Shine a light on “Shadow IT” Razvan Cretu

What is the fuss all about? Definition: Shadow IT, also known as Stealth IT or Client IT, are Information technology (IT) systems built and/or used within organizations without explicit organizational approval, for example, systems specified and deployed by departments other than the IT department.

Why does Shadow IT exist? The corporate IT systems do not provide enough coverage and choice to people so they can perform the actions they need to Lack of adequate training or user awareness sessions on the existing technologies that are deployed by the IT department to perform the function expected by the end user Why do we care? Lack of security controls The strain that it puts on the IT Team to support various systems/integrations

What can we do about it? Use a platform to discover the Shadow IT applications? Try to block access using controls at the network level? Penalize people who are discovered using unapproved applications?

The Process User/Department PMO Finance IT PMO/IT IT/Transformation The change idea PMO Funnel review with the Projects Board Accept or reject the project Finance Issuing Charge Code only to PMO Finance would not accept invoices without the charge code IT Purchase software/hardware (optional) Engage resources PMO/IT Implement change Test Go-Live readiness IT/Transformation Deliver training Prepare QRG Send comms Go-Live The Process

What you need from Management Finance IT Leadership support. Without it, the initiative will fail A PMO group responsible for all projects in the firm (not just IT) A Projects Board that is capable of approving or rejecting a project in a constructive way (do not just say “NO”) Finance Support from the finance team Easy process that allows people to get the funds when needed but not outside the process IT Simple systems that allow people to do their job without going through extra/unnecessary steps A feedback mechanism that allows the users to tell the IT Team what they do not like, or they would like changed An IT Team that is willing to listen and act on the feedback as well as implement solutions fast while in compliance with the security standards

Thank you Questions

Your free online legal information service. A subscription service for legal articles on a variety of topics delivered by email. cms-lawnow.com Your expert legal publications online. In-depth international legal research and insights that can be personalised. eguides.cmslegal.com CMS Legal Services EEIG (CMS EEIG) is a European Economic Interest Grouping that coordinates an organisation of independent law firms. CMS EEIG provides no client services. Such services are solely provided by CMS EEIG’s member firms in their respective jurisdictions. CMS EEIG and each of its member firms are separate and legally distinct entities, and no such entity has any authority to bind any other. CMS EEIG and each member firm are liable only for their own acts or omissions and not those of each other. The brand name “CMS” and the term “firm” are used to refer to some or all of the member firms or their offices. CMS locations: Aberdeen, Algiers, Amsterdam, Antwerp, Barcelona, Beijing, Belgrade, Berlin, Bogotá, Bratislava, Bristol, Brussels, Bucharest, Budapest, Casablanca, Cologne, Dubai, Duesseldorf, Edinburgh, Frankfurt, Funchal, Geneva, Glasgow, Hamburg, Hong Kong, Istanbul, Kyiv, Leipzig, Lima, Lisbon, Ljubljana, London, Luanda, Luxembourg, Lyon, Madrid, Manchester, Mexico City, Milan, Monaco, Moscow, Munich, Muscat, Paris, Podgorica, Poznan, Prague, Reading, Rio de Janeiro, Riyadh, Rome, Santiago de Chile, Sarajevo, Seville, Shanghai, Sheffield, Singapore, Skopje, Sofia, Strasbourg, Stuttgart, Tirana, Utrecht, Vienna, Warsaw, Zagreb and Zurich. cms.law