CIO Strategic Plan Template: Sections, Budget and Board Approval

Before you start: what you need in hand

This plan comes after the listening phase. If you are new in the role, the CIO first 100 days plan guide covers that work: meeting leaders, reading the budget and contracts, and finding quick wins. Before drafting, make sure you have three things.

If one of these is missing, fill the gap first. A plan written without them reads as IT's wish list.

• The CEO's priorities for the company, in their own words.
• The current IT budget, split between running services and paying for change.
• A short list of the risks you already know about.

The CIO strategic plan skeleton

Use these five sections in this order. Each one answers a question leadership will ask.

Keep the main document short. Put system lists, architecture and project detail in an appendix.

• 1. Outcomes. What will change for the business? List 3 to 5 outcomes, each with an owner, a starting value and a target. Example: "Month-end close completed faster. Owner: CFO."
• 2. Initiatives. What work delivers each outcome? One line per initiative, grouped by outcome, plus the one-page roadmap by quarter.
• 3. Budget. What does it cost and when? Show running costs and change costs separately, by year, in the format agreed with the CFO. Add the trade-off rules: what gets cut first, and how a new request is handled.
• 4. Risks. What could go wrong, and what happens if we do nothing? List the top risks with an owner and a response. Include security, reported with one framework.
• 5. Decisions requested. What do you need the board to approve today? Number each decision, give the options, and state your recommendation.

How to write an initiative line

Every initiative gets the same six fields. Leaders can then scan the plan quickly, and you can sort it by owner, quarter or budget line. Two examples to copy and adapt.

If you cannot name a business owner, the initiative probably belongs in the running costs, not in the strategic plan.

• Initiative: Single customer record across sales and service. Outcome: faster account handling for the sales team. Business owner: Chief Revenue Officer. IT owner: Head of Applications. Quarters: Q3 to Q6. Budget line: change, customer platforms. Milestone: sales and service teams use one record for all active accounts.
• Initiative: Tested recovery for core finance systems. Outcome: finance can close the month after a major outage. Business owner: CFO. IT owner: Head of Infrastructure. Quarters: Q2 to Q3. Budget line: change, resilience. Milestone: full recovery test passed with finance present.

Budget trade-offs: rules to agree with the CFO

Requests always outgrow the budget. Set the rules before that happens, and write them into the budget section.

• Rank by outcome. Initiatives follow the order of the outcomes the CEO confirmed.
• Show the cost of doing nothing. One sentence per initiative on the risk or the missed result if it is cut.
• One in, one out. A mid-year request replaces something of similar size, and the executive committee chooses what.
• Show running costs falling. When you retire a system, show the lower running cost in later years.
• Reserve only with CFO agreement. If you keep a small reserve, write who can use it and for what.

Security in the plan

The board will ask about security at almost every review. Pick one framework and keep it for the life of the plan. The NIST Cybersecurity Framework 2.0, released by NIST on February 26, 2024, has six functions: Govern, Identify, Protect, Detect, Respond and Recover.

Rate each function today, agree a target with the board, and report the same six ratings every quarter. Board members can then follow the trend without needing technical detail.

Taking the plan to the board

The board needs risks, outcomes and decisions, not project detail. Before you finish the plan, ask these questions through the chair or the committee that oversees technology.

• What technology risks worry you most today?
• Which decisions do you want to take yourselves, and which can the executive team take?
• How often do you want a technology update, and in what format?
• What would make you lose confidence in the plan?
• Which outcomes would you protect first if spending had to drop?
• Do you want security reported on its own or inside the overall plan?

Checklist before the board meeting

Go through this list a few days before the meeting. Every line should be true before the plan reaches the board.

• Each business head has seen the initiatives that affect them.
• The CFO has gone through every budget line with you.
• The CEO knows which decisions you will ask for.
• Each initiative has all six fields filled in.
• Each outcome has a starting value and a target.
• The top risks have an owner and a response.
• You know which initiatives you would cut first, and what each cut would cost.
• The roadmap fits on one page.
• The quarterly reporting format and dates are proposed.

After approval: decisions, funding and announcement

Approval is where the plan starts working. Most of the effort comes after the vote.

Record the decisions first. Write a one-page summary of what the board approved, deferred and refused, with the reasons. Send it to the executive committee and keep it with the plan. When someone asks later why an initiative was dropped, you have the answer.

Then release the funding. Agree with the CFO how money is released. A common choice is to fund year one in full and release later years at each annual refresh. Another is to fund large initiatives in stages, with each stage released when the previous milestone is met. Write down the rule for moving money between initiatives and who signs off.

Finally, announce the plan. Share the outcomes, the roadmap and the owners with the IT team and the business units. People should see which outcome their work serves.

The quarterly pack

Send it to the executive committee before each meeting. Five parts are enough.

Decisions go first because leaders read the beginning, and decisions are why the meeting exists.

• Decisions needed, each with options and your recommendation.
• The roadmap, with milestones done, at risk or late.
• Progress on each outcome against its target.
• Spending against plan, in the format agreed with the CFO.
• Security ratings against the previous quarter.

Refresh once a year

Every year, revisit the outcomes with the CEO, roll the roadmap forward, and agree the next year's funding with the CFO. Refresh earlier if the company's goals change.

For a longer company-wide horizon, the 3 year strategic plan guide shows how to set it out.