Most UK organisations are updating their IT strategy this year, not because technology is fashionable, but because it now underpins how companies sell, serve and stay resilient. Generative AI is moving from pilot to production, the cyber threat landscape keeps evolving, and cloud choices must balance cost, performance and data governance.
If you lead a team in 2026, the question isn’t “do we need a new strategy?” but “what exactly should we do next, and how will we measure it?”
This practical guide sets out: a 90-day refresh plan, a simple cloud decision matrix, KPI ideas to track progress, and links to neutral UK guidance (NCSC, ICO, GOV.UK). It’s written for non-specialist leaders who need to make clear decisions, fast.
What changed, and why this matters now
- AI is moving into workflows. Many firms now explore AI for service, knowledge search, code assistance or analytics. The opportunity is real, but so are the data, security and governance questions (e.g., where prompts come from, how outputs are reviewed). Recent coverage of the Lloyds Business Barometer suggests around a third of firms plan to focus on AI tools.
- Cyber risk is business risk. UK reporting indicates that over a quarter of firms experienced a cyberattack between 2024 and 2025. The National Cyber Security Centre stresses layered controls, incident rehearsal and tested backups, not just buying more tools.
- Cloud needs a second look. Cost control (FinOps), resilience and data residency are rising up the agenda. Public/private/hybrid choices should be re-assessed by workload, not by ideology. Moves such as sovereign data platforms aim to keep sensitive data within national boundaries.
- People and partners are the constraint. AI, security and cloud skills are in short supply. Strategies that blend upskilling with targeted external support are executing faster. Some organisations use (commercial) managed cloud services to bridge expertise gaps while maintaining governance.
First 90 days: your practical IT strategy refresh
- Map the critical 10–15 services. List your Tier-1 business processes (e.g., ecommerce checkout, ERP, clinical system, claims, payroll), the apps and data they depend on, and the key suppliers. Note where personal data is processed and any sector regulations that apply.
- Baseline security. Enforce MFA everywhere, lock down admin accounts, patch priority systems, and confirm offline/immutable backups for Tier-1 data. Schedule a tabletop incident exercise within 60 days. Use the NCSC’s 10 Steps to Cyber Security as your checklist; aim for Cyber Essentials (Plus where appropriate).
- AI governance quick start. Inventory current AI use (official and shadow). Define an acceptable-use policy, data inputs allowed, human-in-the-loop review points, and logging requirements. If personal data is involved, complete a DPIA and set retention rules. Create a small “AI review board” to approve new use-cases.
- Cloud cost, reliability and exit. Stand up a FinOps view: cost by product/team, top 10 spenders, under-utilised resources. Test RTO/RPO for one Tier-1 service per month. Document how you would export data and rebuild a service if you ever had to switch cloud/SaaS providers.
- People plan. Identify 3 upskilling goals (e.g., “all admins pass NCSC security awareness”, “two staff complete GCP/Azure associate cert”, “product leads briefed on AI policy”) and 2 short-term partner roles to fill gaps (e.g., incident response retainer; cloud optimisation sprint).
Cloud choice: a simple matrix
| Model | Best for | Trade-offs |
|---|---|---|
| Public cloud | Elastic/seasonal demand; analytics/AI platforms; global reach | Egress & lock-in risk; data residency controls needed; FinOps discipline essential |
| Private cloud | Predictable workloads; strict latency/compliance; cost stability | Capex or long-term commit; slower to scale; in-house skills required |
| Hybrid | Split residency (e.g., UK data stays local, burst to public cloud); legacy coexistence | Integration & ops complexity; requires clear landing zones & guardrails |
Tip: classify by workload (data classification, latency, usage pattern), not by a once-for-all “we are a [public/private] shop” decision. Revisit annually.
Measure what matters: suggested KPIs
| Area | KPI | Target / cadence |
|---|---|---|
| Security | MFA coverage; admin account hardening; phishing fail rate; patch SLA compliance; backup restore test pass-rate | ≥99% MFA; quarterly restore tests for Tier-1; phishing fails ↓ quarter-on-quarter |
| Incident response | Mean time to detect/respond (MTTD/MTTR); exercise frequency | Quarterly tabletop; annual live test; MTTR ↓ vs last quarter |
| Cloud (FinOps) | % tagged spend; rightsizing savings; reserved/spot coverage | ≥90% tagged; rightsizing realised savings monthly |
| Resilience | % Tier-1 services meeting RTO/RPO; failover tests | 100% of Tier-1 tested annually; issues tracked to closure |
| AI governance | % AI use-cases with DPIA; human review rate; model drift/quality metrics | 100% of personal-data use-cases with DPIA; periodic quality checks |
Cyber, data & AI: UK-specific guardrails
- NCSC controls: follow the 10 Steps, consider Cyber Essentials / Plus, if you operate essential services, review the NCSC’s Cyber Assessment Framework.
- Data protection: UK GDPR still applies. Use the ICO’s guidance on data protection, DPIAs, and AI & personal data.
- Regulation: track the UK’s Cyber Security and Resilience (Network and Information Systems) Bill on Parliament’s website for scope and timing; check GOV.UK for updates and sectoral guidance (e.g., DORA in finance, NIS/NIS2 trajectory).
Skills & sourcing: how to execute
Blend internal development with targeted external help. A realistic 2026 model is “product-led IT”: small cross-functional teams that own a service end-to-end, supported by a central platform/security function. Where you don’t have depth (IR, cloud optimisation, data governance), use short, outcomes-based partner engagements rather than open-ended T&M.
- Upskill fast: security awareness for everyone; admin training on identity/privilege; one cloud associate cert per quarter; product owners briefed on AI/data policies.
- Partner where it matters: incident response retainer; red-team or phishing programme; FinOps cost optimisation sprint; data protection impact support for AI roll-outs.
Local resources in Oxfordshire
- OxLEP Skills: regional skills and training programmes (digital, cyber, leadership).
- Universities & colleges: short courses in data/AI/cyber/cloud (check University of Oxford Continuing Education; local FE/HE providers).
- Cyber clusters & meetups: Thames Valley/Oxfordshire groups for peer learning and supplier-neutral advice.
FAQ
Do we need an AI policy?
Yes. Cover acceptable use, data sources, human review, logging, incident reporting, IP/copyright, supplier due-diligence and DPIAs where personal data is used.
Public vs private cloud?
Start with the data and workload. Use the matrix above: classify by sensitivity, latency, usage pattern and exit needs. Pilot with FinOps dashboards before committing.
Minimum viable cyber baseline?
MFA, patched devices/servers, hardened admin, phishing education, tested offline/immutable backups, and a rehearsed incident runbook. Align to NCSC’s 10 Steps and Cyber Essentials.
What should we measure?
Pick 6–8 KPIs (see table) and review monthly at exec level. Tie each KPI to an owner and a target date.
