Balancing the Flexibility of Web Services with Responsibilites for Maintaining Network Security

As a CIO responsible for network security and sustainability, and a Web Producer interested in using hosted Web Services, e.g. Blogger, Wordpress.com, wikispaces, basecamp, Volgistics, etc. to further the mission, I find I'm being challenged by honoring the network security responsibility with the flexibility of web hosted services.

For example, we purchase the services of a web hosted company, e.g. Volgistics, Workamajig, and need to set up access for our staff to use the services. But these services don't integrate with our LDAP ACL. We host WordPress in house and staff feel it isn't flexible enough for them so they create Blogger blogs. In this case, I'm concerned that they're not accustomed to following good security and failover practices such as ensuring other people in their organization know the admin credentials to maintain the blog in case the originator is suddenly unavailable.

Does anyone have any suggestions for great practices in these areas or papers I could read?

Thanks!