Management establishes governance, security controls and consistent policies, standards and procedures to prevent and detect shadow IT (devices, software or services running without IT management's knowledge or approval, placed by business units, third-party providers, individuals or incomplete decommissioning), communicates its risks to personnel (security weaknesses and data loss, inability to patch, back up or recover, cost of remediation, spread of malware through automatic backups, licence penalties, legal risk over data ownership and possible nullification of cyber insurance), includes shadow IT in security awareness training and uses the discovery processes the booklet describes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.