How to manage shadow cloud in your organisation
Follow these steps — assess the risks of the information being used in shadow cloud services, fitting them with your cloud plan and risk assessment process.
Cut down risks and focus on opportunities
At its core, managing shadow cloud is about reducing risks and taking advantage of opportunities in ways that are appropriate to your organisation’s:
- risk tolerance when analysing the risks of your information in a public cloud service
- need to use public cloud services in ways that are respectful of the NZ government and New Zealanders’ information
- cloud plan — also called a cloud adoption strategy.
Manage shadow cloud — follow these steps
By managing shadow cloud, you make sure that your organisation:
- is safely using information in public cloud services
- knows which public cloud services your people need to do their work well for the NZ government and New Zealanders.
-
1
Identify shadow cloud in your organisation
Using an audit, find out which public cloud services people in your organisation are using.
Divvy up the public cloud services into those that:
- follow your organisation’s risk assessment process
- do not follow your organisation’s process for assessing risks — shadow cloud.
-
2
Categorise shadow cloud services
Organise shadow cloud services by using your organisation’s existing categories.
-
3
Prioritise the most important services
Focus on the shadow cloud services that are high priorities for your organisation, the NZ government and New Zealanders.
-
4
Assess the risks
Assess the risks so you can decide whether to bring the shadow cloud service into your organisation’s catalogue of approved public cloud services.
-
5
Make decisions from your priorities and risk assessments
For each shadow cloud service, see if it makes sense for your organisation to:
- stop using it
- replace it
- keep it — adding it to your approved public cloud services.
Make decisions based on your priorities and risk assessments
-
6
Create a catalogue of approved services
Catalogue these services so people can easily find them.
A well-chosen set of approved services that are easy to find will:
- help your people find the public cloud services they need to do their work
- make it smoother to manage shadow cloud.
-
7
Actively manage shadow cloud
This is not a one-off solution. View managing shadow cloud as a way to actively find out what your people need to do their work.
-
8
Fit approved services with your other technology
It might make sense to integrate public cloud services with your other technology. Or, it might not. Find out what to do in both cases.
Utility links and page information
Last updated
