The sequence
The order matters more than the menu
Boards do not approve three-year roadmaps. They approve 90-day proofs that pay for themselves. IIG sequences airport programs so each layer is earned by the one before, and funded by the savings of the last.
Ownership first. Decide who holds the through-line across the next three budget cycles. The technology choice is the second decision, not the first.
Inventory second. If the first step of the transformation is a new Excel spreadsheet, the transformation has already failed. Build the systems inventory in a structured database — owners, data flows, integration points, contracts, renewal dates — and let it become the first proof that the organization can run on structured data.
One visible quick win third. Pick a duplicate-entry pain point everyone in the operation already complains about. Fix it. Document the saving in time, errors, and invoiced hours. Use it to fund the next step.
From there, the layers sequence themselves. Data foundation. Reporting on top. Then AI. Then automation. Each layer earns the next. Cybersecurity runs in parallel from day one because the threat exists regardless of foundation maturity.