For many nonprofits, every pound matters.
Budgets are carefully managed, funding can be unpredictable, and technology spending is often scrutinised by trustees and leadership teams. As a result, many charities struggle with a common question:
"How much should we budget for IT support and cybersecurity?"
Spend too little and your organisation may face increased downtime, cybersecurity risks, and operational inefficiencies.
Spend too much and valuable funds may be diverted away from frontline services.
The goal is finding the right balance.
For most nonprofits with between 10 and 100 employees, IT support and cybersecurity should be viewed as an investment in service delivery, business continuity, governance, and risk management—not simply an operational expense.
In this guide, we'll explain typical budgeting ranges, what should be included, and how charities can maximise value from their technology investments.
The Short Answer
For most Scottish charities and nonprofits with 10–100 employees, a realistic IT support and cybersecurity budget is typically:
Managed IT Support
£35–£60 per user per month
Cybersecurity Protection
£10–£30 per user per month
Microsoft 365 Licensing
£0–£20+ per user per month
(depending on nonprofit licensing eligibility)
Device Replacement Fund
£10–£20 per user per month
When combined, many organisations budget between:
£55–£110 per user per month
for a well-supported, secure, and future-ready technology environment.
The exact figure depends on your risk profile, regulatory requirements, number of locations, and technology strategy.
Why IT and Cybersecurity Should Be Budgeted Together
Historically, organisations treated cybersecurity as a separate project.
Today, cybersecurity should be integrated into every aspect of IT.
For example:
- Device management supports security
- Microsoft 365 security protects data
- Backups support cyber resilience
- User training reduces phishing risks
- Monitoring helps identify threats
Separating IT and cybersecurity budgets often leads to gaps in protection.
A modern strategy combines both.
What Should a Nonprofit IT Budget Include?
Many organisations focus only on helpdesk support.
However, a complete IT budget should include several key areas.
1. Managed IT Support
This covers day-to-day support and technology management.
Typical services include:
- Helpdesk support
- Device management
- Monitoring
- Microsoft 365 administration
- User management
- Technical troubleshooting
Typical Budget
£35–£60 per user per month
This aligns closely with what many growing Scottish organisations invest in managed IT services.
2. Cybersecurity Protection
Cybersecurity should be considered a core operating requirement.
A modern cybersecurity budget should include:
- Multi-Factor Authentication (MFA)
- Endpoint protection
- Email security
- Security monitoring
- Backup and recovery
- Security awareness training
Typical Budget
£10–£30 per user per month
The exact amount depends on security requirements and existing infrastructure.
3. Microsoft 365 Licensing
Most nonprofits rely heavily on Microsoft 365.
Common services include:
- Outlook
- Teams
- SharePoint
- OneDrive
- Microsoft Defender
- Intune
Many charities qualify for discounted or donated licences.
Budget Range
£0–£20+ per user per month
The actual cost depends on licence selection and eligibility.
4. Device Replacement Planning
One of the biggest mistakes nonprofits make is waiting until equipment fails.
Technology should be replaced proactively.
Recommended Lifecycle
| Device Type | Typical Replacement Cycle |
| PCs | 4–5 Years |
| Laptops | 4–5 Years |
| Servers | 5–7 Years |
| Firewalls | 5 Years |
Budget Recommendation
Set aside:
£10–£20 per user per month
for future hardware replacement.
This avoids large, unexpected capital expenditure.
5. Backup and Disaster Recovery
Every nonprofit should have:
- Automated backups
- Cloud backups
- Recovery testing
- Business continuity planning
Questions Trustees Should Ask
- Could we recover from ransomware?
- How quickly could systems be restored?
- Have backups been tested?
Business continuity is often overlooked until an incident occurs.
How Much Cybersecurity Does a Nonprofit Actually Need?
Not every charity requires enterprise-grade security.
However, every nonprofit should have a baseline level of protection.
Minimum Security Controls
✓ Multi-Factor Authentication
✓ Endpoint protection
✓ Security updates
✓ Backup systems
✓ Security awareness training
✓ Microsoft 365 security controls
✓ Role-based access controls
Recommended Security Controls
✓ Cyber Essentials certification
✓ Security monitoring
✓ Conditional Access policies
✓ Device management
✓ Incident response planning
These controls significantly reduce risk without creating unnecessary complexity.
How To Budget For A 25-Person Charity
Managed IT Support
25 users × £45 per month
= £1,125 per month
Cybersecurity
25 users × £15 per month
= £375 per month
Device Lifecycle Fund
25 users × £15 per month
= £375 per month
Total Monthly Technology Budget
Approximately:
£1,875 per month
Or:
£22,500 annually
This provides a realistic benchmark for planning purposes.
How To Budget For A 50-Person Nonprofit
Managed IT Support
50 users × £45 per month
= £2,250 per month
Cybersecurity
50 users × £15 per month
= £750 per month
Device Lifecycle Fund
50 users × £15 per month
= £750 per month
Total Monthly Technology Budget
Approximately:
£3,750 per month
Or:
£45,000 annually
For many organisations, this represents a small percentage of overall operating expenditure while supporting critical services.
Common Budgeting Mistakes Nonprofits Make
Mistake #1: Focusing Only on Support Costs
IT budgets should include security, replacement planning, and business continuity.
Mistake #2: Delaying Hardware Replacement
Ageing devices increase downtime and support costs.
Mistake #3: Underestimating Cybersecurity Risks
Charities are increasingly targeted by cybercriminals.
Mistake #4: Treating IT as a Cost Rather Than an Enabler
Technology directly supports service delivery, fundraising, communications, and operational efficiency.
Mistake #5: Budgeting Reactively
The most successful organisations plan technology investments several years in advance.
What Questions Should Trustees Ask About IT Spending?
Trustees do not need to be technology experts.
However, they should regularly ask:
Security
Are we protected against common cyber threats?
Risk
What are our biggest technology risks?
Resilience
How quickly could we recover from a cyber incident?
Budgeting
Do we have a technology roadmap and replacement plan?
Governance
Are we meeting our compliance and cybersecurity obligations?
These questions help strengthen oversight and reduce organisational risk.
A Scottish Charity with 40 Employees
Their Challenges
- Ageing laptops
- Limited cybersecurity controls
- Growing remote workforce
- No technology roadmap
The Improvements Realised
The organisation implemented:
- Managed IT support
- Multi-Factor Authentication
- Microsoft 365 security enhancements
- Device replacement programme
- Cyber Essentials preparation
Their Outcomes
Benefits included:
- Reduced downtime
- Improved cybersecurity posture
- Better budget forecasting
- Increased staff productivity
- Greater trustee confidence
The focus was not spending more.
The focus was spending smarter.
Why Scottish Nonprofits Choose Stratiis
At Stratiis, we help charities and nonprofits across Glasgow, Edinburgh, Lanarkshire, Ayrshire, Lothian, Dumfries & Galloway, and Perthshire build secure, cost-effective technology environments.
Our services include:
- Managed IT support
- Cybersecurity services
- Microsoft 365 expertise
- Device management
- Backup and disaster recovery
- Cyber Essentials readiness
- Strategic vCIO services
- Technology budgeting and planning
We understand the unique challenges charities face and help organisations maximise the value of every technology investment.
Final Thoughts
For most nonprofits with 10–100 employees, a realistic technology budget should include:
- Managed IT support
- Cybersecurity protection
- Microsoft 365 licensing
- Device replacement planning
- Backup and disaster recovery
As a general benchmark, many organisations invest between:
£55–£110 per user per month
across these areas.
The right budget is not necessarily the lowest budget.
It's the budget that enables your organisation to operate securely, efficiently, and confidently while continuing to deliver its mission.
Technology should support your impact—not become a risk to it.
Related Articles
Non-Profit IT Support in Scotland
What Cyber Essentials Requirements Apply to Scottish SMEs and Charities in 2026?
What Cybersecurity Protections Does a 50-Person Business Actually Need?
How Much Should Managed IT Support Cost for a 10–100 Employee Business in Scotland?
