What should a risk practitioner do FIRST when a shadow IT application is identified in a business owner's business impact analysis (BIA)?

Including the application in the BCP prematurely, without understanding its full scope and risk profile, could legitimize an unvetted system.

Before any other action, understanding the business purpose of the shadow IT application is critical. This initial step allows the risk practitioner to evaluate its necessity, criticality to operations, data sensitivity, and potential risks, which then informs subsequent decisions regarding its management, integration, or mitigation.

Segregating the application from the network immediately might disrupt critical business operations if its purpose is not understood and necessary.

Reporting the finding to management is important but should follow an initial understanding of the application's business context, to provide an informed report.