Cybersecurity roadmap: building a three-year plan

A cybersecurity roadmap sets out, over two to three years, the major programmes that will take the organisation from its current security level to the level it targets, in a realistic order and with an approved budget. It answers the board's question (“where will we be in three years, and at what cost?”) whereas the security plan answers the team's (“what are we doing this quarter?”). Here are the inputs to gather, a six-step method, an example, budget benchmarks and how to keep it current.

One year is too short: the programmes that really shift security levels (identity management, network segmentation, detection, supplier assurance) often run past twelve months, and year-two work depends on year one. Five years is too long: threats, tools and regulation move faster. Three years leaves time to act while keeping the forecast credible.

It is also the horizon the French state has chosen for itself. On 9 April 2026, ANSSI, the national cybersecurity agency, published a roadmap of priority security efforts for central government for 2026-2027: ten objectives that each ministry had to translate into its own roadmap by June 2026, with dated milestones, including the roll-out of multi-factor authentication. The logic is the one you would expect in a company: a few objectives, deadlines, an owner per scope.

A serious roadmap does not start from a shopping list but from four kinds of information:

The guide “Digital risk management: the confidence advantage” by ANSSI and AMRAE, the French risk managers' association, stresses this last point: digital security is a business risk to be governed alongside others, by management. A roadmap that ignores business strategy will be overturned by the first unplanned project.

1. Measure the starting point. Pick a yardstick (NIST CSF, ISO 27001, your national NIS 2 framework) and score each area. NIST CSF 2.0 calls the result the current profile and offers four tiers describing how rigorous risk governance is (see our article on NIST CSF functions and tiers).
2. Define the target, and why. The target profile does not aim for the maximum everywhere: it depends on risk, obligations and the risk appetite set by management. NIST's SP 1301 quick-start guide explains how to build and compare both profiles.
3. Group gaps into programmes. Five to eight programmes the board can read (“identity and access”, “continuity”, “suppliers”) rather than sixty actions. Wavestone's yearly CISO Radar maps more than 150 topics by quadrant and maturity, according to Solutions Numériques: a useful prompt for naming and grouping programmes.
4. Sequence. First what cuts the most risk for moderate effort and what a regulatory deadline imposes; then the programmes that depend on it. A detection tool without centralised logs or a response procedure is useless: order matters as much as the list.
5. Cost it by year. Capital spend, recurring costs (licences, subscriptions, services) and internal effort, separating what is committed from what still needs a decision.
6. Get approval and break it down. Management approves the roadmap; NIS 2 makes management bodies responsible for approving cybersecurity risk-management measures (Article 20). Each year then becomes a detailed IT security plan.

Fictional example: an 800-employee services company, likely an important entity under NIS 2, with a three-person security team and an outsourced service desk. Its current profile shows weak governance, untested backups and no supplier oversight.

Year one lays high-impact, low-cost foundations; year two builds structure; year three embeds measurement and continuous improvement. In France, NIS 2 transposition has not yet been voted, so exact compliance dates remain open: the roadmap relies on ANSSI's published framework and will be adjusted once the law and its decrees appear.

There is no universal figure, only benchmarks. ENISA's NIS Investments 2024 study, covering 1,350 organisations across the EU, puts information security at 9% of IT investment, up 1.9 points year on year, and the share of IT staff working on security at 11.1%. Median security spend rises from €0.7 million to €1.4 million. These averages hide large differences by sector and size: use them to position a budget, not to set it.

For the board, present two or three scenarios (“baseline”, “recommended”, “accelerated”), each with the risks reduced, the obligations covered and what remains accepted. Management's risk appetite decides, not last year's budget.

• Annual review: new current profile, completed programmes, adjusted later years, next year's budget.
• Ad hoc review after a major incident, an acquisition, new regulation or a shift in threat (ransomware in your sector, a massive flaw at a supplier).
• Simple indicators in the security dashboard: progress per programme, gap to target profile, overdue actions, open exceptions.
• One owner for the roadmap, often the CISO, and a named owner per programme.
• A stable yardstick from year to year, so progress is comparable. Article 21 of NIS 2 also requires policies and procedures to assess the effectiveness of measures.