Most South Australian small businesses, not-for-profits and councils don’t have an IT strategy document. They have a list of things that are overdue: a server that is out of warranty, laptops still being patched by hand, a website nobody wants to touch, a Microsoft 365 renewal coming up and a growing number of staff asking about AI tools. An IT strategy doesn’t need to be a 60-page report. For most organisations it is a short, honest picture of where things stand and a 12-month roadmap that says what will change, in what order, who owns it and what it depends on. This guide sets out a practical way to build one. It is general guidance; adapt it to your size, sector and obligations.
What an IT strategy and roadmap is for
A good roadmap turns scattered IT decisions into planned ones. It helps you:
- Replace things before they fail, instead of after, by knowing when hardware, software and contracts reach end of support or renewal.
- Explain IT spending to a board, owner or council as a set of outcomes and risks rather than a list of products.
- Answer outside questions consistently, such as cyber insurance questionnaires, government supplier security schedules and audit findings.
- Give suppliers a clear brief, so quotes are comparable and you are not redesigning the plan every time a vendor visits.
Step 1: start from what the organisation is trying to do
Begin with the next one to three years of the business or council plan, not with technology. Write down the handful of things the organisation has said it will do: grow into a new service, open a second site, move more customer requests online, reduce paperwork, meet a new compliance obligation or win government work. For SA councils, the Local Government Act 1999 already requires strategic management plans, including a long-term financial plan and infrastructure and asset management plans, so the IT roadmap should line up with those documents and their review cycle rather than sit beside them. For each goal, note what it needs from IT: a system, a process change, better data, a skill or simply reliable basics.
Step 2: take stock of what you have
You can’t plan replacements without a list. A one-page register is enough to start:
- Devices and infrastructure: laptops, desktops, phones, servers, firewalls, Wi-Fi and printers, with age, owner and support end date. Our patch and vulnerability management guide explains how to keep this register current.
- Software and subscriptions: Microsoft 365 or Google Workspace plans, line-of-business systems, finance, payroll, CRM, website and hosting, with renewal dates, contract terms and who administers each one.
- Accounts and ownership: who holds the domain, DNS, admin and billing accounts. Our domain, DNS and admin account checklist covers this.
- Data: where important and sensitive information lives, how it is backed up and when a restore was last tested.
- People and suppliers: who supports what, what is written down and what lives only in one person’s head.
Step 3: assess the gaps honestly
Score each area simply, for example as working well, needs attention or at risk, and write one sentence on why. Useful lenses:
- Security: how you compare with the ACSC Essential Eight, MFA coverage, patching, backups and admin access. If you supply SA Government, also consider the South Australian Cyber Security Framework (SACSF) expectations in agency contracts. See our Essential Eight guide.
- Reliability: what would stop work for a day, such as a single internet connection, an ageing server or one person who knows the passwords.
- Fit: where staff work around systems with spreadsheets, paper or re-keying.
- Compliance: privacy obligations, records management, accessibility of public websites and any industry rules that apply to you.
- Cost and value: unused licences, overlapping tools and contracts that renew automatically. Our Microsoft 365 licence review guide is a good first check.
Step 4: choose and order the initiatives
Turn the gaps into a short list of initiatives, each with a one-line outcome (for example “all staff laptops managed and encrypted” rather than “deploy Intune”). Then put them in order using four questions:
- Is there a hard date? End of support, contract expiry, an insurance renewal or a legal change goes first.
- What is the risk if we wait? Security basics such as MFA, patching and tested backups usually rank above new features.
- What does it depend on? Identity and device management often need to come before a cloud move, and clean, well-labelled data before an AI assistant.
- What can the team absorb? Staff can only take on so much change at once; spread disruptive projects across the year and avoid your busiest periods.
Step 5: lay out a 12-month roadmap
Keep it to one page, grouped by quarter. A typical pattern for a small organisation looks like this:
| Quarter | Focus | Typical initiatives |
|---|---|---|
| Q1 | Secure the basics | MFA for every account, admin account clean-up, backup and restore test, asset and software register, Microsoft 365 security baseline. |
| Q2 | Replace what is at risk | Out-of-support devices and network equipment, device management for laptops and phones, licence right-sizing at renewal. |
| Q3 | Modernise one area | A file server to SharePoint move, a cloud migration of one server or application, or a website rebuild, chosen from the business goals. |
| Q4 | Improve how work gets done | Online forms and workflows, reporting dashboards, a governed AI pilot, then review progress and draft next year’s roadmap. |
Your order will differ; the point is that each quarter has a clear theme and a small number of initiatives. Larger moves such as a cloud migration or a move from a file server to SharePoint have their own planning guides.
Step 6: plan the money without surprises
For each initiative, record whether it is a one-off project cost or an ongoing cost (subscriptions, support, renewals), and when the money is needed. Ask suppliers for written, itemised quotes against the same brief so you can compare like with like; our project brief and quotes guide explains how. Leave room in the year for unplanned failures and urgent security fixes so they don’t push the whole plan back.
Where AI fits
Treat AI as one initiative in the roadmap, not a separate strategy. Before rolling out tools such as Microsoft 365 Copilot or a customer chatbot, make sure the basics are in place: an acceptable use policy, sensible sharing permissions and labelled sensitive information, and a named owner. Start with one or two well-defined uses and measure whether they actually save time.
Keep it alive: governance and review
- Name an owner for the roadmap, even in a small business, and an owner for each initiative.
- Review quarterly in a short meeting: what was done, what slipped and why, and whether priorities have changed.
- Report simply: a one-page status with each initiative marked on track, at risk or done, plus the top three risks.
- Refresh annually alongside the business plan or, for councils, the strategic management plan review.
Questions to ask your IT provider
- Can you give us a register of our devices, software and contracts with support and renewal dates?
- Which three risks would you fix first, and why?
- What does each initiative depend on, and what would happen if we delayed it by six months?
- Which costs are one-off and which are ongoing?
- How will you report progress, and how often will we review the plan together?
Our guide to choosing a managed IT provider covers what to expect from ongoing advice and vendor management.
Talk to an Adelaide team
EITSAA provides managed IT, cyber security and technology advice for SA small businesses, not-for-profits and councils. We can run a short IT review that produces an asset and risk register and a prioritised 12-month roadmap you can use with any supplier. Get a quote for an IT review and roadmap or call 0402 401 584, Monday to Friday, 9am to 5:30pm. Learn more about our managed IT and cyber security, DevOps and cloud engineering and training and consultations services.