No organization today, even the most conservative and secretive ones, can pretend that they are 100% cloud-free. The range of cloud-based solutions, from virtual machines hosting backend IT systems to Software as a Service, from IT-sanctioned platforms to user-provisioned consumer services, is simply too great for an organization to completely avoid.
I recall a senior IT executive from a global bank telling me they didn’t use the cloud (for security reasons), “except for Salesforce.com.” I guess customer data did not qualify as a security risk. Or maybe “that” cloud was deemed secure.
The only way to completely prevent cloud usage is to shut down internet access to users. Essentially, the modern equivalent of what you only see in spy movies: a sealed network, custom-made computers with no USB port, no external hard drive, and employees are searched on their way in and out of the office. Except that “no-internet” is not really practical in the twenty-first century.