Which of the following is the MOST effective way for a CIO to govern business unit deployment of shadow IT applications in a cloud environment?

Implementing controls to block applications is a technical enforcement measure that is often reactive and can be circumvented if the underlying governance and executive support are not in place.

Executive education is crucial because gaining buy-in from the highest level of leadership empowers the CIO to enforce policies, allocate resources for controls, and establish a risk-aware culture across the organization. This foundational understanding at the executive level ensures strategic alignment and support for managing shadow IT, rather than just tactical enforcement.

Training the help desk to identify shadow IT is a detection and response mechanism, but it doesn't address the root cause of shadow IT or provide a comprehensive governance framework.

Reviewing and updating the application implementation process is a procedural improvement, but without executive understanding and support regarding shadow IT risks, such updates may lack the necessary organizational mandate for effective enforcement.