How should mid-market operators plan IT for 2027? Three postures, three 90-day windows

January planning sessions are useful, but they're not where the year actually gets made. The decisions that determine 2027's IT outcomes were made in Q4 2026 - or weren't. If you're sitting down to plan 2027 now and feeling slightly behind, you're not wrong. The good news: the year has three 90-day windows, and a focused catch-up in Q1 still produces materially better outcomes than the alternative.

Window 1 - Q1 2027 (Jan-Mar): Foundation

The first 90 days of 2027 are foundation work. Whatever else you do this year depends on these three deliverables completing cleanly:

One: Your posture diagnosis is honest. Acquiring, divesting, or holding - pick the one that matches the truth. The 2027 plan only works if the posture is named correctly.

Two: The 2026 composite cyber score is computed. Whatever it is, you know the number. You know which controls scored 0-2 and need attention. You know what your renewal questionnaire is going to look like.

Three: The three-scenario budget is built. Upcycle, mid-cycle, downcycle. The named-trigger framework documented. The CFO and IT lead in alignment on what's executed in each scenario.

These three deliverables take roughly 30 days of structured work to produce. The remaining 60 days of Q1 are for executing on the highest-leverage gaps the diagnosis surfaces.

Window 2 - Q2-Q3 2027 (Apr-Sep): Execution

Months four through nine are the heaviest execution months. The middle six months of the year are when most IT capability investment actually deploys - long enough to do real work, short enough that the work has time to settle before year-end.

What typically deploys in window 2 across the operators we work with:

• Twelve controls gaps remediated where Q1 diagnosis flagged them
• Vendor consolidation projects executed (these take 3-6 months from decision to operational)
• Identity infrastructure upgrades (Microsoft Entra deployments, SSO expansion, phishing-resistant MFA)
• AI pilot deployments and scaling (Q1 decision to deploy = Q2 pilot start = Q3 scaling decision)
• M&A readiness work for divesting-posture operators
• Integration capability for acquiring-posture operators

Window 2 is where the plan gets tested. Operators who built the foundation in Q1 execute cleanly. Operators who didn't find themselves doing foundation work in Q2 while their competitors are executing.

Window 3 - Q4 2027 (Oct-Dec): Consolidation

The final 90 days are for consolidation, measurement, and 2028 prep:

October: Tabletop exercises completed. Composite cyber score recomputed and compared to Q1 baseline. The year's improvement is documented.

November: 2028 cyber insurance renewal preparation begins. Vendor governance review for 2028 renewal cycle. M&A readiness consolidation for operators in divesting posture.

December: 2027 retrospective. 2028 planning kickoff. The cycle starts again.

Window 3 is when the year either ends compounded or ends scattered. Operators who hit Q1 and Q2 milestones reach Q4 with capability that's deployed, documented, and ready for the next year's pressure. Operators who didn't hit milestones reach Q4 with deferred work that becomes Q1 2028's catch-up.

What changes by posture

The 90-day windows are universal. What changes is what fills them:

Acquiring posture: Q1 - hypothetical absorption exercise, integration capability gap list. Q2-Q3 - execute on gap list, build acquisition pipeline, refine integration playbook. Q4 - pre-deal preparation if a target is in sight; otherwise continued capability building.

Divesting posture: Q1 - 90-day seller-side readiness sprint kickoff. Q2 - data room construction, narrative documents, pressure testing. Q3 - go-to-market or active diligence. Q4 - close or repositioning for 2028.

Holding posture: Q1 - six levers framework assessment. Q2-Q3 - execute on the two highest-leverage levers for your specific stage (typically identity + cyber for under 80, data architecture for 80-150, governance for 150+). Q4 - consolidation and 2028 prep.

If you're starting late

If it's mid-January or later and you haven't done the foundation work, the framework still works. Three adjustments:

1. Compress Q1 to 60 days. The foundation work can be done in 60 days under focused effort. It can't be done in 30. Don't compress further than the work allows.
2. Pick fewer Q2-Q3 initiatives. The execution window shortens. Choose 2-3 initiatives instead of 4-6. Get them done cleanly rather than starting six and finishing three.
3. Use Q4 honestly. If the year was a partial year, document what was deferred. Plan the deferral into 2028 explicitly. Drift accumulates fastest when work that wasn't done isn't named as work that wasn't done.

The full framework - three postures, three windows, the deliverables specific to each - lives across the document family. Crude Truth covers cycle posture. The Operating System covers the six levers and the deployment patterns by stage.

If you'd rather have someone facilitate the Q1 foundation work, the IT-and-the-Cycle Assessment is the right entry point - three to five days, written report, no obligation.