The IT steering committee's primary function is to ensure the alignment of IT with business strategy. The emergence of "shadow IT" (independent procurement of cloud services) signifies a gap between business needs and the existing IT service delivery or procurement model. The most effective and strategic response is to address this gap directly. Defining a procurement strategy based on business unit needs creates a governance framework that enables business agility while ensuring that risks, costs, and integration are managed centrally. This approach fosters collaboration, addresses the root cause of the issue, and aligns IT resource acquisition with enterprise objectives.

A. This is a reactive and punitive measure that could disrupt critical business operations and create animosity between IT and business units, failing to address the underlying business need.
B. While including business leadership in governance bodies is beneficial, the enterprise architecture (EA) review board's focus is typically on technical standards, not the broader strategic issue of procurement.
C. Imposing a specific technical solution like "open source only" is an arbitrary constraint that may not meet diverse business requirements and fails to address the core governance problem.

1. ISACA, CGEIT Review Manual, 8th Edition. Domain 2: IT Resources, Task Statement T2.4 states a key activity is to "Ensure that policies and processes are in place for the sourcing of IT resources (e.g., insourcing, outsourcing, cloud) to support enterprise objectives." This directly supports creating a strategy (Option D) rather than reacting punitively (Option A).

2. ISACA, COBIT 2019 Framework: Governance and Management Objectives. The core principle of the COBIT framework is to meet stakeholder needs. In this scenario, the business units are key stakeholders. Governance objective APO02 Managed Strategy emphasizes understanding the enterprise context to develop a supporting IT strategy. A procurement strategy based on business needs is a direct application of this principle.

3. ISACA, CGEIT Review Manual, 8th Edition. Domain 1: Governance of Enterprise IT, Task Statement T1.2, "Ensure that the governance of enterprise IT (GEIT) framework supports the achievement of enterprise goals and objectives." A strategy that ignores business needs and agility (as implied by the existence of shadow IT) is not a supportive framework. Option D seeks to create such a supportive framework.