Procurement hard gates

Shadow IT is not a security failure; it is a procurement failure. In an environment where any employee with a corporate credit card can subscribe to a SaaS tool, shadow IT is the natural outcome, not an aberration. Ring 6 closes the procurement pathway at the payment layer.

The hard-gate pattern

• ▸Corporate cards block SaaS category MCC codes at issuance.
• ▸All SaaS purchases flow through a single procurement portal that enrolls vendors against §6.2.
• ▸Employee-initiated SaaS trials require advance registration (48-hour lead time) to trigger the enrollment memo.
• ▸Personal-card reimbursement for SaaS is prohibited by policy and technically declined at the expense system.

These four controls do not rely on employee vigilance. A diligent employee cannot complete a shadow purchase because the payment pathway does not exist. An undisciplined employee has the same experience: friction at the transaction, which surfaces the need to go through the governed path.

Confirm your comprehension.