IT strategy: what it is, what it includes and how to build one

The question arrives at the budget committee: sales wants a CRM, operations a maintenance system, finance wants to replace the ERP, and someone proposes 'doing something with AI'. Each proposal makes sense on its own. What doesn't exist is the criterion to decide which comes first, how they connect to each other and what each contributes to the business plan.

This guide explains what an IT strategy is, what it is for, what it should include, what two public IT governance frameworks say and how it is built step by step.

What is IT strategy?

An IT strategy is the plan that defines which technology a company needs to execute its business strategy, in what order it will adopt it and with what business case. It starts from the business — what the company wants to achieve, which processes sustain it — and ends in a portfolio of technology initiatives (ERP, CRM, data, artificial intelligence, infrastructure) with owners, sequence and multi-year costs.

It is not a systems inventory or each department's wish list. It is a leadership decision about where to invest in technology and where not to, with the same criteria used for any other investment.

What is an IT strategy for?

It serves three purposes. First, so that technology responds to a business objective and not to a vendor's catalog: each initiative is justified by what it changes in operations or revenue. Second, so that systems are decided together and not one at a time: a CRM that doesn't integrate with the ERP, or an AI project with no governed data, are the result of deciding project by project. Third, so that the board can approve a technology budget with benefits, costs and risks, instead of approving tools.

What does an IT strategy include?

A complete IT strategy has five pieces:

IT assessment: which systems support the operation today, how they integrate, which contracts and technical debt exist, and where current technology holds the business back.

Target architecture: how systems, data and infrastructure should be connected to execute the strategy, and what changes from the current state.

Prioritized portfolio of initiatives: the list of projects ordered by business impact, with their dependencies (an analytics project depends on the ERP's data, for example) and their sequence.

Business case per initiative: expected benefit, multi-year total cost — licenses, implementation, integrations, internal team, support — risk and owner.

IT governance: who decides on the portfolio, in which committee, with which indicators it is reviewed and how often it is updated.

An IT strategy without a business case per initiative is a list of projects. Without governance, it's a document no one opens again.

Does your technology plan fit on one page?

We define the target architecture and the portfolio of initiatives your business strategy needs, each with its business case, and accompany execution.

• Portfolio prioritized by business impact
• Selection criteria defined before seeing vendors

Learn about IT strategy consulting

What is IT governance, and what do ISO/IEC 38500 and COBIT say?

IT governance is the part of the strategy that defines who decides and how the use of technology in the organization is controlled. Two public frameworks serve as references.

ISO/IEC 38500:2024, Information technology — Governance of IT for the organization, published in February 2024 in its third edition, provides guiding principles for members of governing bodies of organizations, and those who support them, on the effective, efficient and acceptable use of information technology. According to its official abstract, it applies to the governance of the organization's current and future use of IT and to organizations of all sizes — public and private companies, government entities and not-for-profits — regardless of the extent of their use of IT.

COBIT, published by ISACA, is described by its publisher as the premier framework for the governance and management of enterprise IT; its current version is COBIT 2019. Among what ISACA highlights is aligning IT goals with strategic business objectives, and the relationship between governance and management objectives, alignment goals and enterprise goals.

In our view, neither is adopted in full by a midsize company. ISO/IEC 38500 helps leadership understand its role — evaluating, directing and monitoring the use of technology; COBIT helps the IT team structure processes and controls. The IT strategy takes from each what the company's size and requirements justify.

Technology leadership without a full-time position

CIO or CTO as a Service: IT governance, architecture and alignment of technology with the business, on demand.

• Same judgment, adjusted dedication
• Vendor-agnostic

Talk to our team

How do you build an IT strategy, step by step?

1. Start from the business strategy. If it doesn't exist or isn't written down, the first step is strategic planning, not technology.

2. Assess what exists: systems, integrations, contracts, data and people. What works, what holds back and what it costs to maintain.

3. Define the target architecture: how systems, data and infrastructure should be connected to execute the strategy.

4. Identify and prioritize initiatives with a single criterion: business impact, dependencies, risk and the organization's capacity to absorb change.

5. Build the business case for the heaviest initiatives, with multi-year total cost and an owner.

6. Define governance: committee, indicators, review frequency and the criteria any vendor will be evaluated against later.

7. Execute and review: the strategy is adjusted when the business changes, not when the calendar says so.

Mistakes to avoid in an IT strategy

In our view, the costliest are four. Choosing the software before defining the architecture, so the tool ends up dictating the process. Planning without an owner per initiative, so the project gets whatever time is left over. Calculating only the license and not the multi-year total cost. And not reviewing the portfolio when the business changes, so the strategy becomes a historical document.

When does IT strategy consulting make sense?

When the company will invest in several systems over the coming years and has no map of what comes first; when departments buy tools on their own and nothing integrates; when the board asks for a technology plan with costs and benefits before approving a budget; or when the company needs senior technology leadership but doesn't have the daily decision volume to justify a full-time CIO or CTO.

How we can help

At Cyrrus we provide IT strategy consulting as part of the Construct phase of the CIRA method: assessment, target architecture, a prioritized portfolio with the business case for each initiative, and the criteria we later use to select software and infrastructure with no vendor bias. The same team that does the assessment accompanies execution.

If what's missing is the business strategy, we start with strategy consulting and strategic planning. And if the company needs technology leadership without a full-time position, we offer CIO and CTO as a Service.

To go deeper into related topics: what strategic planning is, what an ERP is and how to choose one, and what AI governance is.