Shadow IT Is An Opportunity, Not A Problem

Shadow IT tends to have negative connotations for technology professionals. But what if the use of unauthorized applications and services is an opportunity for IT to start a discussion with the business rather than drop the hammer?

Stephen Comstock, VP of Site and IT Infrastructure for CBS Interactive, says business users don’t think of outside applications and services as “shadow IT.” They think of it as trying to do their jobs.

“It’s an enabler for the business to find tools they need to streamline or provide efficiencies, get products deployed faster, be more agile,” said Comstock in an interview.

Rather than stamp out these tools, Comstock says IT should learn why users find them valuable, and what IT can do to help.

“It lets IT get involved,” he said. “You talk to the business unit and find out what problem they’re trying to solve rather than trying to control the software.”

Comstock, who oversees an IT team of about 60 people and is responsible for both customer-facing Web and mobile products as well as back-office operations and security, knows there are things IT is really good at: product management, implementing complex systems, budgeting, security, and so on.

“But there are things I’m horrible at,” he said. “I don’t necessarily understand the sales process. But my salespeople do, and they know how to find tools to fill out their pipelines, find qualified leads, and so on. So why would the IT guy pick the sales product?”

“If they find something that helps them bring in more revenue, why not make that an opportunity to talk to the head of sales to say ‘How can we as IT help you more? What are the key performance indicators that help you get more dollars?’”

A common complaint from IT is that the organization doesn’t have a seat at the business table. Comstock says these kinds of conversations are one way to get that seat.

“It’s right in front of us. Just call people up and say ‘I see you’re doing this. How is it helping you?’”

[Get cutting-edge content and real-world insight from business leaders on the intersection of business and technology in the Business of IT track at Interop New York.]

These conversations allow Comstock and his team to engage with his internal customers and find out how IT can make things better for the business.

“The more you do it like that, your customers will start to come to you, and shadow IT starts to become collaborative IT,” said Comstock.

But embracing shadow IT doesn’t mean a free-for-all within the organization. “I wouldn’t let someone kick up a new instance of an HR system without IT being involved and helping guide to make sure we interface properly with our payroll systems,” he said.

“And anything around HIPAA, or things that might cause heartburn with an auditor, I’d prefer we’re part of the conversation from the beginning.”

But when it comes to productivity tools, he’s willing to let folks try. Then his job is to figure out which tools to standardize on. “It doesn’t have to be just one solution, but it’s shouldn’t be 40 either. The control comes in where we narrow it down to two or three vendors.”

That’s also the point at which IT gets more involved with the contracts, price negotiation, and the need for things such as encryption for confidential data. “These are the things we think about that people don’t.”

Comstock also notes that it’s important to have a baseline set of controls in place, including a single sign-on system that allows IT to revoke access to outside services in case an employee leaves.

He’s also aware that shadow IT can be a problem in highly regulated environments—but it’s still not a deal-breaker. “It would be more difficult in a regulated world, but not impossible. Not everything in a regulated world is regulated.”

Comstock says that his opinions might not work for every business, but IT leaders who are willing to change their frame of mind might find opportunities to demonstrate IT’s value to the business.

“If IT can be a partner and help our business move the needle even a little, why wouldn’t you want that? I might be the liberal IT guy, but I think about risk, I think about data at rest. I don’t want people to think I have no idea how to run IT. I think about those things, and I balance it out.”

Comstock notes that if IT can demonstrate how it facilitates the business in bringing in more revenue, that’s a win for IT.

“Making more money is a better motivator than saving,” he said. “If I can make money, I’m going to get more attention. I’m not going to go out and close a sale, but maybe I can help streamline the process for the person who’s going to.”

“When you become more valuable to the business,” said Comstock, “the conversation starts to change.”