Your technology roadmap should have dates and numbers on it
A technology roadmap earns its name when every line carries a date, an owner, a cost and a count. Most of those dates are already published by someone else. Microsoft's lifecycle table gives Windows Server 2016 an extended end date of 1/13/2027, and your provider does not get to move it.
- A roadmap line with no date cannot be late, so nobody has to deliver it. Modernize the server estate is a theme. January 13, 2027 is a commitment.
- Most roadmap dates are facts published by third parties. Vendor lifecycle tables, hardware last-day-of-support rules and certificate lifetime schedules all set dates before your provider opens a slide.
- Deferral has a published price. Microsoft charges 61 dollars per device for the first year of Windows 10 extended security updates, the price doubles every consecutive year, and the years are cumulative.
- A roadmap with no budget column is a wish list with dates on it. The federal government spent about 80 percent of a 90 billion dollar IT budget just keeping existing systems running.
- Every row needs four fields. An owner, a date, a cost and a count of the devices or seats it touches. The count is the one nobody volunteers.
What should a technology roadmap include?
A technology roadmap should include one row per decision, and every row carries five fields. The work, the date, the owner, the money, and the count of things it touches. A row missing any of those is a theme, and a theme has no date, so nothing about it can ever be late.
Most roadmaps fail that test on sight. A provider presents a slide once a year reading modernize the server estate, strengthen security, improve resilience. Nobody can tell you in March whether any of it is overdue, because none of it was ever dated. That is not a communication problem. It is the difference between a plan and a mood board.
Here is the part almost nobody says out loud. You do not have to invent the dates, and neither does your provider. Vendors publish them. Microsoft's lifecycle table gives Windows Server 2016 an extended end date of 1/13/2027. Cisco commits to five years of TAC support for hardware from the EOS date. The certificate authorities have already scheduled the maximum life of a TLS certificate down to 100 days from 15 March 2027. Nobody can forecast those away, and nobody needs to guess them.
This post is about the document, not the meeting. The quarterly business review that is really a sales meeting covers the meeting itself. What follows is what that meeting should hand you on paper, and how to tell in sixty seconds whether you are holding a plan.
Which dates on a roadmap are facts rather than opinions?
Four kinds of date on a roadmap are facts, because somebody outside your business published them first. Vendor end-of-support dates, hardware last-day-of-support dates, certificate expiry dates, and contract or domain renewal dates. Every other date on the page is an estimate until money is attached to it.
Vendor end-of-support dates
To find a real end-of-support date, open the vendor lifecycle page instead of asking your provider. Microsoft publishes one page per product with a start date, a mainstream end date and an extended end date, and prints the time of day beside each one. Windows Server 2016 carries an extended end date of 1/13/2027, read from that table on 22 October 2026. That is not a last-minute warning. You get years, in a table, with a timestamp. So schedule the replacement against it and put the row in the budget cycle that reaches that date.
What actually happens to an unsupported system is covered in our guide to end-of-life software risk, so the short version here is the money. Microsoft sells extended security updates for Windows 10 at $61 USD per device for Year One, and states that the price doubles every consecutive year, for a maximum of three years. It also closes the obvious escape route. Year One starts in November 2025, and if you buy in Year Two you have to pay for Year One too, as ESUs are cumulative. You can replace the machines, migrate the users, or pay. There is no fourth option and no discount for waiting.
Hardware, certificates and domains have published clocks too
Three more date sources publish their own clocks, and each one hands you a date you can write down today. Cisco's end-of-life policy gives five years of TAC support for hardware from the EOS date, three years for operating-system software and two years for application software, and says external notification of end of sale is typically six months before the End of Sale. One end-of-sale bulletin therefore sets a hardware refresh date five years out, with half a year of warning before the clock even starts.
Certificates are tightening on a schedule somebody else already agreed. The CA/Browser Forum has set the maximum validity period of a TLS certificate at 200 days from 15 March 2026, dropping to 100 days from 15 March 2027 and 47 days from 15 March 2029, with domain validation evidence reusable for only 10 days from 15 March 2029. Read that as workload, not cryptography. At 200 days each certificate is renewed under twice a year; at 47 days it is renewed nearly eight times a year, so twelve certificates go from roughly 22 renewals a year to about 93. That is arithmetic on a published limit, and it makes automation a dated line item rather than a nice idea.
Domain renewals carry the harshest consequence for the smallest slip. ICANN requires that for at least the last eight consecutive days that the registration is renewable, the existing DNS resolution path must be interrupted, and that registries offer a 30-day redemption grace period during which the registry must disable DNS resolution and prohibit attempted transfers. Your website and your email go dark more than a week before you lose the name at all. A renewal date is an outage date, and it belongs on the roadmap beside the switches.
What a roadmap row must carry, borrowed from people who audit plans
To judge a roadmap row, borrow the test federal auditors already apply to modernization plans. The Government Accountability Office examined ten critical legacy systems in 2019 and looked for three elements in each agency's plan. Milestones, a description of the work necessary to complete the modernization, and a documented plan for the disposition of the legacy system afterwards.
The result is the part worth knowing. Three agencies had no documented plans to modernize at all, and of the seven that did, only the Departments of the Interior and Defense's modernization plans included the key elements. Two complete plans out of ten, inside organizations with program offices, inspectors general and congressional scrutiny. GAO was specific about the consequence, warning that the rest faced an increased risk of cost overruns, schedule delays, and project failure.
A second federal rule shows what an individual row should carry, and it has nothing to do with IT. Local governments seeking hazard mitigation grants must file a plan containing an action plan describing how the actions identified will be prioritized, implemented, and administered, where prioritization gives special emphasis on the extent to which benefits are maximized according to a cost benefit review of the proposed projects and their associated costs. Strip the subject matter out and that is a roadmap specification written by a regulator with nothing to sell you. Priority, delivery route, administration, and a cost beside each item.
The owner is the field most often blank, and it is the one you cannot delegate. CISA's performance goals ask that roles, responsibilities, and authorities related to the organization's cybersecurity program are established, communicated, and that all roles and responsibilities involving cybersecurity should be documented in an organization's cybersecurity policy. Apply the same standard per row. One accountable person inside your business owns every line, even where your provider does all of the work, because your provider cannot approve your spending.
The numbers that belong beside the cost
Four numbers belong on every roadmap row, and only one of them is the price. The count of devices or seats the row touches, the measure it moves, the cost to do it this year, and the cost of not doing it this year.
- Count. How many laptops, servers, mailboxes or certificates the row covers. A count makes the row checkable against your asset inventory, which the IT asset register you can demand covers in full, and it is the number nobody volunteers.
- Measure. What the row changes about something the business already tracks. Minutes of downtime, days to get a new hire working, or the share of machines on a supported build.
- Cost to do. The capital expenditure or subscription change, in the year it lands, as a single number your finance person can budget against.
- Cost to defer. What the identical row costs twelve months later. Microsoft prices that one for you.
The deferral number is the one that changes meetings. A row reading replace 40 Windows 10 laptops is an argument waiting to happen. The same row reading 40 devices, $2,440 to keep them patched this year, $4,880 next year, $9,760 the year after is a decision, because the price doubles every consecutive year and the published rate is $61 USD per device for Year One. Three multiplications on a vendor's own figure, and the argument is over.
Then say what happens if the work slips, because that is the number a roadmap exists to surface. GAO maintains a schedule guide for exactly this, which presents them as ten best practices associated with developing and maintaining a reliable, high-quality schedule and states the point in one line. Typically, schedule variances are followed by cost variances. A date that moves is not free, and a roadmap that never records a slip is hiding the cost of its own delays.
A roadmap with no budget column is a wish list
A roadmap and a budget are two different documents, and a roadmap with no budget column is a wish list with dates on it. The roadmap says what changes and when. The budget says what gets funded this year. A row that appears on the first and never reaches the second has not been planned, it has been mentioned.
Scale explains why that keeps happening. In 2019 GAO reported that the federal government plans to spend over $90 billion in fiscal year 2019 on IT, and that about 80 percent of this amount is used to operate and maintain existing IT investments, including legacy systems. Your proportions differ and the shape does not. Keeping what you already run consumes most of the money, so every new line item has to win an argument against the bill for yesterday.
The cost of losing that argument year after year sits in the same report. The ten critical systems GAO examined were 8 to 51 years old. Nobody ever decided to run a 51-year-old system. A defensible deferral happened each year, and no single document ever added them up. That is the specific failure a dated roadmap prevents, and it is the cheapest thing on this page.
A roadmap where every row is approved is not a roadmap. It is a quote.
What makes a roadmap move, and what to do with the lines nobody funds
To make a roadmap move, attach it to a quarterly review that has to produce a decision per row, then record what was deferred and by whom. A plan with no review date drifts. A review with no decision rights is just a presentation.
Federal grant rules show the mechanic at its simplest, and it has two halves. A local hazard mitigation plan must contain a section describing the method and schedule of monitoring, evaluating, and updating the mitigation plan, and the jurisdiction must review and revise its plan to reflect changes in development, progress in local mitigation efforts, and changes in priorities, and resubmit it for approval within 5 years in order to continue to be eligible for mitigation project grant funding. The plan states how it will be reviewed, and letting it go stale costs real money. Copy both halves into your agreement.
In practice that means three sentences in the contract. The roadmap is reviewed on a named cadence, the review produces an approve, defer or decline decision on every row, and the minutes name who deferred what and until when. The one-page service review a busy owner can run is the shortest version of that meeting, and it works because the paperwork is thin enough that somebody actually reads it.
The lines nobody will fund
A line nobody will fund does not get deleted, it gets moved. Write it onto a risk exception register with a named signatory and an expiry date, which our guide to the risk exception register sets out in full. The roadmap then records what you chose to do and the register records what you chose to live with. A roadmap that quietly drops a row leaves no evidence of either decision, which is worse than carrying the row in red.
The technology roadmap to ask for, in seven columns
Ask for one row per decision and seven columns, on one page per year. Send the column headings once and they become the standing format, because a provider forced to assemble this twice by hand will automate it the third time.
| Column | What it holds | Why you can check it |
|---|---|---|
| Work | One sentence naming the system and the change | It names a system you own |
| Date | The month the work completes | A month is either met or missed |
| Source of the date | The lifecycle table, warranty record, certificate or contract behind it | You can open the page yourself |
| Owner | A named person in your business, never a job title | That person can confirm it |
| Count | Devices, seats, sites or certificates the row touches | It matches your asset inventory |
| Cost | This year's cost, and next year's cost if deferred | Two numbers, both arithmetic |
| Status | Approved, deferred to a named year, or not funded | A deferral carries a name and a date |
Then run the sixty-second test on the roadmap you already have. Count the rows with a specific month in them, and count the rows where you can verify that month against a page somebody else published. If the second number is zero, every date on the sheet is your provider's estimate, and an estimate is not something you can hold anyone to.
Good reads as replace 14 switches by June 2027, driven by last day of support, owner named, cost in this year's capital expenditure, approved. Weak reads as strengthen network resilience, ongoing. None of this makes an IT plan risk-free, and no honest provider claims otherwise. It makes the plan measurable, which is what you thought you were buying. Take the seven columns to three independent providers and compare what comes back.
FAQ
What should be on a technology roadmap?
One row per decision, with seven fields. The work, the date, the published source of that date, a named owner, a count of the devices or seats it touches, this year's cost and next year's, and a status. Federal auditors check plans for the same shape, looking for milestones, a description of the work necessary to complete the modernization and a disposition plan.
How do I find the real end-of-support dates for my systems?
Open the vendor's own lifecycle page rather than your provider's slide. Microsoft publishes a table per product, and Windows Server 2016 carries an extended end date of 1/13/2027. Cisco's policy gives five years of TAC support for hardware from the EOS date. Both are published commitments you can read in a browser in under a minute.
What is the difference between a technology roadmap and an IT budget?
A roadmap states what changes and when. A budget states what is funded this year. A roadmap row that never reaches the budget has been noted, not approved. GAO reported that about 80 percent of this amount is used to operate and maintain existing IT investments, out of over $90 billion, which is what every new row competes against.
How often should a technology roadmap be reviewed?
Quarterly, with an approve, defer or decline decision recorded on every row, then rebuilt annually against your budget cycle. Federal grant rules require a plan to contain a section describing the method and schedule of monitoring, evaluating, and updating the mitigation plan and resubmission within 5 years to stay funded. Borrow both ideas.
What does it cost to defer a hardware refresh by a year?
More than doing it now, and the vendor often publishes the premium. Microsoft charges $61 USD per device for Year One of Windows 10 extended security updates and states the price doubles every consecutive year, for a maximum of three years, with the years cumulative. GAO adds the general rule that typically, schedule variances are followed by cost variances.
Best IT MSP is the independent directory of managed IT and cybersecurity providers across the US and Canada. We rank on verified rating and firmographic data, we label paid placement, and we do not sell IT services. Ask three ranked providers in your city for a roadmap with these seven columns filled in, then compare what comes back.