Skip to content
How to Build a 12-Month IT Roadmap and Budget Your CFO Can Actually Read

How to Build a 12-Month IT Roadmap and Budget Your CFO Can Actually Read

2026-10-30 · By the Yellow Coop Team

Most mid-market IT budgets are last year’s number plus a hopeful percentage, with surprises paid for out of “miscellaneous.” The takeaway: build your IT roadmap and budget in three buckets (keep the lights on, must-do changes, and growth bets), give every line an owner and a date, and fund the predictable surprises before they show up. One page, no jargon, and a CFO who stops wincing.

Why “last year plus 5%” fails

Keeping existing systems running quietly eats the budget. The U.S. Government Accountability Office (GAO) reported on July 17, 2025 that federal agencies have typically reported spending about 80 percent of more than $100 billion in annual IT and cyber-related spending on operations and maintenance of existing IT. For fiscal year 2025, about $83 billion (79 percent) of planned IT spending across the 24 Chief Financial Officers Act agencies was slated for operations and maintenance.

Your company isn’t a federal agency, and 80 percent isn’t a benchmark you should hit. It’s a warning about what happens when nobody separates “running” from “changing”: the running costs grow, and the change budget is whatever’s left.

Step 1: Inventory what you already pay for

You can’t plan spending you can’t see. List every system, license, and contract with:

  • Owner: the person who decides whether it renews.
  • Annual cost: total, and per user where it applies.
  • Renewal date and notice period: many contracts auto-renew unless you cancel by a deadline.
  • Seats bought vs. seats used.

That last column matters. In a January 29, 2024 report on federal software licenses, GAO identified two key activities for right-sizing: tracking licenses currently in use, and regularly comparing that inventory to purchase records. Doing so helps avoid over-purchasing (paying for seats nobody uses) and under-purchasing (which can trigger extra fees). Of nine agencies GAO reviewed, none had fully determined whether their five most widely used software licenses were over- or under-purchased. If big agencies struggle with this, it’s worth checking for empty seats in your own company.

Step 2: Sort spending into three buckets

Run (keep the lights on). Licenses, hosting, help desk or managed service provider fees, connectivity, routine hardware refresh. Goal: flat or shrinking per user.

Must-do (non-negotiable changes). Things with an external deadline: software reaching end of support, a customer’s security requirement, an insurance renewal condition, a contract expiring. These aren’t optional. Only the timing is.

Grow (bets). New systems, automation, AI projects. Each one needs a stated outcome, such as hours saved, revenue enabled, or risk removed, plus a point at which you’ll check whether it’s working.

Step 3: Price the predictable surprises

A lot of “unexpected” IT spending was announced years in advance. Software end-of-support dates are the classic example.

Microsoft ended support for Windows 10 on October 14, 2025. After that date, Windows 10 PCs keep working but stop getting security fixes unless they’re enrolled in Microsoft’s paid Extended Security Updates (ESU) program. For organizations, Microsoft lists ESU at $61 per device for Year One, with the price doubling each year for up to three years. It also says Year One started in November 2025, and that buying in Year Two means paying for Year One too.

Here’s what that looks like for 50 PCs:

ESU yearPrice per device50 devices
Year One$61$3,050
Year Two$122$6,100
Year Three$244$12,200
Three-year total$427$21,350

That table doesn’t settle whether to upgrade, replace, or pay for ESU. That depends on hardware age, upgrade eligibility, and labor. It shows why end-of-support dates belong in the Must-do bucket with real numbers, not in next year’s “miscellaneous.”

Step 4: Fund security on purpose

NIST’s Cybersecurity Framework 2.0 (February 26, 2024) includes a governance outcome, GV.RR-03, stating that “adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies.” In plain English: security spending should follow from the risks you’ve decided matter, not from whichever vendor called last.

Practically, give security its own lines in the Run and Must-do buckets so it doesn’t get cut quietly when a Grow project runs over.

Step 5: Put it on one page

Your CFO wants to see:

  1. Total spend, split into Run, Must-do, and Grow, compared with last year.
  2. The top 10 contracts by cost, with renewal dates.
  3. Quarter-by-quarter roadmap: each item with an owner, budget, and date.
  4. Risks of not funding each Must-do item, in a sentence each.
  5. Savings found from the license and contract review.

Then review it quarterly. A roadmap that’s never updated is just a wish list with formatting.

Common traps

  • Budgeting projects but not their running costs. A new system adds licenses and support to Run forever.
  • No notice-period calendar. Auto-renewals are how unused tools survive.
  • Grow items with no exit check. Decide up front what result means “keep going.”

Conclusion

A good IT budget isn’t a bigger number. It’s a clearer one. Separate running from changing, price the deadlines you already know about, and give every line an owner.

A 12-month IT roadmap and budget the CFO can read is one of the typical deliverables in Yellow Coop’s Operate work, alongside an IT spend baseline and a vendor renegotiation and consolidation plan. You can get it through Virtual advisory hours or a Fractional engagement of 1 to 4 days a week. Book a 20-minute call to see which fits.

Sources