Software License Asset Management (SLAM) Part II

Transcription

1 LANDesk White Paper Software License Asset Management (SLAM) Part II Preparing for Software Compliance Audits

2 Contents You Never Know When You ll Be Audited...3 Costs go beyond penalties and increased license fees....3 Move from Defense to Offense and Take Control of Your Audit....3 Most software asset management programs fail when the data goes stale....3 SLAM is a set of ongoing management disciplines....3 Start by Acquiring Key Information...4 Prepare to negotiate license terms...4 Resolve Ownership by Creating a Reference Catalog of Owned Titles....5 Enterprise agreements don t save you from tracking entitlements....5 Discovery Drives Daily Operational Control...5 The importance of data analytics to turn raw data into actionable information....6 Use Entitlement and Discovery Data to Compare Your SLAM Plan with Reality....6 Conclusion: Survive Audits, Contain Costs and Drive Efficiency Top 10 Benefits of SLAM...7 To the maximum extent permitted under applicable law, LANDesk assumes no liability whatsoever, and disclaims any express or implied warranty, relating to the sale and/or use of LANDesk products including liability or warranties relating to fitness for a particular purpose, merchantability, or infringement of any patent, copyright or other intellectual property right, without limiting the rights under copyright. LANDesk retains the right to make changes to this document or related product specifications and descriptions, at any time, without notice. LANDesk makes no warranty for the use of this document and assumes no responsibility for any errors that can appear in the document nor does it make a commitment to update the information contained herein. For the most current product information, please visit. Copyright 2013, LANDesk Software, Inc.and its affiliates. All rights reserved. LANDesk and its logos are registered trademarks or trademarks of LANDesk Software, Inc.and its affiliates in the United States and/or other countries. Other brands and names may be claimed as the property of others. LSI /13 AS/BB/DL 2

3 You Never Know When You ll Be Audited If you re becoming more anxious about software audits, there s a reason for it. Forrester Research found that organizations are increasingly anxious about being subjected to software audits from the firms that supply the applications that they use around the world for tasks ranging from word processing to supply chain management. Forrester analyst George Lawrie says that based on interviews with leading software vendors and software asset management experts, there s a software license time bomb armed, ticking, and buried deep in the foundations of many a Global 2000 firm s elegant IT architecture. 1 In addition, CIO Magazine s Stephanie Overby reports that when software license revenues are down, software vendors focus more on licensing audits to recover some of that lost revenue. Overby also cites a Gartner Inc. survey that revealed an increase in license reviews or audits, with 60 percent of respondents in 2010 reporting being audited in the previous year compared with around 30 percent in 2007, plus she cites a 2011 IDC/Flexera study showing that 56 percent of large enterprises were audited in the prior year 17 percent of them saying they had been audited three or more times. 2 And the software vendors aren t the only ones looking to capitalize on unlicensed use. Disgruntled insiders within your organization have incentives to make online noncompliance claims through the Business Software Alliance (BSA), which offers up to a $1 million reward for a qualifying report of license noncompliance. 3 Costs go beyond penalties and increased license fees While penalties and increased license fees for noncompliance can cost organizations millions of dollars, they are far from the only costs your enterprise can face as a result of a software audit. An onsite audit can disrupt the work environment for many months and pull your internal resources away from key projects for the onerous task of gathering whatever information the software provider demands from software invoices to the documents that came from companies you have acquired. Language in current license agreements can lead to misinterpretation and disputes, increasing attorneys fees. And then there s the media: even if noncompliance was unintentional, the press may have a field day reporting that your organization has pirated software, damaging your reputation and brand. One of the ways organizations protect themselves against noncompliance is to overbuy software licenses. If you don t understand [1] Software & Information Industry Association. Anti-Piracy FAQ, php?option=com_content&view=article&id=387:piracy-faq&catid=8:anti-piracy-overview&itemid=420 [2] Stephanie Overby, How IT Departments Can Prepare for a Software License Audit, 7 December, [3] Business Software Alliance. what you have, you may be tempted to overbuy licenses to avoid getting hit with penalties and fees. This crisis-driven approach to preparing for an audit may avoid fines, but it does nothing to reduce the time and money you ll spend to survive subsequent audits. If you can t easily put your finger on what software you have, where you have it and how you are using it, the chances increase that you will fail a software audit. Move from Defense to Offense and Take Control of Your Audit The complexities of software management cause many organizations to wait until after the software audit penalties to implement some form of software management strategy. The job of the software compliance auditor is to make sure the vendor gets paid for every use of its software. Auditors look for proof of ownership, facts about deployment and evidence of enforcement. Most software asset management programs fail when the data goes stale The first step in getting on the offensive is to make sure your data is continually up to date. For many organizations, software license management means using the basic system tools that come with Microsoft Windows or other operating systems to account for software installations. But without a process for comparing installed software to allowances on a license agreement, you not only stand to fail an audit, you have no way to recover and allocate underutilized licenses. You also have no way to align software buying with your needs or to make cost-effective agreements with your software vendor. What you need is a software license and asset management (SLAM) program that continually discovers what is being used on your systems and prepares you in advance of an audit, allowing you to recover considerable costs by taking control of your software assets. SLAM is a set of ongoing management disciplines Rebuilding SLAM data every year is far more difficult, expensive, and prone to error than straightforward, ongoing management and maintenance. As introduced in Five Steps to Reduce Software License Costs and Ensure Audit Preparedness, the first in a three-part series of SLAM white papers, SLAM is a set of five disciplines that offers the validation you need to protect yourself at the time of an audit and to plan for the future effectively by: 1) ensuring the consistent capture of data over time, 2) providing a history of changes over time, and 3) demonstrating control at any given time of your software asset entitlements. Actively performing these tasks will keep your data fresh and relevant, and enable audit readiness any time. 3

4 Acquire & Import Discover & Inventory Document Reconcile Report 4. Who uses it? (employee, contractor, commercial, academic, personal, etc.) 5. Who has management responsibility? (customer entitlement program, self-regulated login/dongle, key server, etc.) 6. What are trade-in options and what proofs are required? (new license; upgrade; side-grade [competitive upgrade]; evaluation; software assurance [time or version limited]; etc.) Start by Acquiring Key Information Start your SLAM discipline by collecting key information about your software, such as entitlements, license agreements, contract terms, proofs of purchase, departmental allocations, and warranties. The key here is to get in the habit of capturing license terms and conditions as soon as the purchase is made, rather than waiting for some arbitrary future date to catch up on data entry. The easiest way to do this is to automate the entry of this data from the manufacturers and vendors you purchase your software and assets from. Each purchase is unique, and it s important to understand how the product is defined and delivered. Defining the terms and conditions of ownership is where the real work is done to enable true entitlement management, because this is how you capture what conditions are associated with entitlement. You must capture the use conditions for each license agreement and understand how entitlements are measured for each license. You must also capture audit conditions and requirements, including notice and frequency. After you acquire the data, then add it to the catalog. This initial data acquisition and importing is the essence of entitlement management, or the practice of assigning the right to use a managed software title. The information creates the administrative policy that you can then use to reconcile newly discovered software installs against. To keep this information continually current, organize it in a structured asset inventory repository that contains a software catalog of owned and available software titles and licenses. A consistent update process will result in an up-to-date catalog that quickly answers auditor queries. By integrating the repository with other SLAM components, you can deduce chargebacks, potential upgrade paths and the number of licenses still available for assignment. The Software & Information Industry Association (SIIA) offers the following license model analysis that includes seven core questions that describe the majority of license types: 1. Who sells it? (OEM, retailer, open source, packager, etc.) 2. How is usage measured? (install, concurrent usage, user login, server access, site license, corporate license, etc.) 3. What are usage terms? (perpetual, subscription, time-limited, etc.) 7. Are there special conditions? (dongle/token, secondary use permissions [home *and* work; desktop *and* laptop], activation key required, etc.) If you capture this information you can resolve every instance against an entitlement granted by the license. There is a great opportunity for cost savings because most modern licenses are fairly straightforward; many include multiple installs resolving to a single entitlement. As mentioned earlier, each software purchase is unique and may have unique terms and conditions. Invoices prove ownership while the license terms and conditions define permitted use. This is especially true of negotiated purchases because license agreements can vary from purchase to purchase. Retail licenses often differ significantly from vendor-direct agreements and OEM licenses are normally extremely restrictive. It s important to attach a copy of the license agreement to each asset record (just as you do with proofs of purchase) and track the location of original media for each purchase. It s also important to understand how the product is defined and delivered. For example, is it a standalone product, a bundle or a suite? What individually identifiable components, such as product name, version, manufacturer, and vendor (which may be different than the manufacturer) make up a bundle or suite? Is the product server-based or installed on end-user devices? Prepare to negotiate license terms Validated data and a clearer understanding of what software you actually use and how you control its distribution and management equip you with the tools to press vendors for better terms. Terms are more than just price they re audit, compliance, secondary install, supplemental use and other specific elements that determine both how you are permitted to use the software and how you manage your vendor relationship. When you possess the hard facts to back up you negotiations, you can confidently go into the audit in a position of strength. While you can only document your current contracts, you can prepare to negotiate future software contracts: Set boundaries on who, when and under what conditions the vendor may call for an audit Establish very clear definitions of compliance; boilerplate contracts are often vague Clarify supplemental requirements such as CALs or prerequisite products; many vendors don t have a single, fixed policy; you may have room to bargain 4

5 Use validated usage data to push for better pricing; consider alternative licensing models The most important part of SLAM is maintaining validated proof of what software you own. This is the most neglected task because it s the most daunting to begin, and is rarely done well: Purchase orders are not enough you need hard evidence of payment, such as paid invoices, cancelled checks, receipts, or vendor records You likely own more than you think; look at OEM, retail, and bulk purchases, not just enterprise agreements Collect purchases into titles to generate a count of owned licenses You may also need multiple managed titles for a single product title. For example, terms and conditions may require licenses to be segregated (OEM or negotiated purchases that may be devicebased, user-based, or subscription-based. Departmental ownership or allocation may demand arbitrary separation for tracking and accountability purposes. In addition, where a single product is delivered as multiple managed titles, it s important to clearly distinguish how each title should be managed and assigned, and dependencies, upgrades and downgrades should be understood. Some titles may require additional assignments (CALs, etc.) or prerequisite software. Resolve Ownership by Creating a Reference Catalog of Owned Titles Entitlement management (software reference catalog) provides you the key baseline for identifying non-compliant installs. A regular, disciplined audit of entitlements conducted at least monthly compared to the software discovery will help you rein in compliance drift. Initial implementation may require an extended project, and while maintenance is simple, it must be continuous. Another key point is that a license is associated with a specific product and version, and each product purchase brings in a new license. By defining a neutral container for an installable product (a managed title), you can now attach all licenses for that product to a single container to enable a total count of owned entitlements for use. In organizations with more advanced IT Service Management (ITSM) discipline, this managed title should be under IT Infrastructure Library (ITIL) change control meaning you only add or remove (or increment the version of ) that title as the result of a planned project. This simplifies end-user requests by creating a short list of available titles, and the IT asset manager manages licenses using the asset repository. Since it s possible you own more titles than you make available for assignment, you should build on ownership data to create a reference catalog of owned titles. This list of such titles, required for true compliance checking, will be a superset given that products like SQL Server (single processor) vs. SQL Server (multi-processor) are different products, for example. In an effort to simplify request handling, you should group owned licenses into managed titles, creating a list of actively supported applications. This list is characterized by common products, versions, license terms and usage conditions, which helps simplify tracking and management. Upgrade licenses are tied to an existing purchase and do not add to the owned total. And finally, some licenses can be used to cover earlier versions of the same product (downgrade rights). You should track which downgrade products and versions are permitted by a newer license. Internal use policies in addition to vendor use policies should be included. Enterprise agreements don t save you from tracking entitlements If you rely on enterprise agreements for key titles, keep in mind that you still need to track the right to use the title. Whether you pay up-front in a bulk purchase or true-up at the end of the year, you still want to install as few copies as you can and an explicit request/approval process is the best way to do it, regardless of how the license is paid for. Consider these points: Annual true-up simplifies accounting, but you still pay for each discovered instance Enterprise agreements tend to be more expensive than negotiated bulk purchases Managing and restricting allocation based on corporate policy is still managed through the request process Allocation tracking (user, workgroup, department, business unit) is needed to understand cost impacts on both teams and projects Cost of allocation should be highlighted in the request process and monthly budget impact reports sent to stakeholders Costs impact of license removals is useful in budgeting and forecasting Administrative tracking backs up discovery and usage management tools help enable resource steering and accountability Discovery Drives Daily Operational Control Discovery, when compared against the entitlement management plan, delivers the objective facts that provide the knowledge to drive daily operational control. Many organizations rely on discovery as their primary SLAM engine, and it is critical to success. But it s not enough. Discovery detects that an install exists, but it doesn t track whether it is authorized. Discovery can tell you what s installed, but not how it resolves to a license. Discovery works in conjunction with entitlement, not as a replacement. 5

6 In a nutshell, three separate elements discovery, recognition, and usage are all generically termed discovery and are often handled by the same systems management or configuration control tool. They form the foundation data for operational control and audit backup. Discovery identifies devices, recognition identifies software products running on those devices and usage tracks statistics on what software is used. These discovery elements work to accurately discover and recognize installed products required for accurate true-up and license management. Different discovery tools recognize software differently, so it s important to know your tool and its characteristics. You may need multiple tools to drive complete discovery. Use discovery data to drive definition of managed products in your entitlement catalog. This ties the tool to administration and ensures that the data is relevant and directly useful. A company-wide discovery discipline serves your organization far beyond the audit, by providing the necessary information to drive entitlement policies, recovery processes and purchasing. The importance of data analytics to turn raw data into actionable information IT departments typically employ an enterprise management or systems lifecycle management automation solution to manage their distributed environments, deploy software packages to multiple users, discover and manage the mobile devices users are bringing into the workplace, secure endpoints, and monitor software licenses. Unfortunately however, the sheer volume of data reported by these enterprise management systems can easily overwhelm its users. Even a moderately sized infrastructure can generate asset inventory reports containing millions of listings. While the data may be thorough, actionable decision-making information is often hiding in plain sight. Organizations are increasingly looking to leverage the data trapped in their enterprise management systems to enable key strategic initiatives and increase the value in their investment. A key area focus for many IT departments is software normalization and reporting. For example, one particular company with an enterprise management solution in place happened to receive an audit notice from Microsoft. The IT staff figured that with its enterprise management system installed, passing the information over to Microsoft for the audit would be an easy task. However, they discovered early on that it would not be so. The problem with any desktop management solution today is not being End User License Agreement (EULA) aware. While the solution can gather all the software found on a PC or server in various ways, the problem is that hundreds if not thousands of entries from a specific manufacturer like Microsoft will be shown, without letting IT staff know exactly what products they hold licenses for. To make matters worse, Microsoft software has been delivered under various names, e.g., Microsoft Corporation, Microsoft Labs, Microsoft Inc., or perhaps even Microsoft Business Solutions. In addition, many of Microsoft s brands have names such as Visio Corporation or others. This creates complexities when attempting to discover software on the endpoints. Data normalization combined with a rules engine allows similar names to be inventoried into a system group. Various software products from Microsoft can be inventoried against one name Microsoft. Data normalization also shows relationships between products; for example, recognizing Adobe Creative Suite as an umbrella identity for Adobe Illustrator, Photoshop, InDesign, Acrobat and other suite components. This greatly simplifies your management of software assets and identifying the assets being used on your hardware endpoints and by your users. Use the SLAM and data analytics disciplines you put in place to generate reports that prove your organization s software usage patterns. By using automated reporting tools that integrate with the structured data repository and the engines for software discovery, request handling, and fulfillment, your organization can support a wide range of decision making, from evaluating and revising internal policies to providing leverage during purchase and contract negotiations: Use Entitlement and Discovery Data to Compare Your SLAM Plan with Reality Keep your organization in compliance by reconciling your entitlement (administrative assignment) with your discovery (actual install) and you ll arrive at the genuinely useful data you can leverage to generate IT work orders. A simple reconciliation report you run once a month supplies the data needed to bring the organization back into true. More importantly, the entitlement tells you exactly which machines are out of compliance. If you discover software for which no administrative assignment was made, you can reasonably assume it s a rogue application and should be removed. If it s not rogue software, but was installed outside the approved process, removing it once or twice will teach employees to adhere to policy and request software through the front door. This is how you create and maintain compliance over time, which will spare you the last-minute frenzy when the auditor calls. With accurate catalog, entitlement, and discovery data you now have the data to reconcile and plan to ensure standards and deal with exceptions. 6

7 Reconcile installs with entitlements Identify unauthorized (un-entitled) installs and have IT remove the software Identify unfulfilled entitlements (not installed) and follow up on the process Recalculate counts of available entitlements (Lack of ) software usage triggers removal (Lack of) software usage triggers removal Set a threshold of inactivity; initiate a process to remove unused software Create an approval process first and automate it as much as possible Provide a cost impact report when tied to cost data from the catalog Maintain discipline over time Keep entitlement data up to date by tying requests to the reference catalog Reconcile installs and entitlements at least monthly; preferably weekly or even daily Recover unused software periodically; at least once each quarter Keep a history of all software additions and removals to satisfy both internal and external audits Conclusion: Survive Audits, Contain Costs and Drive Efficiency Until you take control of software entering and leaving your organization, you remain exposed at the time of an audit. It stands to reason that software audits will increase as vendors continue to collect on revenue losses from unlicensed software. In addition to government copyright laws that permit extreme penalties, an audit burdens your staff, disrupts productivity, and jeopardizes your organization s reputation. With so much at stake, it makes good business sense to prepare for an audit with a SLAM program. Top 10 Benefits of SLAM 1. Turns data into decision-making information 2. Supports both enterprise and departmental agreements 3. Improves internal analysis, chargeback, and financial accountability 4. Reduces legal/financial/reputational exposure risk 5. Improves efficiency and lowers IT support and maintenance costs 6. Assists in budget planning and resource allocation 7. Streamlines mergers and acquisitions 8. Provides data for license renegotiation and purchase right-sizing 9. Ensures consistent and repeatable processes 10. Delivers full visibility into lifecycle data for any asset Two additional SLAM white papers in this three-part series are also worth reading. The Part I white paper Five Steps to Reduce Software License Costs and Ensure Audit Preparedness explains how you can use a SLAM strategy to make sure you have the right number of licenses in your organization and how to reclaim unused licenses in a systematic way. The Part III paper Structuring SLAM to Solve Business Challenges discusses how to avoid repeating costly overbuying mistakes by implementing best practices that automate software installation requests with your software catalog, which in turn enables real-time assignment and recovery based on policy and license availability. This level of sophisticated reporting capability will provide greater visibility and with it greater control over the software entering and leaving your organization. At the time of a software audit, a SLAM program helps you avoid increased license fees and penalties and keeps your employees engaged in your key initiatives rather than burdened by an auditor s requests for documentation. Adhering to a SLAM discipline beyond the audit provides the structure and analysis a company needs to forecast purchases and negotiate better license agreements from a position of strength and knowledge. SLAM will do much more than take the pain out of an external audit; it will allow you to perform routine internal audits to determine if your software assignments benefit your organization, if you have the right software assigned to the right machine, and if you are working with the right vendor. Without processes that offer up hard statistics, you have no leverage for negotiating license agreements, volume discounts, or the details of the audit process. 7