The situation where individuals and groups seek out their own technology solutions, is a phenomenon known as *shadow IT*. Shadow IT poses a risk to the organization because it *puts sensitive information in the hands of vendors outside of the organisation's control*. The presence of shadow IT in an organization means that *business needs are not being met by the enterprise IT team*. Consulting with shadow IT users often identifies acceptable alternatives that both meet business needs and satisfy security requirements.