Shadow IT and BYOD Policy for SMBs — Rules and Costs

Shadow IT means IT tools, services or devices that employees use for work without the company knowing about them or approving them. Examples include talking to clients on a personal LINE account, forwarding files to a personal Gmail, sending large files through a free file-transfer site, pasting internal documents into a personally subscribed generative AI, and reading work email on a personal smartphone. It is rarely malicious. It usually comes from a good-faith wish to get work done faster, which is exactly what makes it hard to catch. In short, simply announcing a ban does not stop it. The practical approach is to take inventory, set rules, provide alternative tools, add technical safeguards and review regularly, in that order. As a rough guide, MDM (mobile device management) costs about 300 to 800 yen per device per month, and a company-issued smartphone costs about 2,000 to 4,000 yen per month plus the handset. This article walks through the thinking, the options, the costs and the items to put in an internal policy, for owners of small and mid-sized businesses without a dedicated IT person.

Shadow IT means IT used out of the company's sight. It is not only a problem for large enterprises with IT departments. Companies with no dedicated IT staff are actually more likely to see it spread without anyone noticing. Typical examples are as follows.

- Personal LINE or social media DMs: contacting clients or field staff through personal accounts. The history stays on the individual's phone even after they leave
- Personal Gmail or iCloud: forwarding work files to a personal address in order to work from home
- Free file-transfer services: sending and receiving large data through external services the company does not know about
- Personally subscribed generative AI: pasting customer information or contract text in to be summarized
- Personal smartphones and PCs: opening work email, chat and cloud documents on devices outside company management
- Free cloud storage and note apps: saving work documents in personal accounts, where the company can no longer see them

Using a personal device for work is called BYOD (Bring Your Own Device). BYOD is a legitimate way of operating when the company allows and manages it, but it becomes shadow IT when the company neither allows it nor manages it. The problem is therefore not that the device is personal. It is that the company has no visibility, no rules and no controls. Handling of generative AI is covered separately in company rules for ChatGPT and other generative AI, so please read it alongside this article.

In most cases the cause is not employee carelessness but a company environment that is inconvenient or incomplete. Knowing the reasons makes it easier to choose the right countermeasure.

- Company tools are inconvenient or missing: there is no file sharing or chat system, so people substitute a free service at hand
- Speed takes priority: requests and approvals take time, so people sign up on their own
- No rules, or rules nobody knows: no one has explained what is not allowed, and people do not realize it is a problem
- Convenience: many free services can be used immediately after creating an account
- More remote and mobile work: people work away from the office more often and want to use whatever they have with them

In other words, shadow IT is also a sign that something people need has not been provided. Looking at what employees actually use shows where they are really struggling.

Using IT the company does not know about carries the following risks. In many cases they come to light only after an incident.

- Information leaks: customer data or deal terms can get out through a lost or stolen personal phone, malware, misdirected messages or a family member looking at the screen
- Data taken away at resignation: documents remain in personal email, storage or devices, and cannot be deleted after the person leaves. The company has no way to order deletion or to confirm it
- Accounts the company cannot manage: services an employee signed up for in their own name cannot be shut down by the company at resignation, and the company does not even know who holds what
- License and terms-of-service violations: using consumer plans for business can breach their terms. Installing company-licensed software on a personal PC can also be a licensing problem
- Unclear responsibility: when an incident happens, the company cannot investigate what occurred or explain it to clients and customers

The resignation problem is especially easy to overlook. When business data sits in personal accounts or personal devices, it cannot be collected or deleted during offboarding. We cover the procedure in the IT offboarding checklist, but shadow IT does not even appear on that checklist, because nobody knew it existed.

There are broadly three policies for personal smartphones. None is always right. The choice depends on company size, job types and how sensitive the information is. Costs are rough estimates.

In practice, many companies split by job type rather than apply one rule to everyone. For example, company-issued phones for sales staff who handle customer information daily, conditional BYOD or PC-only for office staff, and company-issued devices only for anyone who touches management-level confidential information.

The cost depends heavily on the policy and the number of devices. The figures below are rough estimates and vary by service, contract and quantity. Please confirm with several quotes when you actually introduce anything.

You do not have to introduce everything at once. Start with the no-cost steps of taking inventory and writing the rules down, then add technical measures according to how sensitive your information is.

Starting with a ban or an MDM rollout tends to cause resistance and confusion. The following order is easier to make stick.

First, find out what tools and devices are actually in use. Present it as a survey to learn what is hard about their work, not to blame anyone, and use anonymous questionnaires or interviews. Ask about communication tools (LINE, social media), how files are exchanged, use of personal email and storage, use of generative AI, and which personal devices are used for work and for what. At the same time, list the devices and accounts the company itself contracts for. The IT asset management guide helps with building the register.

Based on the inventory, sort things into what is allowed, what is allowed with conditions and what is prohibited. The key to adoption is providing a conditional option instead of banning everything. Keep the rules short enough to read, about one or two A4 pages.

For everything you prohibit, provide something to use instead. If you ask people to stop using personal LINE, offer a company chat such as Teams, Slack or LINE WORKS. If you ask them to stop free file transfer, let them issue sharing links from company cloud storage. For generative AI, point them to a company-contracted service or a plan that does not use input data for training. Providing alternatives decides whether the whole effort succeeds.

Once the rules and alternative tools are in place, strengthen defenses technically. For accounts, requiring MFA (multi-factor authentication) and abolishing shared accounts come first. See account, password and MFA management for details. On top of that, apply MDM or app protection to devices so they can be locked and wiped remotely if lost. When business data is handled on personal devices, a method that protects only the work apps avoids intruding into employees' private space.

Rules are not finished once written. Redo the inventory every six months to a year and reflect new services and changes in how people work. Also update the status of devices, accounts and consent forms every time someone joins, leaves or moves. Fast-moving areas such as new generative AI services in particular need regular review.

An internal policy on personal smartphones and shadow IT should include at least the following.

- Purpose and scope: what the rules are for, and whether they apply to employees, part-timers and contractors
- List of permitted devices and services: state clearly the devices and tools the company approves
- Conditions if BYOD is allowed: eligible job types, OS version, passcode and screen lock, consent to MDM or app protection
- Prohibited actions: business communication through personal accounts, forwarding to personal email, entering confidential information into free transfer services or personally subscribed generative AI
- Range of information that may be handled: whether and how far customer data, personal data and confidential information may be handled on personal devices
- Contact and procedure for loss, theft or suspicious activity: who to report to and within how many minutes or hours of noticing
- Handling at resignation or transfer: deleting business data, disabling accounts and removing MDM or app protection
- What the company can see: what is monitored or managed on personal devices and what is not (privacy considerations)
- Cost sharing: who pays for communication fees and handsets, and whether there is an allowance
- Response to violations: the flow of warning and correction, and the approach to disciplinary action
- Review timing and contact point: who to ask, and when the policy is reviewed

Because the actual policy touches work rules and labor matters (cost sharing for personal device use, the extent of company oversight), it is reassuring to have a labor and social security attorney or similar professional check the final version.

Simply announcing that business use of personal smartphones is banned almost never makes shadow IT disappear. There are three reasons.

- Work stops, so people hide their use: without an alternative, staff keep using these tools out of sight to get things done. A ban often just makes the use invisible
- People stop consulting you: an overly strict ban makes it harder to report problems and incidents. Reports of loss or misdirected messages come late and damage grows
- You cannot verify compliance: without technical backing, the company cannot tell whether the rules are being followed

Conversely, when you provide alternative tools, make clear what is allowed and create an atmosphere where people can ask for help, shadow IT shrinks naturally. It also matters to explain that the rules exist not to restrict employees but to protect both employees and the company.