Building a Technology Roadmap for a Franchise Network
Networks do not grow by letting every location make independent technology decisions. They grow on a consistent roadmap that supports every site, every employee and every customer — and the consistency is what makes the brand scalable.
The problem most franchise groups face is not a lack of technology. It is a lack of sequence. Every site has systems, and most of them work. But each site was set up at a different time, by a different person, under different assumptions, and nobody owns the joins between them.
A roadmap changes that. It names what to do, in what order, and why — so the network grows on a foundation that gets stronger with every location rather than more complex.
The short answer
Secure every location before you standardise across them; standardise before you automate; prove any change at one site before you roll it to the network; and prepare governance and permissions before you introduce AI anywhere. That sequence — the LOOKUP Business Modernisation Framework — works because each stage makes the next one possible, and reversing it is the most common reason technology investment in a franchise network fails to deliver.
Why sequence matters more than selection
Most franchise networks do not struggle because they chose the wrong tools. They struggle because they did the right things in the wrong order, and the order is what determines whether each investment builds on the last or competes with it.
Standardising before securing means the network is consistent — consistently exposed. A standard applied on top of unmanaged identities and unpatched devices does not reduce risk; it replicates it across every location.
Adopting AI before information is consistent means AI surfaces whatever is in the systems — which may include commercial terms, franchisee performance data or another location's customer information. Permissions at every site determine what AI can see, and inconsistent permissions mean inconsistent exposure.
Rolling out to the network before proving at one site means the first problem is a network problem. A workflow that has not been tested at a single location, with a named owner and a measured result, will fail at scale — and the failure is harder to contain because it is everywhere at once.
The sequence is not a suggestion. It is the difference between a network that gets stronger with every location and one that gets harder to support.
The LOOKUP Business Modernisation Framework™
Building a technology roadmap for a franchise network follows the same eight-stage sequence every LOOKUP engagement uses — because the order is what makes the investment hold as the network grows.
Understand the current environment
Protect identities, devices and information
Remove legacy technology constraints
Create consistent systems and processes
Improve workflows and productivity
Establish governance and AI readiness
Introduce technology deliberately
Measure, review and continuously improve
Understand the current environment
Protect identities, devices and information
Remove legacy technology constraints
Create consistent systems and processes
Improve workflows and productivity
Establish governance and AI readiness
Introduce technology deliberately
Measure, review and continuously improve
Discover
Map the systems across every location — point of sale, networking, devices, Microsoft 365, identity and line-of-business applications — to understand what actually exists before changing anything.
Secure
Enforce multi-factor authentication, conditional access and endpoint protection at every site. One unmanaged location exposes the whole network, so security baselines come before anything else.
Modernise
Remove legacy devices, unsupported software and ad-hoc connectivity that cannot be managed centrally. A network cannot be standardised on foundations that vary from site to site.
Standardise
Define one device build, one identity structure, one set of security policies and one Microsoft 365 configuration. Every new site and every retrofit starts from the same template.
Optimise
Connect recurring work — onboarding, compliance reporting, support routing — so head office is no longer the default path for every site question. Automate what is entirely rule-based.
Prepare
Establish AI governance and permissions groundwork across the network. Permissions at every location determine what AI can and cannot see, so consistency is the precondition.
Implement
Introduce AI and automation one workflow at a time, proven at one site with a named owner and a measured result, before anything is rolled to the rest of the network.
Improve
Review what worked, what did not and what changed as the network grew. A roadmap is a living sequence — it should be revisited as locations open, close and change ownership.
The two tracks running at once
A franchise network that is growing is always running two tracks at the same time. Existing locations are being brought onto the standard, one by one, while new locations are being opened to it from day one. Both tracks need to reach the same destination, and the blueprint is what keeps them aligned.
The new-location track is the easier one because there is nothing to undo. Each site starts from the template, and the question is only whether the template was followed. The existing-location track is harder because every site has a history — a local supplier, a different firewall, a different way of doing things — and each has to be moved while trading.
The roadmap has to account for both. opening each new location to the same blueprint and bringing existing locations onto the standard are different work, but they answer to the same plan and the same sequence.
What comes first for most networks
Identity, access and security baselines almost always precede everything else. The reason is structural: a network is only as secure as its least managed location, and one compromised account at one site can reach further than that site if identity is shared or uncontrolled.
Everything later in the roadmap — standardisation, automation, AI — depends on knowing who has access to what, and on every location meeting the same baseline. If that foundation is not in place, the work built on top of it is built on sand.
For most networks, this is also the area where the gap between the best and worst site is widest, and where the risk of doing nothing is highest. Closing it first means every later stage is applied to a network that is already protected, not one that is hoping to be.
Planning across multiple years
A roadmap for a franchise network is not a single project with a finish date. It is a multi-year plan that is reviewed and adjusted as the network grows, acquires, and changes. The plan covers the major cost categories so decisions are made deliberately rather than reactively.
Devices
Plan the replacement cycle for devices across every location so that hardware is refreshed on a predictable schedule rather than when a site fails. A standard device build means every replacement is the same, and the cycle is manageable at scale.
Licensing
Map Microsoft 365 and application licences across the network so that the business is not paying for unused seats at one location while short at another. Centralised licensing makes the true cost visible and adjustable.
Cloud services
Identify which cloud platforms the network depends on and when renewals fall due. A multi-year view prevents surprise renewals and gives the business time to consolidate or renegotiate before a deadline forces a rushed decision.
Security
Schedule security uplifts — multi-factor authentication rollout, conditional access policies, endpoint protection upgrades — so they are sequenced across sites rather than attempted everywhere at once. The plan keeps security moving without overwhelming the network's capacity to absorb change.
Network growth
Factor in the locations the business expects to open, acquire or close over the planning horizon. The roadmap should accommodate growth without being rebuilt every time a site is added — the blueprint is what makes that possible.
The plan is reviewed rather than written once. As the network changes, the roadmap is revisited — not discarded — so it stays relevant to where the business actually is, not where it was when the plan was first drawn.
How to tell which stage you are actually at
The questions below can be answered by a franchisor or multi-site owner without a consultant. Honest answers reveal where the network genuinely sits in the sequence — which is often further back than the business assumes.
Can you list every device at every location?
If the answer involves calling each site or asking a local supplier, the network is still at Discover. You cannot standardise what you cannot see.
Does every location enforce multi-factor authentication?
If any site does not, or if you are not certain, the network is still at Secure. One unmanaged site is a network-wide exposure, not a local one.
Is the same device build and identity structure used at every site?
If each location was set up differently, the network is still at Standardise. A blueprint that has not been defined cannot be followed.
Can head office see the security posture of every site in one place?
If visibility depends on asking each site, the network is still at Optimise. Central visibility is what makes everything after it manageable.
Has any AI tool been tested at one site with a named owner and a measured result?
If the answer is no, the network is still at Prepare or earlier. AI proven at one site is the precondition for rolling anything to the rest.
When was the roadmap last reviewed?
If there is no review date or the plan has not been revisited since it was written, the network is at Improve in name only. A roadmap that is not reviewed is a document, not a plan.
What a roadmap should contain
A current position
An honest assessment of where the network sits today — which sites are managed, which are not, what is standard and what varies. Without a true starting point the sequence is guesswork.
A sequence with reasons
Not just a list of projects but an ordered plan where each step explains why it comes before the next. The reasons are what keep the roadmap intact when pressure to skip ahead arrives.
A first step small enough to start
A roadmap that cannot begin is a wish list. The first action should be concrete, bounded and achievable without halting trade — identity at one site, a security baseline at the next location due to open.
Named owners
Every stage and every action has a person responsible for it, not a department. Ownership is what turns a plan into work that actually happens, and ambiguity about ownership is what lets work stall.
A review point
A date — not a vague intention — when the roadmap is revisited against what has changed: new locations, closed sites, acquisitions, shifts in strategy. A roadmap nobody owns is a document, not a plan.
How LOOKUP helps
Discovery and assessment
LOOKUP maps the systems, devices, identity and security posture across every location to establish the true current position before any sequence is proposed. The assessment is what makes the roadmap honest.
Blueprint and roadmap development
LOOKUP works with head office to define the standard, sequence the stages and name the owners — often through a Virtual CIO engagement that provides strategic technology leadership without a full-time hire.
Staged delivery across locations
LOOKUP delivers each stage site by site, proving the change at one location before replicating it, so the network absorbs change without stopping trade. LOOKUP coordinates with point of sale and line-of-business platforms rather than replacing them, working alongside the systems franchise groups already run.
The other outcomes in this series
Opening New Locations on a Repeatable Blueprint
How do we open the next location without reinventing technology every time?
Standardising Technology Across the Network
Our existing locations all run differently — how do we bring them onto one standard?
Containing a Security Incident
If one location is compromised, how do we stop it becoming the whole network's problem?
Onboarding and Offboarding
When someone joins or leaves at any location, how quickly and how completely does their access change?
Reducing the Load on Head Office
Why is head office acting as the network's IT helpdesk, and what does it cost us?
For networks ready to look further ahead, preparing the network for AI answers where AI can help across a network and what has to be true at every location first.
Frequently asked questions
What does a technology roadmap for a franchise network actually include?
Why does the order of technology projects matter more than the choice of products?
What should a franchise network do first on its technology roadmap?
How do you run the two tracks — existing sites and new sites — at the same time?
How long does it take to work through a technology roadmap for a network?
What is the LOOKUP Business Modernisation Framework?
Can AI be brought forward in the sequence if the network is keen?
How do you tell which stage of the roadmap the network is actually at?
Who should own the technology roadmap inside head office?
How do independently owned locations fit into a head-office technology roadmap?
What should a multi-year technology plan for a franchise network cover?
How often should a franchise technology roadmap be reviewed?
What happens to the roadmap when the network acquires another group?
Does every location have to be at the same stage of the roadmap at the same time?
Where should a franchise network start if there is no roadmap at all today?
Sources & Further Reading
The following sources inform the security and AI guidance referenced on this page.
- Essential Eight — Australian Signals Directorate's Australian Cyber Security Centre. The baseline mitigation strategies behind the Secure stage of the framework, applied consistently across every location.
- Guidance for AI Adoption — National AI Centre, Department of Industry, Science and Resources. Six essential practices for governing and adopting AI responsibly, relevant to the Prepare and Implement stages.
Evidence Standard
LOOKUP references recognised industry, government and professional sources. Research findings are paraphrased and linked to their originals. LOOKUP's own observations are presented separately from third-party research.
Ready to put your network on a sequenced technology roadmap?
Book a strategy session to assess where your network stands today and what order the work should go in.
Written by
Peter Kantarelis
Founder, LOOKUP — Business Technology Strategist
Peter has spent over 25 years helping Australian businesses align technology with strategy. He founded LOOKUP to give small and medium businesses the same structured approach to security, modernisation and AI readiness that large enterprises take for granted — without the enterprise price tag or complexity.
