## 2 Related Work
### Personal Devices and Shadow IT, BYOD  
Utilizing personal IT devices, software applications or other IT services for remote work is not a new phenomenon. However, the sudden transition to the remote (home) environment in early 2020 accelerated the adoption of this practice by users and organizations. Users suddenly had to rely on what they already privately owned to complement the IT support they received from their organization.  
There are a number of definitions for shadow IT, and we use the terminology described in [41]: \"...shadow IT which is hardware, software, or services built, introduced, and/or used for the job without explicit approval or even knowledge of the organization\". The category of shadow IT is related to the categories of BYOD (bring your own device) or BYOS (bring your own service), where users are encouraged to use their own devices according to preset rules and conditions. The key challenge for any organization is the IT governance and control over the use of private devices and services [41].  
Existing literature [42] indicates that governing shadow IT or, more generally, the usage of personal IT space is unlikely to be beneficial for both organizations and users without some sort of dialogue. One survey [43] of three private and two public companies has also identified how hard it is to come to an agreement between an organization and its employees when users are very selective in what policy and regulation details they are willing to accept. Another factor described is user alignment and user acceptance when faced with technology upgrades relating to BYOD devices and technology [44]. This study demonstrates that even a technology solution that has enhanced security can result in user resentment or opposition without the required alignment. The requirements are defined by the organization through informal and formal channels, where policies and guidelines cover only the formal part. There are two different aspects for users to think about when considering shadow IT [45]. The first relates to application development when the current application functionalities do not match user expectations. The second relates to the benefit of potential innovation. This can be the case if application development meets the rigorous functionality, regulatory and other requirements.  
Shadow IT could also become a governance issue from a different perspective. In a decentralized unit of an organization, without the consent and knowledge of the central IT function, users could even develop an application that did not go through the regular security, functionality and other tests.  
Within the shadow IT space, the governance of personal devices can be partially implemented and controlled. Deactivating USB connections on company devices or restricting access to core applications via VPN tokens on company laptops are two good examples of this. Governance of shadow IT applications is more complicated, and there are parts of the shadow IT space that might require even more attention, such as the use of personal cloud services. Recent research [46] has shown that many open questions still exist about what action to take in organizations where the use of personal cloud services intersects with the use of organizational data.  
There are also a number of open research directions [42] that can be identified for future shadow IT research, e.g., exploring generation Z's attitudes and behaviors towards shadow IT.  
We address the topics of personal device usage, cloud services usage and other details through targeted survey questions (see Section 4.3).