Illustrative sample
Sample 12-month technology roadmap for an 85-person professional-services firm.
A 12-month technology roadmap sequences security, infrastructure, and business-system work into quarters, assigns each item an owner, and ties the plan to a budget that leadership can review. This page is an illustrative sample for a fictional 85-person professional-services firm: the firm, the environment, and the dates are invented, and a real roadmap is built from an assessment of the client's environment and priorities.
At a glance
The year in four quarters.
The themes in order, each with its items below. Security exposures come first, standards second, resilience third, and verification last, so each quarter builds on the one before.
Quarter 1: baseline and urgent risk reduction
Assess, inventory, and close the exposures that matter most: multifactor authentication, endpoint detection and response, verified backups, and documented network and accounts. 10 items.
See the quarterQuarter 2: standardize devices and protect data
Standardize devices and protect data: device management, conditional access, email protection, awareness training, data labeling, and the firewall and network separation. 9 items.
See the quarterQuarter 3: resilience, policy, and consolidation
Build resilience and policy: an incident response plan with a tabletop exercise, central logging, access reviews, standard onboarding, the file server retired, and a full restore test. 9 items.
See the quarterQuarter 4: verify, document, and plan ahead
Verify and plan ahead: a follow-up assessment, updated policies, phishing-resistant sign-in for sensitive roles, the hardware refresh plan, license review, and next year's roadmap and budget. 9 items.
See the quarterWorkstreams
Seven workstreams, one plan.
Security
Assessment, endpoint detection and response, email protection, awareness training, logging, and incident response.
Identity and access
Multifactor authentication, administrator account separation, conditional access, and access reviews.
Endpoints and devices
Inventory, device management, standard configurations, onboarding and offboarding, and hardware lifecycle.
Microsoft 365 and data
Licensing, tenant settings, sharing rules, data labeling and retention, and file server retirement.
Network and infrastructure
Documentation, firewall and segmentation, wireless, switch monitoring, and circuit capacity.
Continuity and backup
Backup verification, restore testing, recovery procedures, and recovery priorities by system.
Governance and budget
Priorities agreed with leadership, quarterly reviews, the budget view, and next year's plan.
Months 1 to 3
Quarter 1: baseline and urgent risk reduction.
Theme for the quarter: baseline and urgent risk reduction. Each item names the workstream it belongs to and who owns it.
- Governance and budget
- Name an executive sponsor and approve the first quarter's priorities. Owner: Client.
- Security
- Complete a cyber risk assessment and rank findings by business risk. Owner: Isidore.
- Security
- Deploy endpoint detection and response to every workstation and server. Owner: Isidore.
- Identity and access
- Enforce multifactor authentication for all users, starting with administrators. Owner: Joint.
- Identity and access
- Separate administrator accounts and remove unused or shared accounts. Owner: Isidore.
- Endpoints and devices
- Inventory every device and flag those that cannot be patched. Owner: Joint.
- Microsoft 365 and data
- Review Microsoft 365 licensing, tenant settings, and external sharing permissions. Owner: Isidore.
- Network and infrastructure
- Document the network, firewall rules, and internet circuits. Owner: Isidore.
- Continuity and backup
- Verify Microsoft 365 and server backups, then complete a first test restore. Owner: Isidore.
- Governance and budget
- Agree on priorities and budget with leadership, then hold the first quarterly review. Owner: Joint.
Months 4 to 6
Quarter 2: standardize devices and protect data.
Theme for the quarter: standardize devices and protect data. Each item names the workstream it belongs to and who owns it.
- Identity and access
- Add conditional access rules for risky sign-ins and unmanaged devices. Owner: Isidore.
- Endpoints and devices
- Enroll laptops and phones in device management with a standard configuration. Owner: Isidore.
- Security
- Launch security awareness training with scheduled phishing simulations. Owner: Joint.
- Security
- Deploy email filtering and sender authentication for every company domain. Owner: Isidore.
- Microsoft 365 and data
- Decide which client data counts as sensitive and approve the retention rule. Owner: Client.
- Microsoft 365 and data
- Label sensitive client data and apply retention and sharing rules. Owner: Joint.
- Network and infrastructure
- Replace the aging firewall and separate guest, staff, and server networks. Owner: Joint.
- Continuity and backup
- Write recovery procedures and rank business systems by recovery priority. Owner: Joint.
- Governance and budget
- Hold the quarterly review, update the roadmap, and revise the budget view. Owner: Joint.
Months 7 to 9
Quarter 3: resilience, policy, and consolidation.
Theme for the quarter: resilience, policy, and consolidation. Each item names the workstream it belongs to and who owns it.
- Security
- Adopt a written incident response plan and run a tabletop exercise. Owner: Joint.
- Security
- Centralize security logs with defined retention and after-hours alert review. Owner: Isidore.
- Identity and access
- Complete a user access review with each department head. Owner: Joint.
- Endpoints and devices
- Standardize new-hire setup and offboarding with a documented checklist. Owner: Joint.
- Microsoft 365 and data
- Move remaining file server data to SharePoint and retire the server. Owner: Joint.
- Network and infrastructure
- Choose the firewall cutover window and tell staff what to expect. Owner: Client.
- Network and infrastructure
- Refresh wireless coverage and add monitoring to all switches. Owner: Isidore.
- Continuity and backup
- Test a full restore of a business-critical system and record results. Owner: Isidore.
- Governance and budget
- Hold the quarterly review and adjust priorities for next year's budget. Owner: Joint.
Months 10 to 12
Quarter 4: verify, document, and plan ahead.
Theme for the quarter: verify, document, and plan ahead. Each item names the workstream it belongs to and who owns it.
- Security
- Run a follow-up assessment to confirm earlier findings are closed. Owner: Isidore.
- Security
- Review written security policies and update them for the year's changes. Owner: Joint.
- Security
- Approve the updated security policies and the incident response plan. Owner: Client.
- Identity and access
- Evaluate phishing-resistant sign-in methods for administrators and finance staff. Owner: Joint.
- Endpoints and devices
- Plan next year's hardware refresh from warranty dates and device age. Owner: Isidore.
- Microsoft 365 and data
- Review license use and remove subscriptions the firm no longer needs. Owner: Isidore.
- Network and infrastructure
- Assess internet circuits and remote-site connectivity for capacity and redundancy. Owner: Isidore.
- Continuity and backup
- Update the recovery plan and repeat the restore test. Owner: Joint.
- Governance and budget
- Present the annual review and draft next year's roadmap and budget. Owner: Joint.
How to read it
How the roadmap is built and kept current.
Items are sequenced by risk and by dependency. Controls that reduce exposure quickly, such as multifactor authentication and endpoint detection and response, come first. Work that depends on a standard, such as conditional access or device management, follows once the baseline and the inventory exist. Larger changes to the network or data storage are scheduled after staff have absorbed the earlier ones.
Every item has an owner. Isidore marks work that our engineers perform. Client marks decisions and tasks that only the organization can complete, such as approving a policy or scheduling downtime. Joint marks work that needs both sides, such as a firewall replacement that depends on the firm's calendar and our engineering time.
The quarterly review covers items completed, items in progress, and items that slipped, along with new risks, vendor changes, and business plans such as a new office or an acquisition. The Director of Client Experience leads the review with firm leadership, and it ends with an updated roadmap and a written record of the decisions made.
The budget view groups the estimated cost of each item by quarter and by workstream, and separates recurring costs from one-time projects. It also flags renewals and hardware lifecycles. This sample omits amounts. In a real roadmap, leadership can see what each decision commits and what deferring an item means.
Items move between quarters for stated reasons: a dependency is not ready, a lead time changes, staff capacity is limited, or a new risk takes priority. Each move is recorded with the reason and its effect on the budget, so the plan stays accurate and nothing disappears without a decision.
Questions
What leaders ask about roadmaps.
What is the difference between a roadmap and a project list?
A project list records work in progress. A roadmap places work in a sequence tied to risk, dependencies, and budget, assigns an owner to each item, and is reviewed on a schedule. It answers why an item is planned for a given quarter and what changes if that item moves.
Who builds the roadmap, and from what?
The Director of Client Experience and the engineering team build it with your leadership, starting from an assessment of devices, accounts, security controls, and business priorities. Other inputs include contract renewals, hardware age, and planned changes such as a new office or an acquisition.
How often does the roadmap change?
The roadmap is reviewed every quarter and adjusted when priorities, risks, or the business change. Moves between quarters are recorded with a reason, so leadership can see what changed and why, instead of finding later that the plan quietly drifted away from the original.
Does the roadmap commit our organization to spending?
No. The roadmap lays out recommended work, the order, and its estimated budget effect. Leadership approves each project before it begins, and a deferred item stays on the roadmap with its risk noted, so the decision to defer is visible and can be revisited at the next review.
Can the roadmap include work our internal IT staff owns?
Yes. Each item has an owner, and internal staff can own items alongside The Isidore Group. A shared view helps coordinate dependencies, such as a firewall replacement that needs both internal scheduling and engineering time, and it shows leadership who is responsible for each piece of work.
Related reading
From a sample to your plan.
A roadmap for your organization starts with an assessment of devices, accounts, security controls, and business priorities, then a conversation with leadership about order and budget. The vCIO service carries that plan through quarterly reviews.
- vCIO and IT strategy
- Quarterly reviews, the roadmap, and the budget view, led by your Director of Client Experience. vCIO services.
- Cyber risk assessment
- Where a roadmap begins: findings ranked by business risk, with an owner for each. About the assessment.
- MSP switching checklist
- If a change of provider comes first, the handoff checklist keeps support, security, and access intact. Read the checklist.
Next step
Build a roadmap from your own environment.
If you would like a roadmap built from your own environment, we can begin with an assessment and a conversation about your priorities.
- No obligation.
- Prefer to talk? Call 844.884.8040.
Ready to make your technology work harder for your business?
Schedule a complimentary 30-minute conversation with our team.
The form is unavailable right now. Prefer to talk? Call 844.884.8040.