Many IT strategies are lists of projects rather than strategies. They describe what the IT function intends to buy or build, but not which business outcomes those investments serve, which risks they reduce or in what order they should happen. European regulation has made this gap harder to sustain. NIS2 and DORA place accountability for cybersecurity and ICT risk on management bodies, so technology direction must now be understood and approved at board level. The answer is an IT strategy roadmap: a sequenced plan that links business objectives, capability gaps, risk and investment, and that management can own.
Why many IT strategies fail to guide decisions
Strategies that do not influence decisions tend to share the same weaknesses:
- No link to business objectives. Initiatives are justified by technology trends rather than by measurable business outcomes.
- No prioritisation. Every initiative is presented as essential, so budget is spread thinly and little is completed.
- Risk treated separately. Security, resilience and compliance are handled as parallel programmes rather than as constraints and drivers of the same plan.
- A static document. The strategy is written once, approved and not revisited as the business, the market or the regulatory landscape changes.
Regulation has moved IT strategy into the boardroom
Two EU frameworks now make management bodies directly responsible for decisions that were previously delegated to IT.
NIS2. Under Article 20 of Directive (EU) 2022/2555, the management bodies of essential and important entities must approve the cybersecurity risk-management measures their organisation takes and oversee their implementation. They can be held liable for infringements. Members of management bodies are also required to follow training, so that they can identify risks and assess risk-management practices.
DORA. Regulation (EU) 2022/2554 has applied to financial entities since 17 January 2025. It places responsibility for the ICT risk-management framework on the management body. The framework must include a digital operational resilience strategy that sets out how ICT risk is managed in support of the business strategy and objectives.
The practical consequence is that an IT strategy can no longer be a technical document reviewed only by the CIO. Boards must be able to read it, challenge it and demonstrate that they have approved the risk decisions it contains. CloudOptly’s NIS2, DORA and EU AI Act compliance advisory addresses these obligations in detail.
Five steps to an IT strategy roadmap
1. Anchor the strategy in business objectives
Start with the three to five business objectives that matter most over the next three years, such as growth in a new market, lower cost to serve, faster product delivery or regulatory approval for a new service. Each technology initiative in the roadmap should trace back to at least one of them.
2. Assess the current state honestly
Document the application portfolio, infrastructure and cloud footprint, data landscape, security posture, supplier dependencies, skills and total cost of IT. Identify technical debt, single points of failure and services that support critical functions. This assessment also provides much of the evidence that NIS2 and DORA supervisors expect to see.
3. Define target capabilities and principles
Describe the capabilities the organisation needs rather than the products it intends to buy, for example a governed data platform, automated IT operations, resilient identity and access management or an AI strategy and governance framework. Agree architectural principles that guide later decisions, covering cloud adoption, data residency and sovereignty, build or buy, and security by design.
4. Prioritise and sequence
Score each initiative on business value, risk reduction, regulatory necessity, cost and dependencies. Sequence them across three horizons: foundations and mandatory remediation in the first twelve months, capability building in the second year, and differentiation thereafter. Regulatory deadlines and dependencies, such as identity or data foundations that other initiatives require, determine much of the order.
5. Establish governance and measurement
Assign an accountable owner to each initiative, define measurable outcomes and review progress quarterly with the management body. Report on a small set of indicators, such as delivery against plan, IT cost as a share of revenue, service availability, risk exposure and audit findings. Board members who must approve these decisions benefit from structured technology and cybersecurity training for executives, which NIS2 makes mandatory for management bodies in scope.
What a board-ready roadmap contains
- A one-page summary linking business objectives to technology initiatives.
- A sequenced plan across three horizons, with costs and dependencies.
- The principal ICT and cybersecurity risks, with the decisions taken to accept, reduce or transfer them.
- Critical suppliers and the exit or contingency arrangements for each.
- Governance arrangements, indicators and the review schedule.
Common pitfalls
Three errors recur. The first is treating compliance as a separate programme, which duplicates effort and produces controls that do not fit operations. The second is planning in too much detail beyond the first year, which creates false precision; later horizons should state intent and decision points rather than fixed scope. The third is omitting the operating model: a roadmap that ignores skills, sourcing and organisational change rarely survives its first budget cycle.
Conclusion
An effective IT strategy roadmap connects technology investment to business outcomes, makes risk decisions explicit and gives management a plan it can own. Under NIS2 and DORA, that ownership is no longer optional. Organisations that build the roadmap and the regulatory evidence together avoid duplicate effort and give their boards a basis for informed decisions.
CloudOptly provides independent IT strategy and technology advisory for executives in Sweden, the Nordics and across the EU. Request an executive briefing to review the current IT strategy against business objectives and regulatory obligations.
This article provides general information and does not constitute legal advice.