Shadow IT Policy Generator

This policy governs Acme Corp's acquisition, use, and management of software-as-a-service (SaaS) applications, AI tools, browser extensions, and cloud services. It applies to all employees, contractors, and third parties operating on Acme Corp systems or handling Acme Corp data. The policy is intended to reduce unauthorized application risk, control redundant spend, and meet Acme Corp's obligations under SOC 2 and GDPR.

"Sanctioned application" means any SaaS application or service formally approved through Acme Corp's procurement and security review process and listed in the approved application catalog. "Shadow IT" means any application, extension, or service used for business purposes that has not been so approved. "Sensitive data" includes any data classified as Confidential or Restricted under Acme Corp's data classification standard, or data subject to SOC 2 and GDPR.

Employees may use sanctioned applications for ordinary business activities consistent with their role. Use of unsanctioned applications, including AI tools and browser extensions, is prohibited where the activity involves Sensitive data, the application requires authentication with corporate credentials, or the application accesses corporate identity, calendar, mail, or storage. Personal accounts may not be used to access or transmit Acme Corp data.

New SaaS applications are reviewed under a tiered process based on annual cost and data classification. Tier 1 ($0 to $1,000 / month, no Sensitive data) follows a streamlined review with manager and IT sign-off. Tier 2 ($1,001 to $10,000 / month, or any Sensitive data) requires security review, vendor questionnaire, and procurement approval. Tier 3 (above $10,000 / month, or applications processing Restricted data) requires a full vendor risk assessment, DPIA where GDPR applies, and executive sign-off. Time-to-decision targets are 5, 10, and 20 business days respectively.

Use of AI tools must follow the approved AI tool list, which is maintained by Acme Corp's Information Security team. Personal accounts on consumer AI tools (including but not limited to ChatGPT, Claude, Gemini, Copilot) may not be used for work involving Sensitive data. AI tools that retain prompts or outputs for model training may not be used with any data classified above Public. New AI tools follow the same tier review as other SaaS, with an additional requirement to document the model provider, data retention behavior, and training data treatment.

All applications handling Acme Corp data must be aligned with the data classification standard: Public, Internal, Confidential, Restricted. Sanctioned applications are mapped to the highest data class they may process; Shadow applications, by definition, are unmapped and therefore default to Public-only suitability. Applications processing regulated data require explicit additional review.

Acme Corp maintains an ongoing amnesty channel for employees to self-report shadow applications without disciplinary consequence, where the reporting is timely, voluntary, and pre-empts discovery by IT or audit. Self-reported applications are triaged within 10 business days. The amnesty applies to disclosure only; subsequent willful continued use of an unsanctioned application after triage is treated as a policy breach.

Violations result in formal warning on first occurrence, removal of access on second occurrence, and escalation to HR for repeated or material breaches. Acme Corp may revoke access, terminate the application contract, or recover associated data without notice where doing so is necessary to protect Sensitive data, SOC 2 and GDPR obligations, or system availability.

Exceptions to this policy must be requested in writing, justified by a documented business need, and approved by the CIO or CISO. Approved exceptions are time-bounded, recorded in the policy exception register, and reviewed at the cadence specified below.

This policy is reviewed on a annual cadence by the policy owner, in coordination with the SOC 2 compliance lead, and updated when there is a material change to Acme Corp's technology, regulatory, or risk environment. The next scheduled review date is recorded in the policy register.