Security vetting plugins

TLDR: If/how do you pre and post vet 3rd party plugins to your critical and sensitive systems and services?

I and I am in an environment where plugins for various platforms (ERP, LMS,etc.) are being used, often outside the awareness, review, and approval by IT (proper), business, or data owners.

While we can (and plan) to start blocking a lot of this from a technical standpoint, we are obviously not trying to tell the business that they can’t use them …

awareness business critical cybersecurity data environment erp etc lms party platforms plugins review security services start systems vet