Shadow IT

Policies tell employees they may not use unsanctioned IT resources such as online storage, unapproved mobile applications and unapproved devices, and security awareness training covers how to identify and report shadow IT.

CSF 2.0 outcome: inventories of services provided by suppliers are maintained. Priority Medium. R1: current and automatically updated inventories of the services the organization's suppliers provide should be available for use in finding and addressing vulnera...

Baseline control principles for it asset management (required of every AI (minimum for a low inherent risk)). An inventory of IT assets (hardware, software, data and systems, hosted internally and externally) is kept, with accountability for it assigned;

Include multifunction devices and special-purpose devices (video conferencing, IP phones, network cameras, access control, building management, environment monitoring) in the register; include third-party assets where needed on a risk basis;

End user computing and shadow IT (hardware, software and services not managed by the IT department) raise the risk of data leakage and malware and should be managed as information assets.

Since much cryptography arrives through suppliers, the organisation maps its cryptographic supply chain: for each supplier the products supplied, whether contracts are running and how to contact them, including certificate authorities, internal communication a...