You are reading Part 12 of our 12-part Non-Profit Authority Series.
A growing non-profit should build a five-year IT strategy around business goals, cybersecurity, employee productivity, technology lifecycle, cloud systems, recovery, and predictable budgeting. For organizations with 15-30 employees, the strategy does not need to predict every technology change. It should identify likely needs, major risks, replacement cycles, and decision points so leadership can avoid managing technology one emergency at a time. A practical plan should be reviewed annually and adjusted as the organization grows.
The 7-Part Five-Year IT Strategy
A useful five-year plan includes:
- Business goals
- Current technology baseline
- Security roadmap
- Lifecycle plan
- Cloud and infrastructure planning
- Recovery and compliance readiness
- Multi-year budget
The strategy should remain flexible.
Its purpose is to create direction, not lock the organization into decisions that no longer make sense three years later.
1. Start With the Organization’s Business Goals
Technology planning should begin with the mission and operating plan.
Leadership should consider:
- Expected employee growth
- New programs
- New locations
- Remote or hybrid work
- Fundraising needs
- Data requirements
- Grant expectations
- Collaboration requirements
- New applications
- Changes in regulatory or insurance expectations
Technology should follow those needs.
For example, a non-profit planning a second location should consider networking, connectivity, security, equipment, Microsoft 365, support, and budgeting before signing a lease.
A growing organization should not wait until the week before opening to discover those requirements.
2. Establish a Technology Baseline
Before planning five years forward, leadership needs to understand the current environment.
The baseline should identify:
- Managed workstations and servers
- Network equipment
- Microsoft 365
- Security tools
- Backups
- Cloud applications
- Equipment age
- Vendor support status
- Documentation
- Recurring problems
- Known risks
This is where technology alignment becomes valuable.
Technology alignment helps leadership identify recurring weaknesses, aging equipment, security gaps, documentation issues, and productivity friction before building a multi-year improvement plan.
A useful baseline answers two questions:
Where are we now?
and
What will happen if we do nothing?
3. Build a Security Roadmap
Cybersecurity requirements change over time. A five-year plan should consider both current controls and likely future needs.
WTITC’s security model distinguishes between:
Essentials
Device-focused protection including antivirus, Endpoint Detection and Response, unified device backup, and Datto SaaS Protection where applicable.
Complete
User and environment protection that adds Inky email security, BullPhish ID training, Dark Web ID monitoring, SaaS Alerts, and Microsoft 365 management and maintenance.
Complete is WTITC’s standard recommendation for most organizations.
Leadership should also consider whether future risk justifies:
- BCDR
- Third-party penetration testing
- Compliance Manager
- Additional policy or access controls
- Security upgrades
The security roadmap should reflect the organization’s real exposure rather than simply adding tools.
4. Build a Technology Lifecycle Plan
Technology replacement should appear on the roadmap before equipment fails.
A practical plan should identify:
- Workstations approaching replacement
- Unsupported operating systems
- Aging servers
- Firewalls nearing end of support
- Wireless infrastructure
- Switches
- Battery backups
- Other critical equipment
For many workstations, 3-5 years is a useful planning range, although actual replacement timing should depend on supportability, reliability, security, performance, and employee needs.
Infrastructure may operate longer when it remains supported and reliable.
The purpose is not to replace everything on a rigid schedule. The purpose is to prevent multiple expensive surprises.
5. Plan for Microsoft 365, Cloud Systems, and Growth
As the organization grows, cloud systems tend to become more important.
Leadership should consider:
- Microsoft 365 administration
- User access
- Security controls
- Email protection
- Backup
- SaaS monitoring
- License changes
- New applications
- Data growth
- Collaboration needs
A system that works well for 15 employees may require different management when the organization has 40.
WTITC’s target content range is 15-30 employees because it allows planning to be specific, but WTITC can support larger organizations.
The five-year plan should therefore anticipate growth rather than imply that the environment will remain static.
6. Include Recovery, Risk, and Compliance Readiness
A strategy that addresses growth but ignores recovery is incomplete.
Leadership should evaluate:
- Backup
- BCDR
- Incident response
- Data protection
- User access
- Security documentation
- Audit evidence
- Regulatory requirements
- Cyber insurance
- Grant requirements
- Accepted risk
Technology controls can support regulatory compliance readiness, help document controls, and improve audit readiness.
They should not be represented as guaranteeing compliance.
The organization’s legal, regulatory, insurance, and contractual obligations should be evaluated with the appropriate advisors.
7. Build the Financial Roadmap
Technology strategy should ultimately connect to dollars.
For general planning, a properly secured managed IT environment can reasonably fall around $125-$175 per endpoint per month, although that range is not a universal quote.
Actual investment may vary based on:
- Security package
- Endpoints
- Users
- Tiered Technology Fee
- User-security requirements
- Cloud systems
- Optional services
- Compliance requirements
- Multiple locations
- Project needs
WTITC’s managed services structure includes:
- Security Package
- $40-per-endpoint Managed Services Fee
- Tiered Technology Fee
Major projects and exceptional work should be planned separately using the $150 per hour professional services benchmark where applicable.
An annual IT budget becomes more accurate when leadership can connect recurring managed services costs to future projects, lifecycle replacements, security investments, and optional risk-management services.
The five-year strategy allows those costs to be spread across planned budget cycles.
A Sample Five-Year Planning Structure
A non-profit might organize the plan this way:
| Year | Primary Focus | Example Decisions |
| Year 1 | Stabilize | Documentation, monitoring, security gaps, highest-risk equipment |
| Year 2 | Standardize | Workstation replacement, Microsoft 365 cleanup, process improvements |
| Year 3 | Modernize | Server, cloud, network, or major infrastructure decisions |
| Year 4 | Optimize | Productivity, automation, security refinement, policy maturity |
| Year 5 | Reassess | Full environment review and next five-year roadmap |
This is not a mandatory WTITC schedule.
It is a planning model showing how leadership can spread technology decisions over time.
Hypothetical Example: A 17-Employee Non-Profit Planning for Growth
Consider a hypothetical 17-employee non-profit in Midland that expects to grow to 28-35 employees over five years.
Its current environment is stable, but:
- Several workstations will need replacement
- Microsoft 365 requires tighter management
- A server will eventually need a strategic decision
- Leadership is considering a second location
- Cyber insurance requirements are becoming more detailed
- BCDR has not yet been implemented
A five-year approach could:
- Document the current environment.
- Address immediate security gaps.
- Establish a workstation lifecycle.
- Improve Microsoft 365 management.
- Evaluate BCDR.
- Plan the server decision before it becomes urgent.
- Budget for the second location.
- Review the strategy every year.
The expected result is not perfect prediction.
It is fewer emergency decisions and better coordination between technology, budget, growth, and risk.
Five-Year IT Strategy Checklist
Leadership should be able to answer:
- How many employees do we expect to have in five years?
- Are new locations likely?
- Which systems are most important to operations?
- Which equipment is nearing replacement?
- Are any systems becoming unsupported?
- How will Microsoft 365 needs change?
- Are user-security controls strong enough?
- What major projects are likely?
- Do we need BCDR?
- What compliance or insurance expectations could change?
- What risks are currently being accepted?
- Which investments belong in Year 1?
- Which can wait?
- What should appear in future budgets?
- Who reviews the roadmap annually?
Use this Strategy to Evaluate Providers
A five-year roadmap is also a useful provider-selection tool.
A prospective provider should be able to discuss more than immediate support tickets.
Leadership should ask whether the provider can explain:
- Proactive management
- Security structure
- Pricing
- Lifecycle planning
- Technology alignment
- Recovery
- Documentation
- Growth planning
A strong Permian Basin IT provider should help a non-profit make better long-term technology decisions instead of waiting for equipment, security, or support problems to become emergencies.
That is an important distinction between ongoing technology management and reactive IT support.
What Should the Five-Year Strategy Accomplish?
A successful strategy should give leadership a clearer view of:
- Where technology supports the mission
- Where risk is accumulating
- Which problems deserve immediate attention
- Which investments can be planned
- How growth affects systems and security
- What the organization should budget
- How technology decisions affect employees
The plan should evolve as the organization changes. Technology alignment gives WTITC a structured way to keep that roadmap connected to the actual environment rather than allowing it to become a document no one uses.
Learn how proactive managed services and technology alignment can connect today’s technology environment to a practical long-term plan for security, productivity, reliability, and growth.
