Certified: The ISACA CISA Prepcast

Welcome to The Bare Metal Cyber CISA Prepcast. This series helps you prepare for the exam with focused explanations and practical context.
Shadow IT refers to systems, applications, and devices that are used within an organization without formal approval or oversight from the IT department. These tools may include cloud-based file sharing services, personal collaboration platforms, unauthorized browser extensions, or even entire systems purchased by departments without going through procurement. Shadow IT is typically adopted by users seeking speed, convenience, or capabilities that official tools may lack. But while Shadow IT can improve short-term productivity, it introduces significant long-term risks. These include security vulnerabilities, compliance failures, and operational inefficiencies. From an audit perspective, Shadow IT undermines centralized visibility, control enforcement, and risk governance. The CISA exam frequently includes scenarios that involve unapproved technologies, highlighting the need for auditors to understand both how Shadow IT arises and how it should be managed.
Common examples of Shadow IT appear in almost every modern organization. These include popular Software as a Service applications like Google Docs, Trello, Dropbox, or Slack used without a formal security or legal review. They also include browser add-ons, unsanctioned communication tools, and third-party platforms adopted by departments without consulting IT. Personal laptops or mobile devices that access work email or company files also qualify when they lack proper device management or security controls. In some cases, entire solutions—such as a marketing automation platform or a customer relationship management tool—are procured and used by business units without any involvement from IT, risk management, or legal. Auditors must assess both sanctioned and unsanctioned environments, and evaluate whether informal workarounds introduce risk to data, systems, or compliance. On the CISA exam, expect scenarios where auditors must evaluate the presence or impact of tools deployed outside standard governance structures.
Shadow IT introduces a wide range of risks. Data loss or leakage is a primary concern when sensitive information is stored in or transmitted through unmonitored applications. These tools may not encrypt data, may lack access controls, or may retain data after user departure. Compliance risk is another major factor—especially when personal or regulated data is involved and stored in environments that fail to meet applicable laws or contractual requirements. Shadow IT tools typically fall outside backup procedures, patching processes, and vulnerability scans. There is no consistent logging or monitoring of user activity, making it difficult to detect breaches or prove compliance. In addition, Shadow IT increases integration complexity. Business functions may become reliant on unsupported or unstable tools that cannot scale, cannot be centrally managed, or cannot connect securely to core systems. CISA candidates must understand how Shadow IT undermines both control design and risk awareness.
Understanding why Shadow IT arises is essential to managing it effectively. Users often turn to unapproved tools when official solutions are perceived as inadequate, slow, or unavailable. A cumbersome approval process, slow helpdesk response, or lack of awareness about existing IT resources can drive users to adopt their own tools. Sometimes the problem lies not in the tool itself but in the absence of support or training. In other cases, departments may have legitimate needs that IT has not yet addressed. Auditors must evaluate not just the presence of Shadow IT, but the organizational conditions that allow it to grow. Addressing the root cause is critical to creating lasting improvements. On the exam, CISA candidates should be able to distinguish between isolated policy violations and systemic governance failures that create environments where Shadow IT thrives unchecked.
Detection of Shadow IT requires both technical tools and human input. Network traffic monitoring can detect connections to cloud services or external platforms not listed in the organization’s approved app catalog. Endpoint management solutions can identify installed software, browser extensions, or unmanaged devices accessing internal systems. Cloud Access Security Broker tools—commonly known as CASBs—can analyze user behavior, detect use of unapproved SaaS applications, and enforce access policies. In addition to technical detection, surveys and interviews may reveal informal processes, file-sharing habits, or tool preferences not visible in system logs. Incident data and audit trails can also expose Shadow IT indirectly, by identifying anomalies in data movement or unauthorized tool use during investigations. CISA exam scenarios may require interpreting findings from these tools to identify the extent and implications of Shadow IT usage.
Mitigating Shadow IT begins with education and enablement. Users must understand the risks posed by unsanctioned tools—not just in terms of policy violations, but in terms of real consequences like data loss or compliance failure. Organizations should provide a catalog of approved applications that meet security and operational requirements. A self-service portal with quick reviews and streamlined requests helps users find what they need without resorting to unofficial solutions. Technical controls such as data loss prevention tools, firewall rules, and DNS filtering can block access to certain tools or at least restrict sensitive transactions. Risk and legal review should be required for any new tool, and users should be guided toward appropriate alternatives where possible. Auditors assess whether these controls are implemented, whether adoption is widespread, and whether users feel supported—not just restricted. CISA candidates should be prepared to evaluate both the control design and the control experience.
Access and data protection policies must be enforced consistently across authorized and unauthorized tools. If users access business data through personal devices or unsanctioned tools, organizations must apply controls like multi-factor authentication, encryption, and access logging. Personal devices must be managed with mobile device management tools if they are allowed to connect to corporate systems. File uploads and downloads should be monitored, with restrictions in place to prevent movement of sensitive data into external tools. Access should only be allowed through secure endpoints that meet baseline security standards. Auditors evaluate whether these policies are documented, whether they cover all relevant endpoints and accounts, and whether technical enforcement matches stated policies. On the exam, CISA candidates may be asked to identify policy coverage gaps or determine how Shadow IT behavior escapes existing security controls.
Shadow IT must also be addressed within vendor management and third-party risk programs. Tools adopted informally may involve external vendors who never undergo security assessment, contract review, or compliance validation. This creates blind spots in the supply chain. Vendor sprawl and overlapping tools increase cost and complexity. Organizations must monitor for unauthorized vendors and include them in the risk register and incident response framework. If Shadow IT is discovered, escalation procedures should define how to address use of unauthorized tools—whether through policy enforcement, alternative solution identification, or formal onboarding of the vendor. Auditors assess whether risk management processes cover these tools, and whether incident response and vendor oversight include provisions for Shadow IT. CISA scenarios may involve vendor-related risk resulting from tools introduced outside procurement or vendor review processes.
Policy and governance are at the center of Shadow IT prevention and response. Acceptable use policies must clearly define what constitutes unauthorized tools, what the consequences are for violations, and how exceptions are handled. These policies must be communicated to employees during onboarding and through regular awareness campaigns. Routine reviews of asset inventories and app usage should be conducted to identify discrepancies. Responsibility for Shadow IT monitoring and governance must be assigned to specific teams—often a combination of IT security, compliance, and risk management. Auditors evaluate whether governance roles are defined, whether reviews are conducted, and whether corrective actions are implemented. CISA candidates may be tested on how governance failures contribute to Shadow IT or how to assess whether policy enforcement is adequate.
For CISA candidates, evaluating Shadow IT means understanding how informal technologies bypass standard governance and control processes. You must assess whether the organization has visibility into unsanctioned tools, whether it provides supported alternatives, and whether detection, mitigation, and response controls are in place. Expect questions on network monitoring, policy enforcement, risk review workflows, and user education. You may be asked to analyze how Shadow IT affects data security, compliance obligations, and operational resilience. As an auditor, your role is not just to identify unauthorized tools—but to evaluate whether the organization is creating conditions where Shadow IT is necessary. Shadow IT cannot be eliminated completely, but it can be governed. With the right balance of policy, control, education, and enablement, organizations can support productivity while protecting the enterprise from hidden risk.
Thanks for joining us for this episode of The Bare Metal Cyber CISA Prepcast. For more episodes, tools, and study support, visit us at Baremetalcyber.com.