Direct answer: Build a cybersecurity budget from the assets you must protect and the risks you need to reduce. There is no verified universal percentage or per-user amount for every small business. Separate recurring protection, one-time improvements and recovery preparation.
Start with business risk
Identify critical applications, sensitive information, privileged accounts and essential suppliers. Record what a loss of access or data would interrupt and who can authorize recovery. This gives the business a reason for each budget item.
Use a scope-based budget worksheet
| Budget line | Evidence to request |
|---|---|
| Identity and access | Account inventory, MFA coverage and administrator access review |
| Devices and email | Supported devices, endpoint coverage and email protection scope |
| Monitoring and response | Alert ownership, escalation hours and containment authority |
| Backup and recovery | Retention, isolation, restore test results and recovery dependencies |
| People and governance | Training scope, incident contacts and risk review schedule |
| Remediation projects | Specific gaps, accountable owners and acceptance checks |
Separate commitments from assumptions
Obtain written license and service quotes. Record the quantity, unit, billing period, minimum term and exclusions beside every cost. If an input is unknown, mark it as a gap and assign an owner; do not substitute a generic industry percentage.
NIST provides small-business guidance on risk, identity, recovery and supplier security. These resources help frame a scope review; they do not validate a provider, price or business outcome. NIST small business cybersecurity resources. Reference checked 2026-09-24.
Review the budget after changes
Revisit the plan when you add applications, acquire a business, change insurance or contractual requirements, or find a recovery gap. Evaluate proposals against the same responsibilities and evidence. Review our managed security scope or request a scoped proposal.
Updated . This update covers the article content and references.
