Extreme approaches do not count as managing shadow cloud

You and your organisation are not managing shadow cloud if you:

• do nothing — a hands-off-the-wheel approach very clearly has negative effects
• do too much — being too strict can also create poor outcomes.

Problems caused by extreme approaches

Both of these approaches tend to cause more harm than the good their adopters originally intend — that is, unintended consequences.

Harm to security, work, dignity and cost

Even though it might feel like you’re doing the opposite, you’ll most likely be hurting the:

• security of your information
• mahi and mana of the people in your organisation
• cost-effectiveness of the public cloud services your organisation is using.

Hands-off-the-wheel approach

Doing nothing about shadow cloud very clearly means you and your organisation are not managing shadow cloud.

You leave everything to chance.

Poor information security

By not making sure risks have been assessed before using public cloud services, you’re not responsibly using NZ government and New Zealanders’ information.

Cabinet requires government organisations to use public cloud services, but assess the risks before doing so.

Cabinet minutes and papers for public cloud services

Hurting the mahi and mana of your people

By doing nothing about shadow cloud, you’re providing so much choice that you’re not giving any direction to your people. This harms their ability to work together.

Using public cloud services requires a balance between:

• common ground — services that everyone in your organisation uses to work together smoothly
• choice — enough, but not so much that it’s inefficient for your people’s work and costs.

Offer a choice of public cloud services to your people

Cost

When you do nothing about shadow cloud, it can be expensive to your organisation because:

• using many different services means you’re not taking advantage of possible cost-savings from volume pricing with fewer services
• you may need to spend money on costly operations to recover information that was lost because of poor or non-existent data recovery plans or an employee got a different job and the service expired.

This leads to your organisation not:

• experiencing the typical benefits of using public cloud services
• following the Strategy for a Digital Public Service.

Reason for failure

You’re not actively trying to find out which public cloud services will help your people do their work. By not giving any direction to your people, you expose the NZ government and New Zealanders to the risks of shadow cloud.

Risks of shadow cloud to government organisations

Overly strict approach

Doing too much to stop shadow cloud seems like a paradox — by trying to make your information secure, you actually make it less secure.

Being strict, you think you’re leaving nothing to chance, but you’re accidentally encouraging people to take chances.

Poor information security

When all your effort goes into clamping down on shadow cloud services instead of adapting to changing business needs and technologies, people get frustrated. Constantly facing obstacles to doing their jobs can lead people to find ways of using shadow cloud services.

Strictly enforcing shadow cloud still leads to not responsibly using the information of the NZ government and New Zealanders.

Cabinet minutes and papers for public cloud services

Hurting the mahi and mana of your people

By being strict with shadow cloud, you’re providing too little choice to your people. This harms their ability to work together.

Using public cloud services requires a balance between:

• common ground — enough, but not so much that it’s inefficient for your people's work and cost-effectiveness
• choice — services that allow people to be creative in solving business needs and work with other organisations inside and outside the NZ government.

Offer a choice of public cloud services

Cost

With the strict approach, your cost is to the quality of your services and their cost-effectiveness. You risk not taking advantage of one of the greatest benefits of public cloud services — being able to quickly adapt your services.

Benefits of using public cloud services

You’ll likely hold on to public cloud services longer than is reasonably workable among fast-changing technology. It’s important to be open to retiring public cloud services when they:

• are no longer required
• stop meeting business needs
• are overtaken by new technologies.

Strategy for a Digital Public Service

Reason for failure

It’s the same as doing nothing.

You’re not actively trying to find out which public cloud services will help your people do their work.

By focusing all of your attention on enforcing against shadow cloud, you’re not putting any energy towards sorting out why it’s happening. You push people towards using shadow cloud services.

Risks of shadow cloud to government organisations

Manage shadow cloud

Managing shadow cloud allows you and your organisation to use a balanced approach, getting strong:

• information security
• buy-in from your people
• cost-effectiveness for your public cloud services.

How to manage shadow cloud in your organisation