Shadow IT is a term often used to describe IT systems and IT solutions built and used inside organizations without organizational approval. It is also used, along with the term "Stealth IT," to describe solutions specified and deployed by departments other than the IT department.
Shadow IT is considered by many an important source for innovation and such systems may turn out to be prototypes for future approved IT solutions. On the other side, shadow IT solutions are not often in line with the organization's requirements for control, documentation, security, reliability, etc.
- 1 Compliance issues
- 2 Examples
- 3 Reasons for use
- 4 Implications
- 5 References
- 6 External links
It is a term used in IT for any application or transmission of data, relied upon for business processes, which is not under the jurisdiction of a centralized IT or IS department. The IT department did not develop it, or was not aware of it, and does not support it. This creates ‘unofficial’ and uncontrolled data flows, which makes it difficult to comply with the Sarbanes-Oxley Act (USA) and many other compliance-centric initiatives, such as:
- Basel II (International Standards for Banking),
- COBIT (Control Objectives for Information and related Technology),
- FISMA (Federal Information Security Management Act of 2002),
- GAAP (Generally Accepted Accounting Principles),
- HIPAA (Health Insurance Portability and Accountability Act),
- IFRS (International Financial Reporting Standards),
- ITIL (Information Technology Infrastructure Library),
- PCI DSS (Payment Card Industry Data Security Standard),
- TQM (Total Quality Management), etc.
Some examples of these unofficial data flows are USB sticks or other portable data storage devices, MSN Messenger or other online messaging software, Gmail or other online e-mail services, Google Docs or other online document sharing and Skype or other online VOIP software, and also other less straightforward products self-developed Access databases and self-developed Excel spreadsheets and macros. Security risks are introduced when data or applications are moved outside protected systems, networks, physical location or security domains.
A 2012 French survey  of 129 IT managers revealed some examples of Shadow IT : Excel Macro 19% software 17% Cloud solutions 16% ERP 12% BI systems 9% Websites 8% Hardware 6% VoIP 5% Shadow IT support 5% Shadow IT project 3% BYoD 3%
Reasons for use
Generally it is believed that employees use shadow IT systems because they think there is no other way to get the data they need to do their jobs. For example, they might use spreadsheets for data analysis because they know how to use them, it is "free", they can exchange information with everyone and, most it gets them the results they need.
A study confirms that 35% of employees feel they need to work around a security measure or protocol to be able to do their work efficiently. 63% send documents to their home e-mail address to continue work from home, even when they are aware that this is probably not allowed.
Besides security risks, some of the implications of Shadow IT are:
Shadow IT adds hidden costs to organizations, consisting largely of non-IT workers in finance, marketing, HR, etc., who spend a significant amount of time discussing and re-checking the validity of certain data, setting up and managing systems and software without experience.
Inconsistent business logic
If a ‘shadow IT’ spreadsheet application encapsulates its own definitions and calculations, it is likely that over time inconsistencies will arise from the accumulation of small differences from one version to another and from one group to another, as spreadsheets are often copied and modified. In addition, many errors that occur from either lack of understanding of the concepts or incorrect use of the spreadsheet frequently go undetected due to a lack of rigorous testing and version control.
Even when the definitions and formulas are correct, the methodology for doing analysis can be distorted by the arrangement and flow of linked spreadsheets, or the process itself can be wrong.
Shadow IT applications sometimes prevent full Return on investment (ROI) from investments in systems that are designed to perform the functions now replaced by Shadow IT. This is often seen in Data warehousing (DW) and Business informatics (BI) projects, which are initiated with good intentions, where the broader and consistent usage of DW and BI in the organization never really starts off.
Shadow IT can be a barrier to innovation by blocking the establishment of more efficient work processes. Additional performance bottlenecks and new single points of failure may be introduced when Shadow IT systems layer on top of existing systems. Data might be exported from a shared system to a spreadsheet to perform the critical tasks or analysis.
Higher risk of data loss or leaks
Shadow IT data backup procedures may not be provided or audited. Personnel and contractors in Shadow IT operations may not be put through normal education, procedures or vetting processes. Originators of Shadow IT systems may leave the organization often leaving with proprietary data or leaving behind complicated systems the remainder of staff cannot manage.
Barrier to enhancement
Shadow IT can act as a brake on the adoption of new technology. Because e.g. spreadsheets are deployed to fill critical needs, they must be replaced carefully. But lacking adequate documentation, controls and standards, that process is slow and error-prone.
Shadow IT creates a dysfunctional environment leading to animosity between IT and non-IT related groups within an organization. Improper motivations behind Shadow IT efforts such as seeking job-security (i.e. "Bob is the only person with this data" or "what will happen if he leaves?"), data hoarding, self-promotion, favor trading, etc. can lead to significant management issues.
Effect on IT Departments
According to Gartner, by 2015, 35 percent of enterprise IT expenditures for most organizations will be managed outside the IT department's budget.
- "Shadow IT - Should CIOs take umbrage?". CXO Unplugged. Retrieved 2012-04-25.
- RESULTATS DE L’ENQUETE SUR LE PHENOMENE DU « SHADOW IT » par Thomas Chejfec : http://chejfec.com/2012/12/18/resultats-complets-de-lenquete-shadow-it/
- Sherman, R., 2004, Shedding light on Shadow Systems, DM Direct, Athena IT Solutions.
- RSA,November 2007,The Confessions Survey: Office Workers Reveal Everyday Behavior That Places Sensitive Information at Risk,available from: http://www.rsa.com/company/news/releases/pdfs/RSA-insider-confessions.pdf
- Raden, N., October 2005, Shadow IT: A Lesson for BI, BI Review Magazine, Data Management Review and SourceMedia, Inc.
- "Predictions Show IT Budgets Are Moving Out of the Control of IT Departments". Gartner. Retrieved 2012-04-25.