Nonprofit technology roadmap on one page

You have no IT department, one operations manager who absorbed the job, and a managed services contract nobody has read since it renewed. A funder picked your case management system in 2021 and then moved on. Payroll depends on a spreadsheet with a tab nobody opens, and a board member wants to know your position on AI. This is the technology roadmap you can write in two weeks, on one page, without hiring anyone.

What goes on the page

List every system you pay for, with one named owner, its annual cost, and the date its contract ends. Pick three moves for the year and write down what each costs in hours and dollars and what done looks like. Add a stop list, the things you will not buy or start this year no matter who asks. Put a budget line and a sign-off date at the bottom. That is the whole roadmap.

It is the working end of the wider technology strategy question, and it ships with a free template at /templates/technology-roadmap/. Everything below is how to fill the page without lying to yourself.

Write it before the budget, not after. In the 2024 Nonprofit Digital Investments Report, NTEN found that 62% of nonprofits make major technology decisions during annual fiscal planning, while only 40% include technology explicitly in their strategic plan and 24% leave it out entirely. The page is the bridge between those two facts.

The inventory: every system, one owner, its cost, its contract end

Start with anything that has a login or an invoice. Include the free tools, because they still hold data and need an owner. Include the spreadsheet that runs a program. Stop at 25 rows. Past that you are listing browser extensions.

Six columns: system, purpose, owner, annual cost, renewal date, and a decision (keep, replace, or retire). The owner is one person, by name, not a department. The owner holds the admin login, answers when it breaks, and decides at renewal. If two people own a system, nobody does.

Cost is annual and all-in: seats, add-ons, and the consultant who keeps it running. The renewal date is the day auto-renew fires, minus the notice period. That column does most of the work, because a renewal you miss costs a full year.

Here is the inventory for a hypothetical $7M human services organization with 55 staff. Every figure is invented to show the shape.

Fifteen rows, $200k a year, five decisions, two of them due inside four months. That is the reason to write the renewal column.

The three moves and how to pick them

Three, not five, because three is what a staff with no IT department can finish in a year alongside the work it already has. Every replace or retire decision in the inventory is a candidate. Rank candidates by renewal date first, then by the staff hours the system burns, then by risk. A renewal you cannot exit ranks above a redesign everyone wants.

Time saved beats money raised. In the same NTEN report, improving inefficient processes had significant influence on technology decisions for 75% of respondents and saving staff time for 61%, while raising more money had significant influence for 34%. Pick the moves that remove a manual step from a named person’s week.

The AI request from the board becomes a move only when it names a process and an owner. Explore AI is not a move. Draft acknowledgment letters from CRM records, owned by the development director, done when the manual step is gone, is a move. Anything that cannot be written that way goes on the stop list.

Here are the three moves for the same hypothetical organization.

The stop list

The stop list is what you will not buy, pilot, or start this year, written down so you can say so in one sentence when a funder, a board member, or a salesperson asks. Three to six items. Each names the thing and the date it gets reconsidered.

For the hypothetical organization the list reads: no new CRM until the June 2027 renewal review; no website redesign this year; no AI pilot without a named process and owner; no tool that needs a new integration to work; no purchase under $2,000 that adds a login without an owner.

Write your buying rules before a sales call, not during one. In NTEN’s 2024 report, cost had significant influence on major technology decisions for 78% of respondents and integration with current systems for 68%, while conversations with product sales teams had significant influence for 26%. When the CRM review comes around, the guide on how to choose a nonprofit CRM covers what to score.

Security basics that cost nothing

A staff of fifty with a case management system, a donor database, and four sites sits inside the small and medium business band where the breach numbers are worst. In the 2025 Data Breach Investigations Report small and medium business snapshot, Verizon found ransomware present in 88% of breaches at small and medium organizations, against 39% at larger ones. The same report puts the human element in roughly 60% of breaches, with third-party involvement doubling from 15% to 30% in a year.

The median ransom paid in that report was $115,000, and 64% of victims did not pay, which only works with backups you have tested. Five items go on the roadmap as a checklist, each with a yes or no.

1. Multifactor authentication on every account that offers it, strongest method available, admin accounts first. CISA states that MFA makes an account 99% less likely to be hacked, and its Cybersecurity Performance Goals rank app-based codes above text messages.
2. Same-day offboarding. Revoke every login the day someone leaves and disable any account idle for 30 days, the example period in CISA goal 3.D.
3. Tested backups. CISA goal 3.O asks for backups stored offsite and offline and a restore test no less than once a year. A backup nobody has restored from is a hope.
4. Updates on by default. Every laptop and phone applies updates automatically, one of the four actions in CISA’s Secure Our World guidance.
5. No shared passwords in email or chat. Use a password manager, another of the four Secure Our World actions. The browser’s built-in one costs nothing.

The operations person who owns the suite owns all five. Put the answers on the page, with the date of the last restore test.

The budget line and the benchmark

Add up the annual cost column, add the one-time costs from the three moves, then add a training line. That is the budget line. In the hypothetical, $200k of subscriptions, devices, and support plus $12,000 of migration help and $9,000 of training gives $221k, about 3.2% of a $7M budget. That figure carries devices and the managed services contract, which the Form 990 technology line leaves out, so it will sit above any benchmark drawn from that line.

The benchmark is older than you would like. NTEN’s Nonprofit Technology Staffing and Investments Report, based on 259 responses gathered in 2016, found organizations between $1M and $5M spent an average of 4.8% of operating budget on technology, with a median of 1.7%. Organizations between $5M and $10M averaged 2.8% with a median of 2.0%, and those over $10M had a median of 1.0%.

Use the median, not the average, which a handful of heavy spenders pull up. The median is not a target either. In the 2024 report, 45% of nonprofits said they spend too little on technology, and 77% of that group named available budget as the barrier.

The training line matters more than its size. The same 2024 report found training takes roughly 1% of nonprofit technology budgets, against 54% for hardware. A system nobody was trained on is a system nobody uses. The budget line goes into the annual budget the way a revenue target goes into a fundraising plan: one number, one owner, one date.

What the board needs to see

The board needs the page once a year, signed and dated, plus a six-month check on the three moves. It does not need the inventory read aloud. It needs four things: the budget line as a share of total budget, the three moves with their done-when dates, the stop list, and the five security answers.

Boards are rarely the obstacle. In NTEN’s 2024 report, 45% of nonprofits already report on technology to their board regularly, and board support was the least cited barrier to technology investment at 12%. A board that has seen the stop list stops forwarding vendor emails.

If two people own a system, nobody does.

The sign-off block carries two dates: the day the executive director signed, and the review date twelve months out, which goes in every system owner’s calendar. If a strategic plan is under way, this page is its technology appendix, and the guide to the nonprofit strategic plan template and process shows where it slots in.

When not to do this

Do not write the page while an executive director transition or a merger is less than six months out. The owner column will be wrong before the ink dries. Do the inventory, hand the new leadership the renewal dates, and leave the moves and sign-off to them.

Do not write it in the middle of a CRM migration. The migration is the roadmap this year, and it already has an owner and a date. Finish it, then write the page with the new system in the inventory.

Do not write it if one person administers fewer than six systems and there is no support contract. Put the systems, owners, and renewal dates on an index card and do the five security items. Come back to the three moves when a renewal or a funder forces a decision.

Do not let anyone turn it into a three-year plan. A three-year technology plan at this size is a list of renewal dates with adjectives. Keep the page to twelve months, and let the renewal column carry the future.