Fighting Shadow IT

The bane of any IT manager or IT dept in general for that matter is “Shadow IT”. It’s difficult to deal with, hard to stop, and ultimately when it becomes a problem, it becomes IT’s problem.

Briefly, for anyone who doesn’t know, Shadow IT refers to any activity by a department to put technical solutions in place under the radar of the IT department. For example, Accounting getting some software in place that helps them reconcile books. Maybe Marketing reaches out to an MSP to get some new site hosted on Google Cloud. Maybe the Operations department is getting a backup provider put in place to sync their documents together. These are just some examples of Shadow IT but the situations are truly endless. Often, these solutions will be put in place with little to zero input from IT and after a certain period of time it eventually falls on IT to manage something they never sanctioned.

So, what can you do? Well, the biggest thing that can be done to prevent the situation is making sure IT is involved with department heads. Make sure as an IT manager that you are reaching out regularly to make sure they have everything they need. Keeping the door open will help make sure that departments come to you first if they have a need instead of just discounting IT as the option. It also makes it easy to set the expectation of anything technical going through IT.

Beyond that, it’s good to make sure that IT is responsive to requests. More often than you might expect the reason a department leaves IT out of the loop is because they feel IT is too slow to respond and help. They can’t wait on IT for 2 weeks to decide on a solution if they only have 2 weeks to finish a project completely. Everyone has deadlines so it will help IT if they are responsive to new requests.

The next thing, even if you don’t have a need to keep developers on staff, it’s a very good idea to have a few development shops in your pocket should you need them. If you have one that you’ve used previously and liked, it’s a good idea to keep some contact so you know you can get hours from them should you need them.

These are probably the best things you can do to prevent shadow IT, but what about all the Shadow IT implementations already in your company? Well first thing is identifying what is and isn’t worth bringing under ITs management. For example, an online service that helps with scheduling tweets for marketing probably isn’t worth putting effort into. However, a hosted WordPress instance for a marketing run loyalty site is definitely worth trying to get control over so that you can make sure they follow the security policies.

Once you’ve identified the resources, next you want to figure out what skillsets are needed to maintain them. For example, maybe databases need to be migrated or maybe a custom tool that Accounting uses will need to be updated from time to time. If you don’t have these skills in-house, it’s time to tap into those dev shops mentioned above to see if a simple support agreement can be worked out to help here and there.

The goal in fighting Shadow IT isn’t just “being in control” of everything. It’s about maintaining corporate security, service levels, and protecting the IT department from the scenario where suddenly they are expected to scramble in order to support something they’ve only been aware of for a few hours.