Citizen development using low-code platforms has emerged as a major vector for digital transformation. But leveraging software built by non-programmers creates challenges that make governance essential for success, sustainability, and risk containment. 

Why is governance so important for citizen development? What governance model strikes the right balance between flexibility and control for your business? This article explores the options and key factors to help you choose.

Key takeaways

• Citizen development governance defines how non-technical employees use low-code platforms to innovate safe, compliant apps that deliver sustainable ROI.
• Ungoverned citizen development greatly increases the risk of data leaks, data breaches, privacy violations, regulatory noncompliance, proliferating shadow IT, etc.
• Baseline goals for citizen-developed apps include regulatory compliance, robust integrations, and safeguards to protect sensitive data.
• The 3 primary models for citizen development governance are centralized, federated, and hybrid.
• Top factors influencing a company’s choice of governance model include the scale of their low-code efforts, compliance obligations, drive for innovation, and corporate culture. 
• Training, approved components, robust guardrails, and continuous monitoring capabilities are pivotal to citizen development governance success.

What is citizen development governance and why is it so important?

Citizen development governance is the framework of policies, procedures, and practices that direct how non-technical employees use low-code platforms to build applications while managing cybersecurity, compliance, and legal risk in alignment with business strategy.

The right governance model ensures that business users can innovate safely while technical teams oversee cybersecurity, privacy compliance, and IT infrastructure impacts. It specifies who can build what kinds of apps, how the business approves app use cases, and what requirements apply to each app based on its risk level. 

Without proper guidelines, organizations incur greater risk of data leaks, data breaches, compliance violations, proliferating shadow AI/shadow IT, and burdensome technical debt. Baseline goals for citizen-developed apps include compliance with regulations, smooth integration with other systems, and not accessing or exposing sensitive data. 

What are top benefits of citizen development governance?

Implementing governance brings structure and clearly defined guidelines to citizen development programs. It stops “experimental” tools from popping up in production environments while empowering staff to streamline and automate daily workflows. 

Top benefits of citizen development governance include:

• Mitigation or reduction of risks associated with low-code apps, especially data breaches, compliance violations, and unapproved/unsafe AI behavior. 
• Making citizen development more scalable and sustainable so a business can support more citizen development projects more effectively, at lower total cost, and with measurably better outcomes. 
• Better app quality for a higher standard of usability, performance, and integration with lower IT administrative effort. 
• Alignment with business strategy and priorities versus just serving isolated needs.
• Improved coordination and collaboration between citizen developers, IT, security teams, DevOps teams, and other stakeholders to facilitate knowledge sharing, best practices, and code reuse.

What are the 3 primary governance models for citizen development?

There are three primary governance models for citizen development: centralized, federated, and hybrid. Each has strengths and weaknesses depending on company size, industry, process maturity, and other factors: 

1. Centralized governance model—With a centralized approach, IT/cybersecurity teams control the platforms that citizen developers can use, set standards for app functionality, manage cybersecurity and privacy approvals, and validate any app that exceeds a predefined risk threshold (e.g., use outside of a small work team, accessing corporate data). A centralized approach with its tight control structure helps limit business risk from low-code apps but can slow down innovation, especially if validation is bottlenecked. Firms in regulated industries like financial services and healthcare may benefit most from a centralized governance model for citizen development. 
2. Federated governance model—With a federated or decentralized approach, IT/cybersecurity teams provide low-code tools, standards (e.g., for cybersecurity, privacy, data access, integrations), and guidance, while business units take ownership and responsibility for development results within clear boundaries. A federated approach gives citizen developers more autonomy than a centralized model, while IT takes a lower effort oversight role based on monitoring and periodic audits. In a federated governance scenario, different teams or departments may have their own schemes for approving low-code apps, reducing friction but increasing business risk and making it more difficult to establish company-wide standards. 
3. Hybrid governance model—A hybrid approach blends positive aspects of the centralized and federated methods. Here IT centrally defines rules and standards, approves critical apps, and monitors compliance while business units are free to innovate on a departmental level within their own governance frameworks. Hybrid governance seeks to balance speed and control to optimize app consistency while supporting departmental requirements, making it a popular choice for enterprises or SMBs with strong process maturity or a collaborative culture. 

Table 1 below illustrates the pros and cons of centralized, federated, and hybrid models for governing citizen development.

What citizen development governance model is right for my business?

When considering a citizen development governance model, these factors are important:

• Scale and complexity of low-code development projects. Larger companies with many citizen developers may need stronger centralized governance versus smaller orgs that can coordinate more effectively around a decentralized or hybrid approach.
• Regulatory and legal compliance obligations. Regulated businesses may need a more centralized governance model to ensure they do not create cybersecurity or privacy compliance gaps.
• Need to drive innovation. Some organizations seek to prioritize a high level of innovation and collaboration with their citizen development programs, whereas others are more concerned with governance efficiency or risk management. Strongly valuing innovation may point to a hybrid or decentralized model that supports creative collaboration both within and across business teams. 
• Corporate culture. To improve acceptance and adoption, businesses should consider the current organizational culture and values their governance program must align with. A decentralized citizen development model may go against the grain with senior leaders at a conservative, risk-averse law firm, for example.

For many organizations, a hybrid approach to citizen development governance strikes the right balance between high-effort central control, managing business risk, agility to innovate, and business-level knowledge and insight. 

According to John Verry, Lead Managing Director at CBIZ Cybersecurity, a hybrid model for citizen development governance is optimal for many SMBs looking to innovate at scale while effectively managing cybersecurity and compliance risks.

In John’s view, a central governance team is often most effective for setting policies, defining standards, and providing tools, guardrails, and oversight. But accountability should reside with the business units as these are the people who best understand app use cases and feel the true impact of apps.

A hybrid model establishes a platform-level team that manages approved tools, app templates/patterns, and automated checks. Business units own the risk for what they build. This balances control with agility to empower innovation within a safe framework.

“In some organizations I see, model teams define whitelisted models or preapproved archetypes for different AI system types,” says John. “One of the advantages to that is you can build specific use cases that can automatically be classified as low-risk and require minimal testing.”

For example, a citizen developer building a group-level chatbot based on a predefined model that only needs to access internal policy documents would not need much centralized oversight. For more complex or higher-risk use cases, the platform team sets stricter requirements and controls. 

With a hybrid approach to citizen development governance, business teams can effectively “self-serve” within predefined pathways that ensure security and compliance. 

What are best practices for initiating citizen development governance?

Best practices for building out citizen development governance in alignment with a chosen model mostly focus on establishing the ideal mix between empowering citizen developers and managing the significant risks from low-code apps. 

Proven citizen development governance best practices that span centralized, federated/decentralized, and hybrid models include: 

• Establish explicit policies and tiered guardrails to define what apps/use cases citizen developers can and cannot build based on risk level.
• Apply strict role-based access controls and least privilege principles to limit the risk of compromising sensitive data or critical workflows. 
• Implement continuous monitoring capabilities that allow you to track app performance, usage, security, and compliance.
• Emphasize education, training, and skill-building for citizen developers in core areas like design, cybersecurity, and user experience.
• Promote a collaborative, win-win connection between citizen developers and IT teams, so as not to polarize staff around freedom versus control. 
• Provide approved low-code platforms, app templates and reusable components to simplify sharing and reusing code. 

What’s next?

For more guidance on this topic, listen to Episode 161 of The Virtual CISO Podcast with John Verry, Lead Managing Director at CBIZ Cybersecurity.