A parks department quietly adopts an unsanctioned public SaaS form tool for event registrations without IT review. How should security classify this situation?
Select an answer to reveal the explanation.
Short Explanation
Shadow IT is the 'helpful' side door—someone spins up a handy SaaS form without asking security. Intent can be innocent, but the attack surface still went unmanaged, like adding a unlocked annex to city hall.
Full Explanation
When a parks department quietly adopts an unsanctioned public SaaS form tool for event registrations without IT or security review, the correct classification is shadow IT. Staff intent may be helpful rather than malicious, yet the city still gains unmanaged attack surface: unknown data flows, unclear identity integration, possible storage of citizen PII outside approved controls, and missing logging or contractual security terms. Shadow IT is defined by lack of authorization and oversight, not by malware signatures.
Nation-state intrusion using custom malware on the SaaS control plane is an advanced external compromise narrative unsupported by merely adopting a convenience form tool. Authorized change management completing a fully approved architecture review is the opposite process—the scenario explicitly skipped review. Insider threat defined solely by deliberate theft of payroll files describes malicious data theft, which is a different problem than unsanctioned service adoption even when both can coexist in a broader risk program.
Exam caveat: shadow IT equals unmanaged/unapproved services introducing risk regardless of good intentions. Operational check: discover unsanctioned SaaS via CASB, DNS, or expense reviews; provide approved form platforms for parks events; require security review for citizen data collection; and migrate or shut down shadow tools while preserving registration data under municipal retention rules.