During an enterprise architecture review, the information security manager discovers that several business units run cloud-based applications that are not recorded in the architecture inventory and were never assessed for security. What should the information security manager do FIRST?
Select an answer to reveal the explanation.
Short Explanation
You can't protect what you don't know you have, so shadow IT first has to come out of the shadows. Get those apps onto the inventory with an owner and into the normal risk process. The trap is reaching straight for the block button or the disciplinary file, which breaks the business and teaches people to hide the next app better.
Full Explanation
Applications that sit outside the architecture inventory also sit outside every control that depends on it: classification, risk assessment, access review, vendor management and incident response. The first management action is to make them visible and governed by working with the business units to record each application, its owner, the data it holds and the processes it supports, and then put it through the normal risk assessment. The risk owner can then decide whether to keep, remediate or retire it. Blocking access immediately is a technical reaction taken before anyone knows what the applications do; it can halt business processes and is disproportionate without an assessment. Reporting the units for discipline treats the symptom, damages the relationship security depends on, and does nothing to understand the risk. A penetration test is a technical assessment that needs a known scope and the owner's authorization, so it cannot logically come before the applications are identified and owned. Exam caveat: if the scenario showed active compromise or a confirmed leak, containment would rise in priority. Operational check: confirm every discovered application now has a named business owner, a data classification and a scheduled risk assessment in the register.