Shadow IT Policy Template [Free] — Discovery, Risk Assessment & Enforcement

What Is Shadow IT?

Shadow IT refers to any technology — software, cloud services, hardware, or AI tools — used by employees for business purposes without the knowledge or approval of the IT department.

Shadow IT vs BYOD

For BYOD-specific policies, see our dedicated BYOD Policy Template.

Common Types of Shadow IT

Shadow IT Policy Template

1. Policy Overview

SHADOW IT POLICY
Version: 1.0
Effective Date: [Date]
Policy Owner: [IT Director / CISO]
Approved By: [CTO / VP of IT]

PURPOSE:
This policy establishes the rules and procedures for the use of
technology within [Organization Name]. All software, cloud services,
AI tools, and hardware used for business purposes must be approved
by IT. This policy defines the approval process, risk assessment
criteria, and consequences for unauthorized technology use.

SCOPE:
This policy applies to all employees, contractors, and third parties
who use technology to conduct [Organization Name] business, including:
- SaaS and cloud applications
- AI and machine learning tools
- Desktop and mobile applications
- Hardware devices connected to the network
- Browser extensions and plugins
- Free and trial accounts for business use

KEY PRINCIPLE:
If you use it for work, IT needs to know about it.
This doesn't mean IT will say no — it means IT will help you
use it safely or find an approved alternative that works.

2. Shadow IT Discovery Process

You can't manage what you don't know about. Use multiple discovery methods:

Discovery frequency:

3. Risk Assessment Framework

When shadow IT is discovered, assess the risk before taking action.

Shadow IT Risk Scoring Matrix

Total score interpretation:

• 6-8: Low risk — fast-track approval or monitor
• 9-12: Medium risk — require formal review and controls
• 13-15: High risk — remediate immediately, migrate to approved alternative
• 16-18: Critical risk — block access immediately, investigate data exposure

Risk Assessment Template

SHADOW IT RISK ASSESSMENT

Application: [Name]
Discovered: [Date]
Discovery method: [How it was found]
Department: [Who is using it]
Number of users: [Count]
Business purpose: [Why they use it]

DATA ASSESSMENT:
- What company data is stored in this tool? [Description]
- Data classification level: [Public / Internal / Confidential / Restricted]
- Is customer PII/PHI involved? [Yes / No]
- Is data exportable? [Yes / No]

VENDOR ASSESSMENT:
- SOC 2 or ISO 27001 certified? [Yes / No]
- Where is data stored? [Region/Country]
- Does the vendor's ToS allow data use for training? [Yes / No]
- GDPR/CCPA compliant? [Yes / No]

RISK SCORE: [X/18]
RECOMMENDATION: [Approve / Approve with controls / Block / Migrate]
APPROVED ALTERNATIVE: [If blocking, what should users use instead]

4. Approved Technology Catalog

The best way to reduce shadow IT is to provide better alternatives. Maintain a catalog of approved tools by category:

Catalog maintenance:

• Review and update quarterly
• Add new categories when shadow IT discovery reveals common needs
• Include request process (self-service vs. approval required)
• Document why rejected alternatives aren't allowed (data risk, compliance)

5. Software Request and Approval Process

Make it easy for employees to request new tools — friction drives shadow IT.

Request Process

STEP 1: EMPLOYEE SUBMITS REQUEST
  - Via IT portal or Slack bot
  - Required info: tool name, business purpose, data involved, users needed
  - Target response time: 3 business days

STEP 2: IT REVIEWS REQUEST
  - Check if approved alternative exists
  - If new tool: run risk assessment (see Section 3)
  - If approved alternative exists: recommend it

STEP 3: DECISION
  - Approved: IT provisions and configures (SSO, DLP, data controls)
  - Approved with conditions: Specific data restrictions or user limits
  - Denied: Explanation provided with approved alternative
  - Deferred: Needs further evaluation (security review, legal review)

STEP 4: PROVISIONING
  - IT configures SSO integration
  - Data loss prevention controls applied
  - Added to approved catalog
  - Users notified and trained

SLA for software requests:

6. Enforcement and Consequences

Enforcement Approach

The goal is compliance, not punishment. Most shadow IT is well-intentioned — employees trying to be productive. Lead with education, not enforcement.

Amnesty Program

When first rolling out a shadow IT policy, offer a 30-day amnesty period:

• Employees can self-report unauthorized tools without consequences
• IT will assess each tool and either approve, provide an alternative, or help migrate data
• After 30 days, enforcement begins
• This surfaces far more shadow IT than any technical discovery tool

7. AI-Specific Shadow IT Controls

AI tools are the fastest-growing category of shadow IT in 2026. They require special attention.

See our AI Acceptable Use Policy Template for detailed AI governance guidelines.

8. Employee Education

Key Messages

• "We're not trying to block you — we're trying to protect you and our customers"
• "If you need a tool, ask. We'll get you something that works — usually within 3 days"
• "Using unapproved tools puts customer data at risk and can violate our compliance obligations"
• "When you leave the company, data in your personal accounts doesn't come with you"

Training Program

Implementing Your Shadow IT Policy

Phase 1: Discovery (Weeks 1-2)

• Deploy CASB or network analysis to identify current shadow IT
• Review expense reports for SaaS subscriptions
• Survey employees on tools they use daily
• Catalog all discovered shadow IT with risk scores

Phase 2: Assessment and Catalog (Weeks 3-4)

• Risk-assess all discovered shadow IT
• Build approved technology catalog with alternatives
• Identify tools to approve, migrate, or block
• Set up software request process (portal or Slack bot)

Phase 3: Policy Launch (Weeks 5-6)

• Announce shadow IT policy to all employees
• Run 30-day amnesty program for self-reporting
• Conduct training on policy and request process
• Begin migrating data from high-risk shadow IT

Phase 4: Ongoing Management (Continuous)

• Run monthly shadow IT discovery scans
• Process software requests within SLA
• Update approved catalog quarterly
• Report shadow IT metrics to leadership quarterly

Related Resources

• BYOD Policy Template — Personal device security (complementary to shadow IT)
• AI Acceptable Use Policy — AI tool governance
• IT Policy Templates: Complete Guide — All IT policy templates in one place
• IT Security Policy Template — Comprehensive security policy
• Vendor Management Best Practices — Evaluate and manage SaaS vendors

Frequently Asked Questions

Isn't blocking shadow IT bad for productivity?

Blocking without providing alternatives is bad for productivity. A good shadow IT policy provides a fast approval process (3-day SLA) and maintains an approved catalog of tools. The goal is to channel innovation through a secure path, not to stop it.

How much shadow IT does a typical company have?

Research shows the average enterprise has 4x more cloud applications than IT is aware of. For a mid-market company, that typically means 200-400 unknown SaaS applications. Many are low risk (personal productivity tools), but 10-20% involve confidential data.

Should I block or monitor shadow IT?

Start with monitoring and education. Immediately block only high-risk tools (those handling confidential data without security controls). For everything else, give employees time to migrate to approved alternatives. Blocking without warning creates resentment and drives shadow IT deeper underground.

How do I handle shadow IT from executives?

The same way you handle it from anyone else — with education and approved alternatives. Executives are often the worst shadow IT offenders because they're used to making their own technology decisions. Provide white-glove service: personally help them migrate to approved tools that meet their needs.

What's the relationship between shadow IT and zero trust?

Zero trust architecture naturally reduces shadow IT risk by requiring authentication and authorization for every access request. When you implement zero trust, unapproved tools can't access corporate data without going through your identity provider — which gives IT visibility and control.