I'll have a pop at this
. Most of this is based on what I know and am comfortable with now, in real life there'd be a lot more training and research into new tech etc.
$20,000(~£40,000) 5 - 20 users
fairly middle of the road servers: HP DL380 or similar, Win 2k3 R2. Couple of DCs, one File and print, mabye one SQL if needed, one exchange box, one backup/AV/patch box, one web running Apache 2 on Redhat and one for Asterisk VoIP.
what's that about so far, £15k inc licences?
Bog standard, of the shelf running XP SP2 (I'm not touching vista with a barge pole for the next year or so), locked down to the point of being almost unusable through AD. Except mine which would be the top of the line with as much memory as I could cram into it, dual booting XP & slackware maybe Ubuntu.
that takes the total up to about £25k.
2Mb ADSL moving up to 4 or 8 as needed. Cisco 1700 series router feeding into PIX 515e (Probably overkill, but DMZ is so easy with it and it will scale nicley when I need hot fail over on a fatter pipe later.), 48 port 3560 series for PoE to VoIP phones, one gig swicth for server (may be a cisco express as I'm running out of cash now...). All switch ports hard coded to accept one MAC. AC in server room.
That's about me spent up, if there's anything left I might treat my workers to a desk or two, maybe even a chair
Most of the money spent at this level would be actual kit to get the company running, the security coming mostly from policy and configuration.
More of the same, scaling up with the users, maybe letting them have laptops if needed, but if wireless, certificates and RADIUS, EAP. If VPN required by now RSA type tokens. IDS sat somewhere, one in the DMZ first, maybe a second on the internal network.
Now we're talking! put half of it to one side, we'll come to that in a second. Probably move a few of the servers to blades, for heat and space reduction, hot swapable/fail over everything two net pipes from different providers. Move some of the services off Windows and on to *nix. Probably by some nice Macs for the arty types in the design dept. Couple of machines in the networks as honeypots. IPS installed (Cisco self healing network? with the client on the workstations that stops your machine from getting on the network if you're not patched up to the eyballs - I forget the Apps name). Open view running to keep an eye on things.
The half I put to one side would be given to HR and the legal dept to handle the occasions when we're sued/have to rehire because I've sacked people on the spot for leaving passwords on postits, propped open security doors with old power supplies, left hardcopies of confidential info in bins without shredding and generally done all the stupid things that you can't control with technology.