What to do about shadow cloud in your organisation
Managing shadow cloud is the best action to take — support your efforts by also taking action in other areas of your organisation.
Manage shadow cloud
Shadow cloud is always going to be present in any organisation — that’s why it’s important to manage it.
Get senior management on board for managing shadow cloud
Senior management needs to understand the:
Extreme approaches do not count as managing shadow cloud
Not doing anything about shadow cloud is not an option. Oddly enough, being too strict will have the same or similar effects. Avoid extreme approaches to shadow cloud.
What leaders of business units can do — teach your people
In your organisation, make sure you encourage the leaders of each business unit to teach the people working there how to:
- follow the policies specific to their area — they might have changed based on your organisation’s cloud plan
- classify information properly — a must-have for respectfully and responsibly using information for the NZ government and New Zealanders
- know when and how to get risk assessments started for public cloud services, using the risk discovery tool to help.
What senior management can do — help your people
Your organisation’s senior management team should think about and plan how to:
- change any policies affected by your organisation’s cloud plan — this might involve forming a cloud adoption team
- make it quicker and easier for people in your organisation to safely use new public cloud services — especially by maintaining a catalogue of approved services.
Be proactive, but also patient
It’s unrealistic to expect good practices to catch on overnight. Apply the guidance from the Government Chief Digital Officer (GCDO) on Digital.govt.nz in ways that make sense to your government organisation.
Get started — how to manage shadow cloud
Bring your organisation’s use of public cloud into line with its cloud plan and Cabinet’s requirement for risk assessments.