vCIO Technology Roadmap Review Checklist Template

Phase 1: Prepare & Interview

Start eight to ten weeks before the client’s budget is set. A roadmap that arrives after the budget is fixed waits a year.

• Open the annual review — client, fiscal year start date, budget deadline, and the vCIO and account manager for the account
• Pull last year’s roadmap — approved, completed, deferred and declined items, and the decision records from the last four QBRs
• Book the strategy interview — with the owner, managing director or finance lead, at least six weeks before the budget deadline
• Run the business strategy interview — growth and hiring plans, new sites or services, systems being replaced, and what worries the leadership team
• Record compliance and insurance obligations — frameworks, customer contracts and cyber insurance renewals that fall due in the next 12 months

Phase 2: Current State & Lifecycle

• Export the asset inventory — devices from the RMM and the documentation platform, with purchase date, warranty expiry and operating system
• Flag end-of-support software — operating systems, server versions, Office editions and line-of-business applications whose support ends within 36 months
• Review hardware age — devices already past the client’s refresh cycle, and those that will pass it during the plan
• Review licences and subscriptions — Microsoft 365 plans, line-of-business renewals and any SaaS the business pays for outside IT
• Review open risks — findings from the latest security risk assessment, and accepted risks that are due for another look

Phase 3: Standards Alignment

• Score the client against your technology standards — each standard aligned, partly aligned or misaligned, with evidence
• Identify gaps that carry business risk — not every misalignment is worth fixing this year, so note why each one matters
• Record agreed exceptions — standards the client has deliberately declined, with the reason and the date of the decision
• Group gaps into candidate projects — one project per business outcome, not one line per device

Phase 4: Compliance & Insurance Requirements

Shown only when a compliance assessment or cyber insurance renewal falls in the plan year. Conditional logic keeps it out of the other reviews.

• Confirm the requirement and deadline — the framework or insurer, the current version of its requirements and the assessment or renewal date
• Compare current controls with the requirement — the gaps that would fail an assessment or answer an insurer’s question badly
• Add mandatory items to the roadmap — marked as required, with the deadline that drives each one
• Schedule the evidence work — assessment preparation or the insurance questionnaire, booked with time to fix what it finds

Phase 5: Build the Roadmap & Budget

The vCIO owns this phase. The internal pricing approval halts the review until someone other than the author has checked the numbers.

• Draft the 12–36 month roadmap — projects by quarter in three horizons: this budget year, next year and year three
• Estimate each project — one-off cost, the change in recurring cost and internal labour, with assumptions written down
• Align the budget to the client’s fiscal year — quarters labelled by the client’s financial year, not the calendar year
• Approve the roadmap pricing internally — the service manager or owner checks costs, margin and resourcing before the client sees a number
• Write the executive summary — one page with the three priorities, the total budget by year and the risk of doing nothing

Phase 6: Present & Record Decisions

• Present the roadmap to the decision-maker — business goals first, then projects, budget and the end-of-support dates that drive them
• Record a decision on every project — approved, deferred to a named quarter or declined, with the client’s name and the date
• Record declined items as accepted risks — with the reason the client gave, so they can be raised again if circumstances change
• Send the decision record — the roadmap as approved, within two working days of the meeting