FFIEC IT Examination Handbook IS-II.C.13(e): II.C.13(e) Rogue or Shadow IT (Information Security)

Policies tell employees they may not use unsanctioned IT resources such as online storage, unapproved mobile applications and unapproved devices, and security awareness training covers how to identify and report shadow IT.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Information Security booklet (September 2016) – FFIEC IT Examination Handbook

IS-I.A I.A Security Culture (Information Security)
IS-I.B I.B Responsibility and Accountability (Information Security)
IS-I.C I.C Resources (Information Security)
IS-II.A.1 II.A.1 Threats (Information Security)
IS-II.A.2 II.A.2 Vulnerabilities (Information Security)
IS-II.A.3(a) II.A.3(a) Supervision of Cybersecurity Risk (Information Security)
IS-II.A.3(b) II.A.3(b) Resources for Cybersecurity Preparedness (Information Security)
IS-II.B II.B Risk Measurement (Information Security)

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All FFIEC IT Examination Handbook controls