rein in use of unauthorized tools (e.g. "shadow IT") minimize damage to reputation maintain regulatory compliance prevent information leakage mitigate third-party risk minimize governance risk[11][12]