Shadow IT It's no longer in the shadows

Amy Cheney, Chief Information Officer, City of Bloomington

Amy Cheney, Chief Information Officer, City of Bloomington

Shadow IT is not a new topic, but it’s ever-present. The ability to easily click through the steps to get a new software tool has made it impossible to ignore. One might say shadow IT is here to stay. If that’s the case, we all need to become comfortable with it. This isn’t something IT professionals necessarily want to do, but we must do it. It's as important as hardening our defenses against cyber-attacks and maintaining software licensing.

Developing guidelines for your employees to refer to as they contemplate tools they need that aren’t currently in the approved catalog of offerings is key. It’s a tricky balancing act that requires trust and communication. Guidelines can make it clear that IT recognizes cases where the tools offered may not meet the needs of all employees. Additionally, guidelines should spell out expectations for both end users and IT.

The first step is to ask your employees to review the current software offerings. This may require them to strike up a conversation, especially if you don't have an up-to-date software catalog. In our case, the catalog exists but is not entirely user-friendly. If you are more mature in your approach, you’ll likely have an online catalog that is easy to navigate and allows end users to request a license. At any rate, it’s important that you stress how important it is to look at what exists before determining if a new tool is needed.

Second, and here's where the trust comes in: we ask our employees to inform us before they begin using software not currently licensed by the city. Make it clearthat an employee’s personal preference for one solution over another is not a good reason to acquire software that isnot currently available. When employees come to IT first, they run the risk of IT saying ‘no’ or ‘not right now’ delaying their progress. It's important to listen as we work to support our end users' needs. That's not to say we can say yes to everyone, but it puts responsibility on the employee when the answer is yes. Again, that’s a huge trust component.

We trust employees are aware of and follow all licensing requirements. This is something that IT is usually quite good at, but the typical employee doesn't have much experience with it. Before they click the buy button, they need to understand what they are agreeing to.

"There’s no perfect or easy solution when considering what to do about shadow IT. It’s up to us leaders to help our employees navigate the many options and be partners and develop trust."

Employeesmust also follow all security requirements and city policies when using these tools. One set of policies that might be easy to ignore is data management. Things like where the data resides, data classification, data access, and data security must be considered before anyone clicksthe buy button. Staff must have a plan for what happens to the data if they were to leave employment. It’s a lot to ask, but if it gives an employee the freedom to use a tool that will enhance their productivity and engagement, it just might be worth it.We ask that when we do offer a solution that has the elusive features that had been lacking,the employee adopts it in a reasonable timeframe.

It’s easy to see why communication makes the difference in this process. Employees may make note of the guideline when it's first rolled out but quickly forget about it. Of course, new employees have no way of knowing about the guidelines if they’re not communicated on a regular basis. Unfortunately, they tend to learn about it when we are saying ‘no’ and that’s not welcoming or productive.

When communicating the rules, it’s important to use various methods. One technique I’ve found to be very valuable and productive is communication with supervisors. They have the most daily interaction with end users and can be great partners when making sure employees understand expectations.

There’s no perfect or easy solution when considering what to do about shadow IT. It’s up to us leaders to help our employees navigate the many options and to really be a partner and develop trust. Let’s focus on talking about it and making those connections before we are surprised by the latest, coolest software.