The information security manager discovers that the marketing department signed up for a SaaS analytics tool and uploaded customer lists without any security review. Several similar cases have occurred this year. What is the BEST long-term action?
Select an answer to reveal the explanation.
Short Explanation
When the same leak keeps showing up, you don't keep mopping the floor; you fix the pipe. Here the pipe is procurement: if a purchase can't finish without a security review, shadow SaaS dries up. Blocking domains and reminder emails feel busy, but they don't change how buying decisions get made.
Full Explanation
Repeated cases point to a process gap rather than a single bad decision. Embedding a security risk review as a required step in procurement and vendor onboarding means every new external service is assessed before data is shared, with the business still deciding but now doing so with risk information. It is a governance control that scales with the organization and works whichever department is buying. Blocking unapproved SaaS domains is a technical reaction that is easy to bypass, creates friction for legitimate business needs and still leaves no route by which tools are assessed. Having the marketing director accept the risk deals with one tool at best, and only after the data has already been uploaded; it does nothing to prevent the next case. An awareness campaign may help, but reminders without a process behind them rarely change purchasing behavior, and the message that only IT may buy is not the actual requirement, which is that services handling data are risk assessed. Exam caveat: the review should be proportionate, with lighter checks for low-risk services, or the business will route around it. Operational check: confirm that purchase orders and corporate card spending on software services are matched against completed security reviews.