IT Strategy & vCIO Services

Elscomm is a Sydney technology consultancy offering IT consulting and IT strategy for businesses of 15 to 70 staff. A business this size rarely needs a full-time chief information officer. It does need someone to decide what to buy, what to replace and what to stop paying for. IT consulting gives you that, as one-off IT consultation services or as an ongoing virtual CIO (vCIO), from the same team that can run your day-to-day IT.

IT consulting in numbers

• 2006 the year Elscomm started advising Sydney businesses
• 15 to 70 staff, the size of business we plan for
• 1 to 3 years ahead, the horizon a typical IT roadmap covers
• 1 team for planning and day-to-day support, so advice matches how your systems run

At a glance

• An IT consultant plans where your technology is heading. IT support keeps it running today.
• IT strategy turns business goals into technology decisions, a roadmap and a budget.
• A virtual CIO (vCIO) is a part-time senior adviser who owns the plan with your leadership.
• Consulting pays off before big spending, contract renewals, growth, office moves and security questions from insurers or customers.
• Microsoft support deadlines for Windows 10, Windows Server 2016 and SQL Server 2016 belong in every current IT plan.

What does an IT consultant do?

An IT consultant advises a business on using technology to meet its goals. An IT support provider keeps things running day to day. An information technology consultant looks further ahead: which systems to keep, which to replace, how to budget for them, and how to cut risk along the way.

What is a virtual CIO (vCIO)?

A virtual CIO is a part-time senior technology adviser who does the planning work of a chief information officer without the full-time salary. You will also hear it called a fractional CIO or an outsourced CIO. In a business of 15 to 70 staff, the vCIO usually works with the owner, managing director or general manager, and meets them on a set schedule to review the plan.

IT consulting services from Elscomm

Elscomm's IT consulting services cover the decisions a business of 15 to 70 staff faces every year:

• Technology planning: a roadmap of what changes, when and why.
• Budgeting: a spending plan the business works around, so replacements are planned instead of urgent.
• Vendor and licence reviews: checking what you pay for, what you use and what is up for renewal.
• Project oversight: keeping upgrades and migrations on track and on scope.
• Risk: spotting end-of-life systems, single points of failure and gaps an insurer would ask about.
• Compliance input: making sure the plan covers the reporting and record-keeping rules your business falls under.

It works best alongside our managed IT services, because the people advising you already know your systems. Projects that come out of the plan run through our IT infrastructure projects and IT procurement teams.

Types of IT consulting

The common types of IT consulting are below. Some firms also offer IT support consulting, where the adviser reviews how your day-to-day support runs and whether it suits the business.

IT strategy consulting: building your technology roadmap

IT strategy consulting turns business goals into technology decisions. A vCIO is the ongoing version: a senior adviser who takes the chief information officer's seat part time, meets your leadership regularly and owns the technology plan. At this level the work covers the roadmap, the budget, vendor relationships, risk and how technology supports where the business is heading.

What goes into a technology roadmap

A technology roadmap is a plan of what will change in your IT, when and why. A good one is short enough for the leadership team to read in one sitting and specific enough to budget from. It typically covers:

• Where you are now: systems, devices, licences, contracts and known risks.
• What has to change: end-of-life hardware and software, security gaps and systems holding staff back.
• When and in what order: priorities by quarter, so spending is planned instead of reactive.
• What it costs: a budget view the business plans around.
• Who owns each item: so decisions get made and actions get done.

IT strategy and planning: the deadlines for 2026 and 2027

Most IT strategy and planning for 2026 starts with Microsoft's support dates. After a product's end of support date it stops getting security fixes, unless you pay for Extended Security Updates (ESU), which cost more each year and only buy time.

• Windows 10: end of support was 14 October 2025, except certain LTSC editions. Businesses can buy up to three years of ESU, one year at a time, and a business joining in a later year pays for the years it missed. The computer still needs replacing at the end.
• Windows Server 2016: extended support ends on 12 January 2027. Microsoft offers ESU for up to three years for servers that cannot be upgraded in time. Upgrading to Windows Server 2019 only moves the deadline to 9 January 2029, while Windows Server 2025 is supported to 14 November 2034.
• SQL Server 2016: extended support ended on 14 July 2026. Many line-of-business applications run on SQL Server, so check the database behind yours.
• Office 2016 and Office 2019: both reached end of support in October 2025.
• Microsoft 365 Apps on older systems: Microsoft will keep providing security updates for Microsoft 365 desktop apps on Windows 10, Windows Server 2016 and Windows Server 2019 until 10 October 2028. That buys time for the apps, not for the operating system underneath them.

Budgeting for IT: the instant asset write-off

Hardware replacement is easier to plan when you know the tax treatment. The $20,000 instant asset write-off is now permanent from 1 July 2026. Small businesses with aggregated turnover under $10 million can deduct the full cost of eligible depreciating assets costing less than $20,000 in the income year they are first used or installed ready for use. The threshold applies to each asset, and it is a deduction, not a cash payment. Confirm your position with your accountant before timing a purchase around it.

IT consulting for compliance: what your plan has to cover

A roadmap for an Australian business has to cover the reporting and record-keeping rules you fall under. These three apply to many businesses of 15 to 70 staff.

• Notifiable Data Breaches scheme: covers businesses and not-for-profits with annual turnover above $3 million, plus private sector health service providers, credit reporting bodies, credit providers, entities trading in personal information and tax file number recipients. If you are covered, your plan needs a tested breach response process.
• Ransomware payment reporting: since 30 May 2025, businesses with annual turnover above $3 million, and responsible entities for some critical infrastructure assets, must report a ransomware or cyber extortion payment to ASD within 72 hours. Failing to report can attract a civil penalty of up to 60 penalty units. Build the reporting step into your incident response plan.
• AML/CTF Tranche 2: since 1 July 2026, lawyers, accountants, real estate agents, conveyancers, precious metals dealers and trust and company service providers that provide designated services must verify customer identities, report suspicious activity and keep records for seven years. Seven years of records means storage, backup and retrieval decisions in your IT plan.

Insurers and enterprise customers also ask about security controls at renewal or through supplier questionnaires. Our IT security team covers the protection side, and our Essential Eight and SMB1001 pages explain how those frameworks work.

IT consultancy for businesses of 15 to 70 staff

Most IT consultancy is built for large organisations. At 15 to 70 staff it works differently: fewer systems, a smaller budget, and decisions made by the owner or a general manager instead of an IT committee. Business IT consulting services at this size should end in a clear set of decisions, not a thick report. The same questions come up again and again: when to replace laptops, whether the office server still needs to exist, which line-of-business software to keep, and how to answer the security questions insurers and customers ask.

Small business IT consulting: what happens without an IT plan

Without a plan, technology decisions get made one at a time, usually under pressure. The patterns are easy to spot:

• Licences renew on autopilot, including ones nobody uses any more.
• Hardware fails together, because it was all bought in the same year and never scheduled for replacement.
• Software gets chosen by whoever is selling, not by what fits how the team works.
• Support deadlines arrive as surprises, such as a server reaching end of support with no replacement budgeted.
• Security questions arrive late, often in an insurance renewal or a customer questionnaire with a deadline.

A roadmap does not remove these decisions. It moves them to a time when you can make them calmly.

IT consulting by industry

We plan technology for accounting, engineering, construction, consulting, financial services, healthcare, aged care and education businesses. Each brings its own priorities.

• Accounting firms: practice management software, client portals, and record-keeping for firms providing designated services under AML/CTF Tranche 2.
• Healthcare and aged care: private sector health service providers fall under the Notifiable Data Breaches scheme whatever their turnover, so breach response planning sits high on the roadmap.
• Engineering and construction: large project files, specialist design software and site teams, so the file server and cloud decision carries more weight.
• Financial services and consulting: client data, supplier questionnaires and insurer questions about security controls.
• Education: shared devices, student and staff accounts, and access control across both.

IT advisory services: when independent advice pays off

IT advisory services give you senior advice without committing to a project: a second opinion on a quote, a review before renewing a major contract, or someone in the room when you choose new software. An independent adviser has no product to sell you, so the advice is about what fits. Large information technology consulting firms and technology consulting firms usually engage through projects. For a business of 15 to 70 staff, a standing arrangement for business technology advisory services often works better, because the adviser already knows the history when the next decision comes up.

Cloud strategy: deciding what moves, and when

A cloud strategy decides which systems move to the cloud, which stay where they are, and in what order. For most businesses of this size, email and files moved to Microsoft 365 long ago. The harder decisions are the line-of-business application, the file server still in the office, and how staff connect securely from home. A Windows Server 2016 machine reaching end of support in January 2027 is often what forces the decision. When a move is agreed, the work runs as a cloud migration project, and Microsoft 365 consulting makes sure the tools you already pay for are set up well.

Questions to answer before choosing a provider for any cloud move:

• What does the software vendor support, and what will it take to run in the cloud each year?
• How will staff connect, and what happens when the internet drops?
• Where will the data live, and how is it backed up?
• What is the plan to move back if the change fails?

IT consulting and services: which does your business need?

You need consulting when:

• you are about to spend significantly on technology
• a major contract or system is up for renewal
• a server or operating system is approaching end of support
• you are growing, merging or moving office
• a customer or insurer is asking hard questions about security.

You need ongoing IT services when staff need help every day, devices need patching and monitoring, and you want someone accountable for things working. Many businesses need both, and it works best from the same team.

What an IT consulting engagement involves

An IT consulting engagement with Elscomm starts with a free assessment, then runs in four steps, whether it is a one-off review or an ongoing vCIO arrangement:

• Review where you are: your systems, devices, licences, contracts and the business goals they need to support.
• Build the roadmap: a prioritised plan of what changes, when, in what order and what it costs.
• Make the decisions: with your leadership, so each item has an owner and a date.
• Keep it current: regular reviews check what has been done, what has changed in the business and what comes next.

Between reviews, your adviser is the person you call before signing a technology contract or approving a major purchase.

What an IT consulting agreement should cover

Before any engagement starts, the scope should be in writing. A clear IT consulting agreement sets out what will be reviewed, what you receive and when, how often the adviser meets your leadership, who owns each recommendation, how the adviser is paid and whether they earn anything from what they recommend, and how either side can end the arrangement.

Choosing an IT consulting company in Sydney

Ask these questions before engaging an IT consultant or computer technology consultants:

• Will the person advising us also know how our systems run day to day?
• Do you earn commission on anything you recommend?
• What will we have in our hands after the first engagement?
• How do you handle recommendations you would not implement yourselves?
• Can we speak to a client of a similar size?
• Is the team close enough to come onsite when it matters?

Talk to us about IT strategy.

IT consulting questions answered

What does an IT consulting company do?

An IT consulting company advises businesses on technology decisions: what to buy, replace or retire, how to budget for it, and how to cut risk. Some also run the projects that follow from the advice.

What are IT consulting services?

Technology planning, roadmaps, vendor and licence reviews, project oversight and risk advice. For businesses of 15 to 70 staff, they often run as an ongoing virtual CIO instead of one-off projects.

Do we really need an IT strategy?

Yes, once technology decisions feel reactive or disconnected from where the business is going. An IT strategy gives you clear priorities, planned spending and fewer surprises, such as a server reaching end of support with nothing budgeted.

What is a vCIO and do we need one?

A vCIO is a part-time senior adviser who owns your technology plan and meets your leadership on a set schedule. A business of 15 to 70 staff rarely needs a full-time CIO, but most benefit from someone owning the roadmap and budget.

How do we choose the best IT consulting company in Sydney?

Look for five things: advisers who also know how your systems run day to day, no commission on what they recommend, a written roadmap after the first engagement, references from businesses your size, and a team close enough to come onsite. Elscomm is a Microsoft Partner and has supported Sydney businesses of 15 to 70 staff since 2006.

How does IT consulting work?

It starts with a review of your current systems and business goals, followed by a prioritised plan. Ongoing consulting then meets regularly to update the plan as the business changes. At Elscomm, the first step is a free assessment.

How does IT consulting make our IT run better?

By replacing ad hoc decisions with a plan. Systems get replaced before they fail, licences match what people use, projects are scoped before anything is bought, and support effort goes into the systems the business depends on most.

Should we pay for Windows 10 ESU or replace the computers?

For most businesses, replace them. ESU costs more each year, runs for three years at most and still leaves you replacing the computer at the end. It works best as a short bridge while the last machines move to Windows 11.

What happens when Windows Server 2016 reaches end of support?

After 12 January 2027, Microsoft releases no further security updates for Windows Server 2016 unless the server is covered by Extended Security Updates. Your options are to replace it, upgrade it, move the workload to the cloud, or buy ESU as a bridge.

Can we claim new laptops and IT equipment under the instant asset write-off?

Businesses with aggregated annual turnover under $10 million can immediately deduct qualifying assets costing less than $20,000 each, as long as the asset is used or installed ready for use for a taxable purpose. Check the details with your accountant.

Do we have to report a ransomware payment?

Yes, if your annual turnover is above $3 million. The payment must be reported to the Australian Signals Directorate within 72 hours of paying or learning a payment was made. Paying a ransom is not illegal in Australia, but the reporting is mandatory.

Does AML/CTF Tranche 2 affect IT for accounting firms?

Yes, for firms providing designated services. Obligations include enrolling with AUSTRAC, an AML/CTF program, a compliance officer, staff training, customer due diligence and reporting suspicious matters. Your IT plan needs to cover identity verification tools and seven-year record storage.

What is the difference between IT services and IT consulting?

IT services keep today running and help staff. IT consulting plans the future and advises leadership. Consulting works best when the adviser also knows how your systems run day to day.

How do you run an IT upgrade project with outside help?

Agree the scope and outcome before anything is bought, name one owner on each side, and plan the change around your business calendar instead of the supplier's. Test with a small group first, keep a way back if something goes wrong, and finish with documentation your team can use.

What is the difference between managed IT services and IT strategy consulting?

Managed IT services keep your systems running day to day. IT strategy consulting shapes where those systems are heading. Elscomm offers both, so the people planning your technology also know how it runs.

Can Elscomm help with our IT strategy?

Yes. We start with a free assessment, then work with Sydney businesses of 15 to 70 staff through a one-off review or an ongoing virtual CIO, and we support the day-to-day IT as well.

Sources: Microsoft Lifecycle, ATO instant asset write-off, OAIC Notifiable Data Breaches, ASD ransomware payment reporting and AUSTRAC AML/CTF reform. Last reviewed September 2026.