Who Needs This
Most businesses arrive here because a decision is coming that nobody in the room feels equipped to make alone.
Deliverables
Seven documents, not a conversation. This is the part that turns “IT strategy” from an abstraction into something you can act on, budget for and hand to a board.
What exists today: users, devices, systems, licences, connectivity, suppliers, contracts, and your backup and security position. Most businesses have never seen this written down in one place.
Every issue found, each with its likelihood, its business impact, and the effort and cost to address it — ordered by priority rather than by how interesting it is technically.
A 12 to 24 month plan with every item scheduled, costed and justified — and separated into what is necessary, what is worthwhile and what is genuinely optional.
Expected capital and operating spend by period, in a form that goes straight into a business plan. IT stops being a series of surprises.
What is held with whom, at what cost, on what term, with what renewal or notice date. This is where most businesses find money they did not know they were spending.
The record most small businesses discover they never had — and the reason every subsequent change costs less than the last one.
The small set of written policies most businesses are expected to hold, and are increasingly asked to produce by customers and insurers.
Written so another provider could pick them up and act on them. If you take the roadmap elsewhere, it still works — a plan that only makes sense with us in the room would not be a plan.
The Review Cycle
The roadmap is revisited at an agreed cadence — progress tracked, priorities re-ordered, budget updated. A plan nobody revisits is a document, not a strategy. Seven standing items, so the meeting is never a vague catch-up.
What was delivered, what slipped, and honestly why.
New sites, headcount, acquisitions or a change of direction — any of which can re-order the priorities.
Recurring problems that point at an underlying cause worth fixing properly.
The register is updated, not rewritten — you can see what moved and what appeared.
What you hold, what is coming up for renewal, and what needs a decision before it becomes automatic.
Where spend has landed relative to the plan, and what that means for the next period.
Agreed in the meeting, with a name against each one — ours or yours.
The industry term is vCIO. We prefer to describe what actually turns up: a technical voice in the room a few times a year, with the documents to back it.
Commercials
A fixed price agreed before the work starts, with the scope, deliverables and exclusions written down. You get the seven documents and the presentation, and that is a complete engagement in itself.
No support agreement required, and no requirement to leave your current provider.
The roadmap kept live, with reviews at an agreed cadence — quarterly for most businesses. Typically taken alongside a support agreement, because the review draws on service data.
Strategy work is quoted as its own line rather than assumed inside a support fee, so you can see exactly what you are paying for.
No prices are published on this site. Strategy work is quoted for your actual environment after the first conversation, because the effort depends on how much of the current state already exists in writing.
Expectations
Stated plainly, because an engagement that was mis-sold at the outset never recovers.
The roadmap is not a sales exercise that happens to recommend everything we sell. Where the right answer is to keep what you have, or to buy from someone else, the plan says so.
An assessment supports readiness for a scheme. It does not confer certification, compliance or insurability, and we are not an accredited assessor or certification body.
We advise; you decide. You know your customers, your margins and your appetite for risk better than we do, and the plan is built to be argued with.
A roadmap left unreviewed for two years is a historical document. It needs revisiting as the business changes — which is the entire point of the review cycle.
Assurance Context
Increasingly, the pressure to have a plan comes from outside the business.
A gap analysis against the scheme's current requirements, and the remediation needed to be ready for assessment — including where Cyber Essentials Plus raises the bar. We prepare you; we do not certify you.
Insurer questionnaires have become specific, and they are often answered inaccurately in good faith. The assessment gives you evidence for the answers rather than a hopeful guess — which matters at claim time.
A documented environment and a live risk register turn a two-week scramble into an afternoon. For some businesses this alone justifies the engagement.
Where IT decisions affect them — where data lives, who can reach it, how long it is kept and how it is recovered. We are not lawyers, and we will tell you when a question needs one.
This page names no scheme thresholds, control counts or requirement specifics, because they change. The current position is confirmed in writing at the time of the engagement.
Next Step
Not a sales meeting and not the assessment itself — a discussion about where the business is going and whether a formal assessment would actually help. Sometimes it would not, and we will say so.
Four fields. We reply within one working day.
Related
The parent pillar — assessments, migrations and remediation delivered against a written statement of work.
Learn MoreWhere the roadmap gets delivered, and where the service data that feeds each review comes from.
Learn MoreUsually the largest single item on an SME roadmap — reviewed, secured and supported.
Learn MoreIncluding an audit and support roadmap that replaced a reactive incumbent.
Read Them