The short answer
A useful roadmap answers five questions: where is the business going, what do we have today, what must change and why, in what order at what cost and with whom, and how will we know it works? It covers 12 to 36 months (year one in detail, later years broadly) and is a management document, not a technical inventory.
1. Business goals and constraints
Start with the plans, in business language:
- Growth targets
- New sites
- Remote work plans
- New products, services or channels
- Nigeria Data Protection Act 2023 obligations
- Security questionnaires from larger customers
- Budget cycles
- Busy seasons
- Staff capacity
- Power and connectivity at each site
Every initiative should trace back to at least one of these, or to a risk that threatens them.
2. Current state
Factual and brief, with detail in appendices. Cover eight areas:
- Devices
- Infrastructure, failover and power backup
- Business applications
- Productivity and identity
- Security
- Data and backup
- Contracts and licences
- People and support
What to capture in each area
| Area | What to capture |
|---|---|
| Devices | Count, age, operating system, management and security status |
| Infrastructure | Servers, network, internet connections and failover, power backup (UPS, inverter, generator), cloud services |
| Business applications | ERP, CRM, line-of-business systems, integrations, owner of each |
| Productivity and identity | Microsoft 365 or Google Workspace, licences, MFA coverage |
| Security | Current controls against a recognised baseline |
| Data and backup | Where critical data lives, backup coverage, last restore test |
| Contracts and licences | Renewal dates, notice periods, costs |
| People and support | Internal IT capacity, providers, service levels |
3. Lifecycle dates
Many items are forced by dates: list warranty expiry, software end of support, contract, certificate and domain renewals. Windows 10 Home and Pro reached end of support on 14 October 2025 (Microsoft Learn), so any device still running it is a priority.
4. Security gaps
Measure against a recognised framework so priorities are defensible.
| Framework | Suits | Covers |
|---|---|---|
| Baseline controls | Small and medium organisations | Incident response planning, automatic patching, security software, strong authentication, awareness training, backup and encryption, cloud and outsourced IT, access control |
| NIST Cybersecurity Framework | Many larger and regulated organisations | A broader structure |
For Nigerian organisations, ngCERT advisories and incident guidance can inform the baseline list. Record each gap, its risk in plain language and the initiative that closes it.
5. Prioritised initiatives
Score initiatives on business value, risk reduction, urgency (including forced dates), cost and effort, then group:
Must do now
Unsupported systems, missing MFA or backups, expiring contracts.
Next
Initiatives that unlock business goals, such as an ERP upgrade or system integration.
Later
Valuable improvements that are not time-sensitive.
Record each with a name and outcome, business reason, owner, timing and dependencies, estimated cost and a measure of success.
Example initiative record
| Field | Example |
|---|---|
| Name and outcome | "Replace unsupported laptops; all devices on a supported OS" |
| Business reason | Security risk; client security questionnaire |
| Owner | Operations manager (business), IT provider (delivery) |
| Timing | Quarter and dependencies |
| Estimated cost | One-time and ongoing, as estimates in naira (or US dollars where a licence or service is priced in dollars) |
| Measure of success | All devices compliant in the management console |
6. Budget and governance
Budget: estimates by quarter and type (one-time projects, recurring subscriptions and services, hardware cycles), as ranges, flagging those awaiting quotes. Finance should recognise the numbers and timing.
One owner
One person accountable for the roadmap as a whole.
Quarterly review
Progress, risks and new information.
Annual refresh
Aligned with budgeting.
Change rule
New requests are scored the same way and sequenced, not added on top.
A hypothetical 60-person distributor needs a second warehouse and must meet a large customer's security requirements. It finds unsupported Windows laptops, MFA on email only, untested backups and orders re-keyed between web store and accounting. Year one, each step with owner, estimate and measure:
- Quarter 1MFA and device replacement.
- Quarter 2Backup redesign and a restore test.
- Quarter 3Network and systems for the new warehouse.
- Quarter 4Web store and ERP integration.
Roadmap template checklist
Direction
- Business goals and constraints for the next 12 to 36 months
- Regulatory and client requirements listed
Current state
- Devices, infrastructure, applications and contracts summarised
- Lifecycle and renewal dates listed
- Security measured against a recognised baseline
Plan
- Initiatives scored and grouped (now, next, later)
- Each initiative has an owner, timing, estimate and success measure
- Budget view by quarter agreed with finance
Governance
- Roadmap owner named
- Quarterly review scheduled
- Rule for handling new requests agreed
Limitations
A roadmap is only as good as its information and review discipline, and it will change with the business; that is expected. Our IT consulting and advisory service includes building or reviewing one. To keep technology and business priorities connected, see five elements that align IT with the business.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Nigeria's national computer emergency response team, ngCERT
- Cybersecurity Framework, National Institute of Standards and Technology
- Windows 10 Home and Pro lifecycle, Microsoft Learn
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.