IT Strategic Plan and Roadmap (CGEIT - Governance of Enterprise IT)
Introduction
The IT Strategic Plan and Roadmap is one of the most important concepts in the CGEIT (Certified in the Governance of Enterprise IT) body of knowledge. It sits within the Governance of Enterprise IT domain and connects to Strategic Management, Benefits Realization, Risk Optimization and Resource Optimization. This guide explains what an IT strategic plan and roadmap are, why they matter, how they are built and maintained, and how to answer exam questions on the topic.
1. Why the IT Strategic Plan and Roadmap Is Important
Organizations invest heavily in technology. Without a clear plan, that spending tends to be fragmented and reactive, and it often fails to support business goals. A well-governed IT strategic plan and roadmap matter for these reasons:
Strategic alignment: The plan ensures IT investments directly support enterprise goals. This is the core of governance, linking stakeholder needs to enterprise goals, alignment goals (IT-related goals) and enablers, as shown in the COBIT goals cascade.
Value creation: The plan directs scarce resources toward initiatives that deliver the greatest business value. This supports benefits realization and optimal investment decisions.
Risk optimization: A strategic view lets the enterprise anticipate technology risks, regulatory changes and obsolescence. These can then be built into planning instead of handled as surprises.
Resource optimization: The plan guides decisions on people, infrastructure, applications, information and sourcing (insource, outsource, cloud) over time.
Accountability and transparency: The board and executive management get a basis for direction, evaluation and monitoring (the EDM model from ISO/IEC 38500 and COBIT).
Communication: The roadmap shows business and IT stakeholders what will be delivered, when and why. This builds commitment and manages expectations.
Agility: A living plan with a defined review cycle lets the enterprise respond to market disruption, new technologies and changing priorities in a controlled way.
2. What Is an IT Strategic Plan and Roadmap?
IT Strategic Plan: A formal document that describes how IT will contribute to the enterprise's strategic objectives over a defined horizon, usually 3 to 5 years. It covers:
- The business strategy and drivers that IT must support
- The IT vision, mission and guiding principles
- The current state (baseline) of IT capabilities, architecture, services and resources
- The target state (future vision) of IT
- Gap analysis between current and target states
- Strategic initiatives and programs that close the gaps
- Investment requirements, funding approach and business cases
- Risks, constraints, dependencies and assumptions
- Key performance indicators (KPIs) and key goal indicators to measure success
- Governance arrangements for oversight and decision rights
IT Roadmap: The time-sequenced, actionable view of how the strategy will be executed. It translates strategic initiatives into a sequenced set of programs and projects with milestones, dependencies and resource needs. Roadmaps are often shown visually in phases, waves or timelines and are updated as conditions change.
Relationship between the two: The strategic plan answers WHY and WHAT. The roadmap answers HOW and WHEN. Below them sit the tactical plans, which run 1 to 2 years and include annual operating plans, budgets and project portfolios.
Hierarchy of planning:
Enterprise Strategy → IT Strategic Plan (long-term) → IT Roadmap (sequenced initiatives) → IT Tactical Plans (annual/medium-term) → Projects and Operations
3. How the IT Strategic Plan and Roadmap Works
Step 1: Understand the enterprise context and strategy
The process starts with the business, not technology. Key inputs include:
- Enterprise mission, vision and strategic objectives
- Stakeholder needs and drivers
- Market, competitive, regulatory and technology trends
- Risk appetite
Common tools for this step are SWOT analysis, PESTLE analysis and stakeholder interviews.
Step 2: Assess the current state
Evaluate existing IT capabilities, services, architecture, maturity levels, performance, skills, sourcing arrangements and costs. Typical methods are capability maturity assessments (for example, COBIT capability levels), application portfolio analysis and benchmarking.
Step 3: Define the target state
Use enterprise architecture (for example, TOGAF) to describe the future business, data, application and technology architectures needed to support the business strategy.
Step 4: Perform gap analysis
Identify differences between the current and target states in capabilities, processes, technology, skills and governance.
Step 5: Define and prioritize initiatives
Translate gaps into programs and projects. Prioritize them based on:
- Strategic alignment
- Business value and benefits
- Risk (both the risk of doing and the risk of not doing)
- Cost and resource availability
- Dependencies and sequencing
- Quick wins versus long-term transformation
Portfolio management techniques (for example, Val IT, COBIT APO05) are used to optimize the investment mix.
Step 6: Build the roadmap
Sequence the initiatives across the planning horizon, considering dependencies, capacity, funding cycles and change absorption capacity.
Step 7: Obtain approval and commitment
The plan must be reviewed and approved through governance structures such as the IT strategy committee (board level), IT steering committee (executive level) and executive management. Business ownership is essential.
Step 8: Communicate
Share the strategy and roadmap with stakeholders so everyone understands their roles and the expected outcomes.
Step 9: Execute, monitor and measure
Track progress using balanced scorecards (including the IT Balanced Scorecard), KPIs, benefits tracking and portfolio reviews. Report to the board and steering committees.
Step 10: Review and update regularly
The plan is a living document. Review it at least annually, or when significant business or environmental changes occur. Adjust the roadmap as priorities shift.
Key governance roles:
- Board of Directors / IT Strategy Committee: Sets direction, ensures alignment, approves strategy and oversees major investments and risk
- Executive Management / CEO: Ensures the IT strategy supports the enterprise strategy and provides resources
- IT Steering Committee: Prioritizes and oversees programs and projects, and monitors execution
- CIO: Leads development of the IT strategic plan in partnership with the business
- Business Unit Leaders: Define requirements, own benefits and co-own initiatives
- Enterprise Architect: Defines target architecture and ensures coherence
Relevant frameworks and processes:
- COBIT 2019: APO02 (Managed Strategy), APO03 (Managed Enterprise Architecture), APO05 (Managed Portfolio), APO06 (Managed Budget and Costs), EDM01 (Ensured Governance Framework Setting and Maintenance), EDM02 (Ensured Benefits Delivery)
- COBIT Goals Cascade: Stakeholder drivers and needs → Enterprise goals → Alignment goals → Governance and management objectives
- ISO/IEC 38500: Evaluate, Direct, Monitor principles
- TOGAF: Architecture Development Method for target-state definition
- IT Balanced Scorecard: Measures performance across Corporate Contribution, Customer Orientation, Operational Excellence and Future Orientation
- Val IT: Value governance, portfolio management and investment management
4. Common Challenges and Success Factors
Challenges:
- IT strategy developed in isolation from the business
- Lack of executive sponsorship
- Plans that are too technical or too vague
- Failure to update the plan as conditions change
- No measurable outcomes or benefits tracking
- Unrealistic sequencing that ignores capacity and dependencies
Critical success factors:
- Strong business involvement and ownership
- Board and executive commitment
- Clear linkage to enterprise goals
- Realistic, prioritized and funded initiatives
- Defined metrics and regular monitoring
- Effective communication and change management
- Integration with enterprise architecture and portfolio management
5. Exam Tips: Answering Questions on IT Strategic Plan and Roadmap
Tip 1: Think like a governance professional, not a technician. CGEIT questions favor answers that reflect board and executive perspectives. Choose answers about alignment, value, risk and accountability over technical implementation details.
Tip 2: Business strategy always comes first. If asked what should be done FIRST when developing an IT strategic plan, the answer is almost always to understand the enterprise strategy, objectives and stakeholder needs. IT strategy is derived from business strategy, never the other way around.
Tip 3: Alignment is the primary goal. When a question asks for the MOST important objective or benefit of the IT strategic plan, look for strategic alignment between IT and the business, or value delivery to the enterprise.
Tip 4: Know who approves and who owns. Know who is responsible for each part of the plan:
- Final approval and oversight usually rest with the board or IT strategy committee.
- Prioritization of projects is a function of the IT steering committee.
- The CIO leads development.
- The business owns the benefits.
Watch for distractors that assign strategic approval to IT management alone.
Tip 5: Watch for keywords MOST, BEST, FIRST and PRIMARY. Several answers may be correct, but only one is the best from a governance view. Eliminate options that are too narrow, too operational or reactive.
Tip 6: Gap analysis links the current and target states. Questions about how initiatives are identified often point to gap analysis between the current state and the desired future state, which is informed by enterprise architecture.
Tip 7: The plan is a living document. Answers stating that the plan should be reviewed periodically and whenever significant business changes occur are usually correct. Be wary of options suggesting the plan is fixed for its entire horizon.
Tip 8: Prioritization is based on value and risk. When asked how to prioritize roadmap initiatives, choose criteria such as strategic alignment, business value, risk and resource constraints. Avoid technology preference, vendor recommendations or which department shouts loudest.
Tip 9: Measurement matters. If a question asks how to determine whether the IT strategy is successful, look for KPIs tied to enterprise goals, balanced scorecards and benefits realization tracking. Choose these over purely technical metrics such as uptime.
Tip 10: Stakeholder involvement is key. Questions describing failed strategies often trace the root cause to lack of business involvement, lack of executive sponsorship or poor communication.
Tip 11: Distinguish strategic, tactical and operational. Know the difference between the three levels:
- Strategic plans: long-term, direction-setting
- Tactical plans and roadmaps: medium-term, sequenced initiatives
- Operational plans: day-to-day activities
Pick the answer that matches the level the question addresses.
Tip 12: Link to the COBIT goals cascade. If a question asks how to translate stakeholder needs into IT goals, the goals cascade is the expected mechanism.
Tip 13: Consider the root cause. For scenario questions where IT projects fail to deliver value, the underlying issue is often the absence of an aligned IT strategic plan or poor portfolio governance, not the project management technique.
Tip 14: Avoid extremes. Answers that recommend cancelling all projects, outsourcing everything or adopting a technology immediately are rarely correct. CGEIT favors balanced, risk-informed and value-driven decisions.
6. Sample Exam-Style Questions and Reasoning
Example 1: Which of the following should be the FIRST step in developing an IT strategic plan?
A. Assess current IT infrastructure
B. Understand the enterprise's business strategy and objectives
C. Identify emerging technologies
D. Develop the IT budget
Answer: B. IT strategy must be derived from business strategy. Assessing the current state comes after understanding the business direction.
Example 2: The PRIMARY purpose of an IT roadmap is to:
A. Document technical standards
B. Show the sequence and timing of initiatives needed to achieve the target state
C. Define IT operational procedures
D. List vendor contracts
Answer: B. The roadmap translates strategy into a sequenced, time-bound execution plan.
Example 3: An enterprise's IT strategic plan was approved three years ago. Since then the company has entered two new markets. What should the governance body do FIRST?
A. Continue executing the current roadmap
B. Review and update the IT strategic plan to reflect the changed business strategy
C. Increase the IT budget
D. Hire additional IT staff
Answer: B. The plan must be kept aligned with the current business strategy.
Example 4: Which of the following BEST ensures that IT initiatives on the roadmap deliver business value?
A. Using agile development methods
B. Requiring business cases with defined benefits and assigning business ownership of benefits realization
C. Selecting leading-edge technologies
D. Increasing project management staff
Answer: B. Value delivery requires business cases, benefit ownership and tracking.
7. Key Takeaways
- The IT strategic plan defines how IT will enable enterprise objectives. The roadmap sequences the initiatives that make it happen.
- Business strategy drives IT strategy.
- Development involves current-state assessment, target-state definition, gap analysis, prioritization, roadmapping, approval, communication, execution, monitoring and review.
- Governance bodies (board, IT strategy committee, steering committee) provide direction, approval and oversight.
- Success depends on business ownership, executive sponsorship, measurable outcomes and regular updates.
- In the exam, choose answers reflecting alignment, value, risk optimization, accountability and a business-first perspective.
Master this topic by thinking from the boardroom's perspective. Always ask how a decision aligns IT with enterprise goals and optimizes value and risk.
