Applications and services created by “citizen developers” are gaining traction and delivering business benefits to many enterprises. Gartner forecasts that by 2024, developers outside of IT will account for 80 percent of the user base for low-code/no-code technologies. However, many citizen-built applications are deployed without IT support or oversight. Taking steps to achieve and sustain compliance of those citizen-built resources is essential to ensure they do not increase data privacy, quality, or security risks.
What You Should Do Now
- Know what you have. Citizen-built applications are not always implemented by IT or with IT’s knowledge. Policies that require and encourage citizen developers to notify IT when deploying applications should be combined with continuous, automated monitoring and frequent regular audits of all citizen-built applications and the entire IT estate.
- Protect your critical data. Citizen-built applications that leverage or manipulate critical corporate data or personally identifiable information (PII) can cause undesired changes to that information. Careful, complete management of all critical data and its lineage can help ensure data is always accurate and consistent and flag actual or potential risks to that data. Additional protections include access controls, encryption, frequent security audits, and vulnerability assessments. Compliance, IT and user support, and education teams should collaborate to develop, deliver and enforce policies and best practices for data protection, especially among citizen developers.
- Document and educate. Many, if not most, citizen developers have limited knowledge or experience with compliance or application security. All relevant policies and best practices must be clearly documented and regularly updated. These must form the foundation for timely and frequent education and training of all citizen developers.
- Don’t forget to test. Citizen-built applications should be tested before and periodically after they are deployed. Tests should focus on compliance and security to ensure those applications do not introduce new vulnerabilities or increased risks to data.
- Vet your vendors. Some citizen-built applications make use of elements provided by multiple vendors. Those vendors should be evaluated wherever possible to ensure they do not threaten compliance at your enterprise. At a minimum, this should include a review of all policies and practices for data protection, privacy, and security.
- Be prepared. Despite the best intentions and efforts to prevent them, data breaches and other security incidents are likely to happen. IT and security teams must have detailed plans and documented practices to respond rapidly and effectively. These plans and practices must be shared with all citizen developers and tested regularly to keep them up to date.
- Keep up. Compliance regulations and requirements are always evolving, especially as the adoption of generative AI and other low-code/no-code technologies continues to proliferate. Compliance, IT, legal and security teams should work closely together to ensure enterprise knowledge of and compliance with all relevant regulations, rules, and frameworks remains current. Information about new or revised compliance requirements should be shared with all citizen developers and other stakeholders as soon as it is available. In addition, software updates and patches should be tested and deployed as quickly as possible after vendors make them available to minimize risks and vulnerabilities to new threats.
How Incisive Can Help
Incisive Software is focused on helping organizations build a strong foundation for success based on accurate and trustworthy data, especially in the face of new and growing risks spawned by generative AI and other low-code/no-code technologies. Incisive offers Incisive Analytics Essentials, a solution that enables you to gain managerial control over citizen-built applications and low-code/no-code deployments while making them available to authorized users. The Concourse platform, the heart of the Incisive solution, provides consolidated, comprehensive abilities to know what you have and what changes and effectively manage, protect, and trust your business-critical data across your entire enterprise.
To learn more about Incisive Analytics Essentials or to arrange a demo or free trial, visit https://www.incisive.com, email [email protected], or call 408-660-3090.
