Technology Strategy & Roadmaps

The 2026 Plan Needs a Not-Doing List

Planning season rewards additions. A short not-doing list, recording what you will stop, defer and decline, protects the work you actually fund.

A laptop with stationery and a phone on a dark desk.

Every planning season produces more projects than any team can deliver. The spreadsheet grows to forty lines, everything is priority one, and by March the plan is quietly failing. Nobody failed. The arithmetic failed.

The fix is not a better ranking of forty projects. It is a shorter plan. And the tool for shortening it is the least popular artifact in planning: the list of what you will not do.

Key takeaways

  • A plan that lists everything funds nothing properly.

  • The not-doing list is a decision record: stopped, deferred and declined, each with an owner.

  • Stopping work is how new work gets the capacity it needs.

  • Saying no in December is cheaper than quietly failing next September.

  • Deferred is not dead. Give each deferred item a revisit date so it does not haunt every meeting.

Step 1: Start with capacity, not wishes

Count honestly what the team can deliver next year: the people, their realistic project hours after the day job, the budget that survived the first pass. That number is the container.

Now size the work that is already committed: keeping the lights on, the projects mid-flight, the obligations with dates on them. What remains is what new work can actually claim. For most companies the remainder is two or three real initiatives, not ten.

Step 2: Name what stops

Every portfolio has projects that continue because stopping them feels like admitting something. The half-finished migration, the tool three people use, the report nobody reads. Each one consumes the capacity the plan pretends is free.

Stopping is a decision, which means it needs an owner and a date, like any other. "We are stopping this in January, here is who winds it down" is a complete sentence.

Step 3: Defer with a revisit date

Some ideas are good and merely early. Deferral done well names when the idea comes back: not "later," but "at the Q2 review." A deferred item with a date stops lobbying for attention, because its advocates trust the process.

A deferred item without a date resurfaces in every meeting and consumes the attention it was deferred to save.

Step 4: Decline the rest in writing

The remainder gets a clean no, recorded where the plan lives. This feels harsh in December and feels like leadership in June, when the funded work is on track precisely because the plan said no early.

This fictional example shows the record. It is an illustration, not a prescription.

Item Decision Owner Revisit Capacity freed
Legacy reporting tool Stop in Q1 Operations lead n/a Half a person
Customer portal rebuild Defer Product lead Q2 review Two people
New expense system Decline for 2026 CFO n/a Project budget

The Q4 project triage covers deciding which in-flight work finishes the year, and getting security into the product plan is the argument for what must stay on the doing side of the line.

Frequently asked questions

Won't stakeholders push back on the not-doing list?

They will, and that conversation is the plan working. A visible no with a reason and a revisit date is far easier to defend than a quiet failure discovered later. Pushback that changes the decision should change it in the open, with capacity re-added to match.

How long should the not-doing list be?

Long enough that the doing list fits the capacity you actually have. For most teams that means the not-doing list is the longer of the two, especially in the first year anyone writes one.

Can security work be deferred like anything else?

It can, but the deferral is a risk decision and should be recorded as one: what exposure continues, who accepted it and when it gets reviewed. That record is what separates a deliberate deferral from an unnoticed gap.

Who owns the not-doing list?

The same executive who owns the plan. The list only works if the person who can say no is the one keeping it.

A Defensible Next Step

Before the plan goes to the board, put the not-doing list next to it. If the plan has no second page, it is not finished. Book a Decision-Clarity Call if you want a working session to build both lists.

Next step

Get Board-Ready on AI and Cyber Risk

A 30-minute call. No charge. You'll leave with a clear read on where your oversight stands and what to do about it.

Stop Guessing. Start Scoring
Tyson Martin

Written by Tyson Martin, NACD.DC

Chief Trust, Security & AI Officer. CISO of record at MIO Partners; former CISO & CTO at Lumber Liquidators and Orvis; advisor to 200+ Fortune 500 boards and C-suites at AWS.

See the track record
Keep reading

More on Technology Strategy & Roadmaps

All CISO Insights
Technology Strategy & Roadmaps

When the CTO Says We Need to Rebuild

A rebuild proposal is a large bet. Test it against repair, phased replacement and doing nothing, and ask for evidence that the current system cannot scale.

Technology Strategy & Roadmaps

Shadow IT: Finding What Procurement Never Approved

Teams adopt tools without asking. Discover them, classify the risk, then decide to legitimize, replace or block. A five-step workflow for executives.

Technology Strategy & Roadmaps

Legacy System Replacement: The Go/No-Go Questions

Replace, wrap or tolerate an aging system? A go/no-go scorecard weighs business criticality, failure risk, replacement cost and migration risk.