for products they sell. Your IT spend keeps the lights on. Different denominator, different expectation.

Mistake 3: No refresh calendar. A laptop bought in 2021 will need replacement in 2026. If you didn't plan for that in 2024, you'll buy whatever is available at the worst possible price in 2026, probably from a dealer who knows you're desperate.

A defensible budget fixes all three. It splits spend into capital and operating, ties each to a refresh cycle, and benchmarks as a percentage of revenue against companies of similar size and sector.

Benchmark: What Should an Indian SME Spend on IT?

Here's the range we see across our client base for FY 2025-26. "IT spend" here includes hardware capex, software licences, cloud subscriptions, AMC, managed services, internet, and internal IT salaries — but excludes one-time project costs like an ERP implementation or a major office relocation.

A few caveats. Asset-heavy sectors (manufacturing, logistics with warehouse automation) sit at the higher end. Pure services firms with mostly laptops and cloud tools sit lower. Companies in regulated sectors — NBFCs, healthcare, any BPO handling client data — should add 0.3-0.5 percentage points for compliance tooling.

If you're spending less than 1% of revenue on IT and you have more than 100 employees, you are almost certainly underinvesting. The symptom shows up as constant firefighting, high attrition among your IT staff, and a security incident that you haven't had yet but will.

If you're spending more than 5%, either you're in a genuinely tech-heavy business or you have a structural problem — usually legacy on-premise infrastructure that should have been retired two years ago.

The Capex vs Opex Split: Where Most SMEs Get It Wrong

The instinct is to minimise opex and push everything into capex because "we already paid for it." That instinct made sense in 2005. It costs you money in 2026.

Here's the split we typically recommend for a 100-person company:

Two things to notice. First, the aggregate split for a typical SME lands around 35% capex / 65% opex. If your split is 70/30, you're buying too much hardware and underinvesting in the services that keep it running. Second, almost every category is shifting toward opex. Microsoft has been pushing this for a decade. Firewall vendors are pushing it now. Even storage is moving to subscription models with vendors like Pure Storage and Dell APEX.

The practical implication: your IT budget needs to be reviewed annually against your opex commitments, not just against new purchases. A ₹3 lakh annual increase in Microsoft 365 licences because you hired 30 people is a budget event, not an afterthought.

Refresh Cycles by Asset Class (2026 Numbers)

This is where most plans fail. Refresh is predictable. If you bought 40 laptops in FY 2022-23, you will need to replace them in FY 2026-27 unless you extend to five years, which we do not recommend for machines running Windows 11 with modern security agents.

Put these against your asset register. If you don't have an asset register, that's the first thing to fix — before you build any budget. A simple Excel sheet with purchase date, model, serial, user, and warranty expiry is enough. We've seen companies with 200 laptops and no reliable list of who has them.

Building the 3-Year Plan: A Worked Example

Let's take a 120-person IT services firm in Bangalore with ₹60 crore revenue. They have 110 laptops, 15 desktops, three servers (one physical, two virtualised on ageing Dell R730s), a FortiGate 60F firewall, and 12 Ubiquiti APs installed in 2019. Current annual IT spend is ₹68 lakh, or 1.1% of revenue. They want to know what the next three years should look like.

Here's how we'd build it.

Year 1 (FY 2026-27): Stabilise and Baseline

Line item breakdown:

Year 1 capex is high because of the server refresh and laptop cycle. Opex is the floor — subscriptions and services you'll pay regardless.

If you need help structuring managed services as part of this — and understanding what's actually included — our managed services page walks through the scope options.

Year 2 (FY 2027-28): Consolidate

Line item breakdown:

Year 3 (FY 2028-29): Scale

Line item breakdown:

The Aggregated 3-Year View

Is this defensible? Yes, because every line item traces back to a specific driver — either a refresh cycle date, a headcount figure, or a contractual obligation. None of it is guesswork. If the CFO asks "why ₹9.5 lakh on servers in year 1," you point at the R730s, note their 2019 purchase date, and note that VMware ESXi 6.7 went EOL in October 2022. Done.

The Failure Story: When the Budget Didn't Exist

A 75-person garments exporter in Tirupur had no IT budget at all as recently as 2023. The owner approved purchases ad hoc: a laptop here, a printer there, whatever the IT guy asked for. In June 2024, their ERP server — a Dell T40 tower running Windows Server 2016, purchased in 2018 — failed on a Saturday. Single power supply. No redundant disk. The server had a RAID 1 array but one of the two drives had been failing for months and nobody noticed because the IT guy didn't know how to read SMART data.

The company lost four days of order processing during peak season. The cost of the emergency server replacement (₹1.6 lakh, paid at spot price to a Coimbatore dealer) was the smallest part. The lost orders and expedited shipping to make up for the delay added up to ₹7.8 lakh in unplanned costs. The owner asked us to build a budget after the fact. We told him the budget would have shown ₹2.4 lakh in year 3 of a 5-year server cycle — spend that would have been allocated six months earlier and purchased at a normal price with time for a proper migration.

The lesson isn't "buy better servers." The lesson is that unbudgeted IT is expensive IT. Every rupee you don't plan for in advance costs you two rupees when it becomes urgent.

Where SynergyScape Is Not the Right Fit

We manage IT for SMEs. We're not the right partner for every SME. Honest limitations:

If you have a full in-house IT team of four or more people, you don't typically need a managed services contract. You may still want us for specific projects — a cloud migration, a security audit, a network redesign — but a per-user monthly retainer would be duplicating capability. In those cases, we'd rather sell you a project than an ongoing contract.

If you're a pure-cloud, no-office company with everybody on laptops and nothing on-premise, a traditional managed services contract is overkill. Your real needs are identity management, SaaS security, and endpoint protection — which you can buy directly from vendors or through a lighter-weight partner.

If your IT spend is under ₹5 lakh annually, the fixed cost of a comprehensive managed contract may not be worth it. You're better off with a break-fix arrangement and a good AMC. We'll tell you that instead of trying to sell you something you don't need.

If you have a captive IT team in a group company that dictates policy, our scope gets limited to execution. That's fine, but it's not the model we're best at.

The point is: a budget plan should be honest about where managed services fit and where they don't. If your situation is one of the above, you should still have a budget. You just shouldn't allocate it to us for everything.

Common Budget Line Items People Forget

A few items that show up in audits and get flagged as unplanned spend:

• GST on everything. Hardware at 18%, software at 18%, services at 18%. Your budget should be GST-inclusive or GST-exclusive consistently — mixing the two creates confusion. Most SMEs work GST-exclusive and account for the input tax credit separately.
• Annual maintenance contracts on UPS batteries. Not the UPS itself, the batteries. ₹8,000-₹15,000 per unit per year if you're on an AMC, or ₹18,000-₹35,000 out of pocket when they fail.
• Cabling and cable management. Every office move, every new desk, every time someone runs a cable under a carpet. Budget ₹1,500-₹3,000 per network point per year for moves and changes.
• Cert-In obligations. If you're in a regulated sector or handling certain data, incident reporting requirements and audit trail retention have cost implications. Budget ₹50,000-₹2,00,000 annually depending on scope.
• DPDP Act readiness. India's Digital Personal Data Protection Act is coming into force with phased obligations. If you process personal data at scale, budget for consent management tooling, data mapping, and potentially a Data Protection Officer role. This is a 2025-2027 line item, not a 2024 one.
• Microsoft 365 price increases. Microsoft raises India pricing periodically — typically 5-10% every 18-24 months. Budget for it. Your per-user licence cost in 2028 will not be the same as 2026.
• Internet failover. Single ISP is a budget trap. A backup connection costs ₹8,000-₹20,000 per month but prevents a ₹2 lakh day of downtime. If you're in a building with poor ISP options, budget for a secondary provider or a 4G/5G failover.
• Bangalore-specific: monsoon cabling risk. If your office has exposed outdoor cabling, budget for annual inspection and possible replacement. Water ingress kills switches. We see two to three such incidents every monsoon in Bangalore offices.
• ISP lead times. New fibre connection in Bangalore typically takes 15-45 days depending on building permissions. Budget for the time, not just the money. If you're moving offices, order internet six weeks before you need it.

How to Present This to Your CFO

The budget itself is half the work. Getting it approved is the other half. A few things that make the conversation easier:

Lead with risk, not with technology. "We are running a firewall that hasn't received a security update since 2023" lands better than "the FortiGate 60F is EOL." Both are true. One gets funded.

Show the number as a percentage of revenue. A ₹69 lakh IT budget sounds large. A 1.15% IT budget, benchmarked against a 1.2%-2.2% range for companies your size, sounds reasonable. Same number, different frame.

Have the alternative ready. "If we don't replace the servers in year 1, we need to budget ₹6 lakh in year 2 for emergency procurement plus ₹3 lakh for expedited migration." The do-nothing option has a cost. Say it out loud.

Separate committed from discretionary. Your Microsoft 365 licences are committed. Your firewall replacement is discretionary (but recommended). CFOs approve committed spend easily and scrutinise discretionary spend. Group them separately.

Use three years, not one. A one-year budget for a three-year problem invites line-item cuts. A three-year plan with a stable total is harder to attack.

If your CFO wants to understand where managed services fit into this, point them at our managed services page — it explains the scope and pricing model clearly. If they want to talk through the numbers directly, reach out and we'll walk through it.

Special Cases: Multi-Location, Regulated, and High-Growth SMEs

The generic plan above works for a single-location SME with steady growth. A few variations:

Multi-location companies need to budget for WAN links, site-to-site VPN or SD-WAN, and per-site equipment. Rule of thumb: add ₹4-8 lakh in year 1 capex per additional site, plus ₹60,000-₹1,20,000 in ongoing opex for connectivity and management. Central management tooling — FortiManager, Sophos Central, or Aruba Central — becomes essential once you cross three sites.

Regulated companies (NBFC, healthcare, insurance) add compliance overhead: audit logging, retention infrastructure, periodic vulnerability assessments, and often a compliance officer role. Expect 15-25% higher IT spend than an unregulated peer of the same size.

High-growth companies (30%+ headcount growth) face a different trap: you budget for 100 users and hit 140 by year-end. Every per-user line item blows out. Build headcount growth into your per-user cost projections explicitly. If your plan assumes 5% growth and you actually deliver 25%, your Microsoft 365 bill, endpoint protection, and managed services costs all overrun by 20%.

The FAQ Nobody Puts in Writing

What percentage of revenue should an Indian SME spend on IT?

For SMEs with 20-150 employees, a reasonable range is 1.8%-3.0% of revenue for FY 2025-26. Smaller companies (under 50 employees) typically sit higher, at 2.5%-4.0%, because fixed costs are spread over less revenue. Larger companies (300+) drop to 0.9%-1.6%. Sectors matter: manufacturing and logistics sit at the higher end, pure services at the lower end, regulated sectors add 0.3-0.5 percentage points.

Should I buy hardware or lease it?

For most Indian SMEs, buying outright is still cheaper over a 4-year cycle than leasing, unless you're cash-constrained or want the capex off your balance sheet for specific reasons. A ₹75,000 laptop bought outright costs ₹75,000 plus GST. Leased over 3 years at typical Indian SME rates (₹2,400-₹2,900 per month), it costs ₹86,400-₹1,04,400 plus GST — 15-40% more. Lease if your working capital is tight or if you want laptop refresh to be automatic. Buy if you have capital and want the lower total cost.

What is a realistic IT capex budget for a 50-person startup?

For FY 2026-27, budget ₹18-₹28 lakh in initial capex: 50 laptops (₹32-42 lakh if all at once, but typically staggered), one server or cloud equivalent (₹2-5 lakh), firewall (₹80,000-₹1.5 lakh), switches and access points (₹1.5-2.5 lakh), UPS (₹80,000-1.2 lakh), and setup costs (₹50,000-1 lakh). Plus ongoing opex of ₹60,000-₹1.2 lakh per month for cloud, security, connectivity, and support.

How do I account for IT spend — capex or opex?

Both. Hardware above your capitalisation threshold (typically ₹25,000-₹50,000 per item for SMEs) goes to capex and is depreciated — computers over 3 years, servers over 6, under IT Act rules. Subscriptions, AMC, cloud services, salaries, and connectivity go to opex and are expensed in the year incurred. Talk to your CA about the threshold; some SMEs set it at ₹25,000 to simplify tracking.

Do I need a separate IT budget for cybersecurity?

Yes. Security is now 12-18% of total IT spend for a typical SME and rising. This includes endpoint protection (EDR, not just antivirus), email security, firewall UTM subscriptions, backup, security awareness training, and periodic assessments. For a 100-person company, expect ₹8-15 lakh annually for security. Underfunding security is the single most common budget mistake we see in audits.

How often should I review the IT budget?

Quarterly, at minimum. Annual reviews catch problems too late. A quarterly review lets you adjust for headcount changes, vendor price increases, failed components that need early replacement, and new compliance requirements. It also gives your finance team visibility before the year-end surprise. We've seen SMEs save ₹3-6 lakh annually just by catching overlapping subscriptions — two different backup tools, duplicate email security, unused cloud capacity — during quarterly reviews.

What to Do This Week

You have enough to build a plan. Here's the sequence:

Day 1-2: Build your asset register. Every laptop, desktop, server, firewall, switch, AP, UPS, and printer. Purchase date. Model. User. Warranty expiry. If you can't do this from invoices, use a network scan and physical count.

Day 3: Pull your actual IT spend for the last 24 months from your accounting system. Not the budget — the actuals. Group by category using the table above.

Day 4-5: Cross-reference. Which assets are past their refresh cycle? Which vendors are you paying for services you no longer need? Which gaps exist in security, backup, or redundancy?

Week 2: Build the three-year model. Use the line items from our worked example as a template. Adapt costs to your specific situation — your laptop needs, your server requirements, your user count. Add your sector-specific compliance costs.

Week 3: Present to finance. Lead with risk. Show the percentage-of-revenue number. Have the do-nothing alternative costed out. Ask for a three-year approval, not a one-year approval.

Week 4: Start executing year 1. Order anything with a long lead time first — servers, firewalls, fibre links. Bangalore ISP lead times are 15-45 days; don't order a 1Gbps line a week before you need it.

The budget you build this month is the budget that protects you next year. The ransomware incident, the failed server, the expired firewall — they don't announce themselves. They show up on a random Tuesday and ask how much unplanned cash you have available. Build the plan so you have an answer that isn't "let's find out."