Which of the following is the BEST control to mitigate the risk of shadow IT?

The correct answer is D. Security awareness training. Educating employees about the risks of using unapproved IT resources and reinforcing proper procurement and approval procedures is the most effective way to reduce shadow IT. Awareness training empowers staff to recognize and avoid unsanctioned services, thereby mitigating that

Submitted by khalil_dz· Apr 18, 2026Governance and Management of IT

Question

Options

AIntrusion detection system (IDS)
BVendor management reviews
CVulnerability scanning
DSecurity awareness training

How the community answered

(48 responses)

A
6% (3)
B
4% (2)
C
19% (9)
D
71% (34)

Explanation

Educating employees about the risks of using unapproved IT resources and reinforcing proper procurement and approval procedures is the most effective way to reduce shadow IT. Awareness training empowers staff to recognize and avoid unsanctioned services, thereby mitigating that

Topics

#Shadow IT#Risk mitigation#Security awareness training#IT governance

Community Discussion

No community discussion yet for this question.

Full CISA Practice