Skip to content

ACCA Strategic Professional · Strategic Business Leader · IT systems security and control

Brandt Engineering discovers that staff have been using personal cloud storage to share design files, bypassing the approved system. The CISO wants to address this within a cyber governance framework. Which response is most appropriate?

The best response combines clear policy, staff awareness training, a practical approved alternative and monitoring or enforcement. This tackles the cause of the shadow IT and the risk together, whereas ignoring it, mass dismissal or blanket internet removal are ineffective or disproportionate.

  1. AIgnore it, as staff productivity matters more than the security policy
  2. BUpdate policy and awareness training, provide a usable approved alternative, and add monitoring and enforcement through access controlsCorrect
  3. CDismiss the staff involved, as the matter is solely one of individual misconduct
  4. DRemove all internet access for the engineering department permanently

Explanation

Shadow IT signals a gap between policy and user needs. A balanced response combines policy, training, a practical approved tool and monitoring. Ignoring it leaves data exposed, mass dismissal ignores the control design weakness, and cutting internet access is disproportionate and disrupts the business.

Did you get it right without looking?

One question tells you little. A timed set on IT systems security and control shows your real accuracy, how long you take and where you lose marks.

Practise IT systems security and controlFree diagnostic mock

More IT systems security and control questions