Management has expressed concerns to the information security manager that shadow IT may be a...

The first step is to determine the extent of shadow IT usage (A). CISM emphasizes understanding the current state before implementing controls or policy changes. Without knowing where and how shadow IT exists, actions such as blocking usage (C) or updating policy (B) may disrupt business operations unnecessarily. Evaluating value (D) is secondary. Identifying scope enables informed risk assessment and proportionate response.