Does your IT team effectively manage all the technology used in your organization? It’s highly likely that some of your staff utilize unauthorized information technology (IT), or “shadow IT”. By 2027, 75% of employees are expected to use technology outside the control of IT teams. People may use shadow IT solutions (technology which isn’t managed by your IT team) because they want to fill perceived tooling gaps left by “official” or “approved” solutions. Shadow IT solutions often encompass cloud services, or applications, browser extensions and other tools downloaded from the internet to enhance productivity. “Home grown” tools developed within your organization also qualify as shadow IT solutions if they’re outside the control of your IT team.

Why should you care about shadow IT?

In addition to excess spending, technology that isn’t properly governed can introduce risks such as:

• Entrusting your data to suppliers which:
  • are not bound by contractual confidentiality commitments and/or
  • don’t meet your supplier eligibility criteria
• Processing your data in vulnerable systems with unpatched software
  • Vulnerabilities in products and environments can be exploited by malicious actors to negatively impact data confidentiality, availability or integrity, such as systems which are subject to a ransomware attack
• Compromising your computing environments with backdoors or other hidden and nefarious mechanisms
  • Downloaded utilities or programs may have been compromised by malicious actors, such as the corruption of the XZ utils library

Now imagine the benefits that your organization could realize, if you have an accurate inventory of all technology deployed across the business, those systems are managed by IT professionals, technology is aligned with your business objectives. You could even cut spending by 10%. Would that be beneficial?

Technology governance brings shadow IT into the light

Technology governance is a framework of policies, processes and standards that align technology investments with business objectives such as cost management and data protection. Careful planning is particularly important when adopting emerging technologies because new solutions often introduce risks along with opportunities. To maximize efficacy, technology governance should:

• Be incorporated into organizational culture, with strong executive support
• Implement clearly documented strategies and policies
• Engage a variety of stakeholders at the operational level

As noted by Harvard Business School, CIOs must be effectively involved in IT governance for it to succeed. Deloitte’s Tech Trends 2024 report recommends that executives consider technology health, rather than technology debt.

Benefits of technology governance

Prepare for technology governance

Begin by selecting an executive sponsor with the right expertise and span of control. That sponsor writes a charter for a cross-functional governance committee and then selects committee members based on their technical skills, financial management expertise, organizational knowledge and ability to collaborate. This committee oversees technology investment decisions and the alignment of technology with business strategy and objectives. Example technology governance charters are available from Massachusetts Institute of Technology (MIT), San Francisco State University (SFSU) and the University of Washington (UW).

5 steps to launch the committee

1. Identify and engage advisors and stakeholders in technology, finance and key processes across the organization.
2. Define their processes, including change management and escalation procedures
3. Decide what tools or systems will be used for committee’s processes, such as:
   • ticketing tool to manage requests for new technology or technology retirement
   • technology asset inventory
   • analytics for operational and executive reports about costs and technology assets
4. Document and communicate guidance, to help employees comply with governance processes.
5. Identifying already-deployed technology using surveys, interviews and IT tools such as network scanning.

Recommendations

Selecting the right cloud providers should be an inherent part of your IT governance effort.  As described in the case study and checklist for evaluating cloud providers, selecting the right  services which satisfy your quality, functional, security, reliability and cost criteria. The evaluation process involves defining requirements, evaluating companies, and then determining how well the specific products meet your requirements.