The first 90 days of a vCIO engagement should focus on assessment, relationship building, and quick wins, not immediate major technology changes. Rushing into major changes without understanding the business culture and existing technology environment leads to resistance and failed initiatives.
A real technology roadmap for a new vCIO client is a one-page prioritized plan that maps business outcomes to technology investments over the first 90 days, sequenced by business impact rather than budget. It proves you understood their business before recommending a single tool.
A new client signs a vCIO agreement and expects a strategist. Too often they get a deck of product logos and a request to buy more. The first 90 days are not for selling. They are for diagnosing. A real technology roadmap is the artifact that proves you understood their business before you recommended a single tool.
Before Day One: Read the Handoff
The first 90 days start before the kickoff meeting. Read the agreement, the proposal, and any notes from the sales conversation. Find out what the client was promised, what they asked for, and what they said worried them. A client who mentioned a past outage in the sales call expects you to know about it on day one. Walking in with that context tells them you listened before you arrived.
Then set expectations in writing. Tell the client what the first 90 days will look like: who you will interview, what you will need from them, and when they will see the roadmap. Most clients have never worked with a vCIO before. If you do not define the engagement early, they will define it themselves, and it usually looks like an extra help desk.
Days 1 to 30: Listen and Inventory
Map the business outcomes the client cares about: revenue protection, compliance, growth. Inventory what they actually run, what it costs, and where it is fragile. NIST’s framework is a useful spine here, giving a common language for identify, protect, detect, respond, recover [NIST CSF 2.0].
Start with conversations, not scans. Interview the owner or CEO first, then the operations lead, the finance lead, and one or two people who use the systems every day. Ask the same questions of each:
- What would stop the business if it went down for a day?
- Which system do you trust the least, and why?
- What did the last technology project cost, and did it deliver?
- What do you want to be doing in three years that technology could enable or block?
The answers rarely match. The owner talks about growth, the finance lead talks about cost, and the front-line staff talk about the tool that crashes every Friday. All three are true, and the roadmap has to account for all three.
Run the inventory in parallel. Collect the list of applications, licenses, servers, network gear, cloud services, and vendors, along with who owns each one and when the contract renews. Note anything with no owner, no documentation, or no support. A vCIO who only sees the hardware misses half of what the business depends on, so include the software subscriptions and the outside vendors too.
Quick Wins Worth Taking Early
Trust builds faster when the client sees something improve within the first month. Pick one or two fixes that are low cost, low risk, and visible. Examples include canceling a subscription nobody uses, fixing a recurring annoyance that staff complain about, or closing an obvious security gap such as accounts that never had multi-factor authentication turned on.
Keep the list short and label each item as a quick win rather than a strategy. The point is to show that you act on what you find. It is not to shortcut the assessment.
Days 31 to 60: Find the Gaps That Matter
Rank risks by business impact, not by how loud the vendor is. If a single server failure would stop invoicing, that ranks above a nice-to-have dashboard. The roadmap’s job is to sequence fixes by consequence, not by budget size.
A simple scoring method works better than a complicated one. For each gap, write down two things: how likely it is to cause a problem, and how badly the business would be hurt if it did. Rate each on a three-point scale and multiply. The items at the top of the list become the first things on the roadmap. Show the client the scoring so they can challenge it. A client who helps rank the risks is far more likely to fund the fixes.
This is also the point to compare what the client has against what they should have. Look at backups and whether anyone has tested a restore, patching and how far behind it runs, how access is granted and removed, and whether the systems still fit the way the business works. Where the answer is unclear, mark it as unknown instead of guessing. An honest unknown is more useful than a confident wrong answer.
Start pricing the fixes during this phase. You do not need final quotes, but you need ranges. A roadmap with no numbers forces the client to take it on faith, and a roadmap with false precision falls apart the first time a vendor changes a price.
Days 61 to 90: Deliver the Roadmap
The deliverable is a one-page prioritized plan: what to do this quarter, next quarter, and this year, with owners and cost ranges. Then walk leadership through it and ask for decisions, not applause. A roadmap that ends with “let us know what you think” usually ends with nothing happening.
What Belongs on the One-Page Roadmap
Keep the page readable by a person who has never opened your documentation. It should contain the business outcomes the plan supports, the top risks in priority order, the projects that address them, a rough cost range for each, the owner for each, and the quarter it is planned for. Anything more detailed belongs in a working appendix.
Write every item in business language. “Replace the aging file server so month-end close no longer depends on one machine” lands better than “migrate storage to a supported platform.” The client should be able to read a line and know why it matters to them.
Mistakes That Cost You the Client’s Trust
The most common mistake is leading with products. If the first document a client sees is a list of tools to buy, they conclude that the vCIO is a salesperson with a new title. Lead with outcomes and let the products follow the plan.
The second is burying the client in detail. A forty-page assessment shows effort, but it rarely drives a decision. Put the conclusions on the first page and keep the evidence in the appendix.
The third is going quiet between milestones. Send a short update every couple of weeks during the first 90 days, even if the update is only what you have learned so far and what comes next. Silence reads as inactivity to a client who cannot see the work.
After Day 90: Keep the Roadmap Alive
A roadmap is not a report you hand over and file away. Review it with leadership every quarter, update the risks that changed, and mark what got done. Add new items as the business changes and retire the ones that stopped mattering. The document should get shorter and clearer with each review, not longer.
The rhythm matters more than the format. A client who sees the same plan improving every quarter learns to expect strategy from you. That expectation is what separates a vCIO from a support contract with a nicer meeting invitation.
Frequently Asked Questions
What if the client wants products immediately?
Give them the quick wins in the roadmap, but anchor everything in their stated business outcomes first.
How detailed should the roadmap be?
One page for leadership, with a working appendix. Long enough to act on, short enough to read.
Who owns execution?
The vCIO owns the plan; the delivery team owns the work. Keep the roles clear.
What if the client has no documentation at all?
Treat the missing documentation as the first finding. Build the inventory from interviews, billing records, and the systems themselves, and record what you learn as you go. The roadmap can include documentation as an early item with an owner and a date.
What if leadership will not make time for the interviews?
Ask for short sessions and send the questions ahead of time. Thirty focused minutes with the owner is worth more than a long meeting that never gets scheduled. If access stays a problem, say so plainly, because a roadmap built without leadership input will miss what leadership cares about.
Should the first roadmap cover a full year?
Plan the next quarter in detail, the following quarter in outline, and the rest of the year as direction. Detail beyond the first two quarters goes stale before anyone acts on it.
About Brent Lacy: Brent Lacy is a technology advisor and the voice behind Rewired MSP. He helps MSPs operate with greater maturity and helps business owners make IT choices that make them more secure and more efficient. He is the author of Out of Cycle: A Field Guide to Strategic IT Continuity, vCIO Rewired: Virtually Conquering IT Obstacles, and Near Miss: Preventable IT Failures Threatening Your Business Security.
Sources
- IBM Cost of a Data Breach Report 2024
- Verizon Data Breach Investigations Report 2024
- CISA Cybersecurity Division
- NIST Cybersecurity Framework 2.0
- Microsoft Digital Defense Report
This article is part of the vCIO Services hub.
