Shadow IT Risk Checklist

Use this checklist to identify potential areas of risk in your organisation caused by Shadow IT.

Discovery

• Have you performed a network scan for unrecognized apps or cloud services?
• Are there employees using personal cloud accounts for business data?
• Do you monitor browser extensions or unauthorized device access?

Policy & Control

• Do you have an Acceptable Use Policy (AUP) in place and regularly reviewed?
• Are there restrictions on app installations on corporate endpoints?
• Do you enforce data handling rules across all departments?

Training & Awareness

• Are employees aware of Shadow IT and its risks?
• Have you conducted user training in the past 12 months?
• Are staff empowered to suggest new tools for formal review?

Response

• Do you have an incident response plan that includes Shadow IT events?
• Is there a documented remediation workflow?
• Can users report Shadow IT sightings easily?