People might argue with me on this.... But....
Small environment like that, with a server (and AD), firewall, centralized AV software, backup/DR, etc.... I'd say if you wanted to do it properly, spend 1,000 to 1800'ish a month on a company that will monitor/manage/patch the server, software, updates, backup, and workstations.
I see companies pay hourly, or scheduled monthly maintenance, they've been compromised for 30 days without knowing, and the people coming to do the "maintenance" are level 1 techs that don't really do anything and miss MAJOR problems. These companies make their money off the extra billing when shit hits the fan because you aren't spending the money to maintain your environment.
I see companies spending 200-800/month on who knows what (just paying to be a client), nothing get's done and the IT company says it includes "some things they need", but can never say what they are doing. Again, these companies make their money off the extra billing when shit hits the fan.
It's not about being cheap, it's about doing it properly. If you do it properly, your stuff will always be up, you'll never have to call your provider. It's a win/win because all the maintenance is scheduled and in the background (no nightmares for your provider), and everything is always working for you and is up and running (no nightmare for you and your staff).
Sig was pwned by Moderator!