Most small businesses already have an IT strategy. It’s written on sticky notes, in a few forwarded emails and in whatever the last person to complain asked for.
Turning that into a one-page plan for the next 12 months is a manageable job, and it works the same way for a five-person studio as for a 150-person agency. A useful IT strategy for a small business covers four things: devices, security, budget and people. Here’s how we’d build one, in five steps.
1. Start with what’s annoying people
Day-to-day frustrations are the best raw material you have. For two weeks, keep a running list of every IT complaint you hear: the slow laptop, the shared password nobody dares change, the new starter who waited three days for access, the renewal invoice that arrived as a surprise. Ask each team lead to add theirs.
Resist fixing anything while you collect. By the end, the same few themes will have come up more than once, and those themes are the first draft of your strategy.
2. Take stock of what you have
You can’t plan a year without knowing where you’re starting from. Put together four short lists:
- Devices: every Mac, iPhone and iPad, roughly how old it is and who has it. A device management system (DMS, formerly MDM) can produce this in minutes.
- Software and subscriptions: what you pay for, how many licences, and when each one renews.
- Admin access: who holds the keys to Microsoft 365 or Google Workspace, Apple Business, your DMS and your domain. If one person holds all of them, write that down too. Our piece on keeping Apple admin access when your IT person leaves explains why.
- Key dates: certificate renewals, contract end dates and anything with a fixed deadline, such as Microsoft stopping text-message sign-in codes on 1 February 2027.
3. Decide what the business needs this year
This is the step that turns an IT to-do list into a strategy. Sit down with whoever sets the direction of the business and ask a few plain questions. How many people will you hire, and when? Is an office move, a new location or more remote working on the cards? Are clients starting to ask for security evidence such as Cyber Essentials? Is there a big project coming, like a new finance system?
Every answer has an IT consequence. Ten new hires in spring means ten Macs ordered over winter and ten sets of accounts ready on day one. A client asking for Cyber Essentials means a few months of preparation before the certificate, and a renewal date in your diary every year after.
4. Turn it into a plan by quarter
Now combine the three lists. Put each item under one of four headings, give it an owner and drop it into a quarter.
Devices cover new Macs for planned hires and a steady replacement cycle. Pick an age at which Macs get replaced and stick to it, so the cost is spread across the year. For some roles, Apple’s certified refurbished Macs are worth a look.
Security covers the fixes from your frustration list plus whatever clients are asking for: multi-factor authentication everywhere, updates applied on time, backups that have been test-restored and a certification date if you need one.
Budget is the cost of everything above by quarter, plus the renewals from step 2. A plan that shows spend by quarter is far easier to get signed off than a stream of requests that turn up whenever something breaks.
People covers who owns IT decisions, how starters and leavers are handled, and any training, such as phishing awareness, you want to run during the year.
Here’s what that might look like for a growing agency:
| Quarter | Devices | Security | People |
|---|
5. Review it every quarter
A plan you look at once a year is just a nice document. Book 30 minutes each quarter to check what got done, what changed in the business and what needs to move. Hiring plans shift, clients add requirements, and prices change, so the plan should change with them.
In Dr Logic’s experience, this review is the step that slips first, usually because nobody’s job is to run it. If that sounds like your business, our virtual CIO and quarterly business reviews give you someone to own the plan with you. Regular strategy reviews are also part of our IT Success Plans.
Start with the frustration list this week, and the rest of the plan will follow from it.
Get next year’s IT on one page.
We’ll help you turn your team’s IT frustrations into a quarterly plan for devices, security, budget and people.
Related articles
- Keeping Apple admin access when your internal IT person leaves
- Refurbished vs new Macs for business fleets
- Set up Microsoft Authenticator before text sign-in codes stop on 1 February
FAQs
What should an IT strategy for a small business include?
Four things: devices, security, budget and people. That means knowing what equipment you’ll need and when to replace it, what security work clients and insurers expect, what it all costs by quarter, and who owns IT decisions. A single page covering those four, reviewed quarterly, is enough for most small businesses.
How far ahead should an IT strategy plan?
Twelve months in detail is the sweet spot for most small and mid-sized businesses. It’s long enough to plan hiring, replacements and renewals, and short enough that the plan stays realistic. Keep a rough note of bigger changes further out, such as an office move, and add them to the detailed plan as they get closer.
Do we need an IT person to write an IT strategy?
No. The most important inputs come from the business: hiring plans, client requirements and the frustrations your team already has. An IT person or provider helps with the stock-take and costs, but an owner or operations lead can draft the first version. Having someone review it quarterly matters more.
How often should we review our IT strategy?
Every quarter, for about 30 minutes. Check what got done, what’s changed in the business and what needs to move. Hiring plans, client requirements and prices all shift during a year, so a plan that’s only reviewed annually tends to drift away from what the business needs.
