Shadow IT Application Discovery Review

Inspection template for identifying unsanctioned SaaS applications using SSO, expense, browser, and procurement data, then routing discovered apps for security review, consolidation, or retirement.

Review Scope and Discovery Inputs

• Review period documented
  Record the start and end dates for the discovery review window.
• Business units or departments in scope identified
  Select all business units included in this review.
• Discovery sources reviewed
  Select all sources used to identify potential shadow IT applications.
• Review owner assigned
  Document the person or team responsible for triage and follow-up.
• Approved application inventory available for comparison
  Confirm that a current sanctioned-app inventory was used to compare discovered applications.
• Exceptions or known pilot tools documented
  Confirm whether approved exceptions, pilots, or temporary tools were excluded from escalation.

Application Discovery and Triage

• Potential unsanctioned applications listed
  Enter the number of unique applications identified as potential shadow IT.
• Duplicate app entries removed or merged
  Confirm that duplicate entries, aliases, and subdomains were consolidated into a single application record.
• Applications matched against sanctioned inventory
  Confirm each discovered app was checked against the approved application list.
• Business owner or sponsor identified for each high-risk app
  Confirm that a business owner was identified for applications handling sensitive data or used by multiple users.
• Application purpose documented
  Confirm the business purpose or workflow supported by each discovered application was recorded.
• Triage outcome assigned
  Select the current disposition for the application.

Security and Compliance Risk Review

• Sensitive data exposure assessed
  Identify whether the application may store, process, or transmit sensitive data.
• SSO or MFA controls in place
  Confirm whether the application is protected by SSO and MFA where supported.
• Vendor security review completed or initiated
  Confirm that a security questionnaire, risk review, or equivalent vendor assessment has been completed or opened.
• Data retention and deletion terms reviewed
  Confirm the application’s retention, deletion, and export terms were reviewed for compliance impact.
• Contract or DPA required
  Indicate whether a contract, DPA, or other legal review is required before continued use.
• Risk rating assigned
  Rate the overall risk of the application based on data sensitivity, access controls, and vendor posture.

Consolidation, Remediation, and Offboarding

• Consolidation candidate identified
  Confirm whether the application can be replaced by an approved enterprise tool.
• Access removal or deprovisioning required
  Confirm whether user access must be removed pending review or retirement.
• Corrective action owner assigned
  Document the person responsible for remediation, consolidation, or offboarding.
• Target completion date documented
  Record the due date for remediation or closure.
• Exception approval path documented
  Confirm that any approved exception has an owner, expiration date, and review cadence.

Review Closeout

• Evidence retained for review
  Confirm that source evidence, screenshots, exports, or reports were retained according to policy.
• Open findings summarized
  Summarize unresolved findings, escalations, and follow-up actions.
• Review status
  Select the final status of the discovery review.
• Inspector sign-off
  Inspector signature confirming the review was completed accurately.