Software Compliance and Software Portfolio Optimization

Transcription

1 Software Compliance and Software Portfolio Optimization Addressing disparate software risks in the context of Technology Business Operations Chris Herman 1

2 What You Will Take Away from This Presentation Software license compliance and software portfolio management are key vendor management activities that represent different IT risks and require different approaches and different mindsets A current view of software compliance in the industry Forces and factors that increase your compliance risk and exposure today 6 processes necessary for a practical compliance program. The straightforward checklist to help you defend your firm in an audit The meaning of Software portfolio optimization A practical approach to implementing and maintaining software portfolio management The IT organizational model that unites these two different activities: TBO TBO and the Vendor Management Maturity Model 2

3 Position of Software in the IT Vendor Spend Portfolio Figures familiar to most IT Finance and Procurement folks 3 rd party spend as a % of IT budget: 65%* Software 19% of total Hardware 19% Telecom 13% Other 14% Considering the state of Compliance at many companies, this figure should probably be higher Considering the state of Optimization at many companies, this figure could be lower *Forrester Research 2011 IT Budget Planning Guide for CIOs 3

4 Balancing Disparate Risks: Compliance Versus Optimization TWO TYPES OF RISKS With respect to the use of Software, Companies are caught straddling two types of related risks: 1. Compliance Risk (risk of under licensing); and 2. Optimization Risk (risk of overlicensing.or Risk, put (risk another of not 2. Optimization maximizing way, the risk the of productive not maximizing use of software the productive assets, use supplier of software relationships assets, supplier and relationships functional coverage) and functional coverage) 4

5 Two Types of Risks - Two Different Mindsets* Compliance Risk Optimization Risk Asks What is? Asks: What s best? Positive : Factual Normative : Relates to values * With apologies to the legitimate study of the lateralization of brain function 5

6 Two Types of Risks: Why They re Almost Always Treated Separately in Industry Literature Compliance Asks What is? Optimization Asks: What s best? Simple questions about matching: Am I entitled to as many licenses as I ve deployed? Do I have the means to measure deployments and entitlements? A complex set of questions about right fit: What function sets (note: Not products ) does my organization need to thrive? Do I already have one or many products that perform the needed function sets? Do I have new needs that can t be met with the current portfolio? Do I have products or components of suites that I no longer need? Are my supplier relationships consolidated for the greatest leverage? Do I need to form new relationships? Change Agent? 6

7 The First Half of the Problem: Software License Compliance 7

8 While both Compliance and Optimization can be considered part of Software Asset Management only Compliance is essential (i.e., no one says you have to be efficient, but the law says you have to be accurate) Simple logical points: It s the Law If you don t know what you have, you can t take any actions It s a prudent necessity to prepare your company for an audit Why you can t wait: Four complacency-challenging events that occur to every company 8

9 Software Compliance: Knowing What You Have is No Longer a Rainy Day Activity: Four Complacency-Challenging Emergencies that Every Organization will Face Merger and Acquisition Activity Sale Agreements that require delivery of valid free-standing licenses to the Buyer Purchase Situations that may require consolidation of multiple Agreements Outsourcing/Insourcing Pursuit of vendor consents that surfaces compliance issues Repatriation of licenses that had been in the custody of the service provider Cost Reduction Initiatives Put you in the middle between cost pressures from the organization (to, e.g., take software off support) and pressure from suppliers to maintain the whole portfolio Software Compliance Audits Disruptive events that create fire drills and involve unplanned expense Negative findings can alert Industry groups and other publishers Preparing for these events requires a formal discipline of administrative oversight and control for IT and software asset management; ad hoc responses are extremely painful 9

10 Look at it Another Way: Both Internal and External Forces Increase Software License Compliance Risk Today Internal Forces M&A activity Outsourcing Cost Reduction Initiatives Corporate adoption of complexity bringing technology changes Virtualization Cloud Computing External Forces Publisher-driven Software Audits Note also the rise in the use of 3 rd party auditors to perform the audits BSA and industry groups Whistle blowers Already mentioned Down economy(or loss of competitive position) results in publishers looking to compliance enforcement as revenue source 10

11 Internal Forces: Adoption of New Technology How Adoption of Virtualization Creates Compliance Risk Before Server Virtualization Machines to software typically 1:1 ratio Intuitively 200 servers = 200 licenses of X* Additional software usage, usually associated with clear affirmative steps and incremental effort (e.g., purchasing, installation, change management, etc.) Client able to insert controls into purchasing processes Type of challenge was tracking machine types / characteristics to software usage After Server Virtualization (mostly Wintel platform) No longer 1:1 machine to software ratio Machine may have 1 instance or 5 instances requiring software licenses Additional instances requiring software can be spun up almost instantaneously No logical external control points for new software New tracking / processes required * Innovations in licensing models has always trailed innovation in processor technology. Before virtualization, licensing complexity arose from sophistication of server CPU technology; # of CPUs, multicore processors, etc., etc. 11

12 Internal Forces: Adoption of New Technology How Adoption of Virtualization Creates Compliance Risk Dynamic and evolving Usage Rights (See excerpted TOC from MS licensing publication on virtualization) It s complicated - It s not uncommon for large companies to retain dedicated staff who specialize in license usage rights 12

13 Internal Forces: Adoption of New Technology Virtualization: Big Players are pursuing the Space Microsoft and Citrix join VMware in Gartner s Market Leaders Quadrant for Virtualization Technology: This graphic is important to guide your prioritization of efforts The normal sourcing approach is to prioritize actions by spend; an informed view of compliance prioritization is also guided by considerations of risk/exposure 13

14 External Forces: Software Publisher Audits Software Publisher Audit Activity Gartner 2011 Survey Survey Data: Percentage of Gartner members reporting being audited by named publishers within last 12 months IBM (44%) Adobe (38%) and you thought Adobe was free? Microsoft (32%) Oracle (19%) SAP (16%) McAfee (15%) Attachmate (13%) HP (14%) Autodesk (12%) VMware (11%) BMC (5-10%) CA (5-10%) EMC (5-10%) Novell (5-10%) Informatica (5-10%) From Gartner website: visit for additional information. Individual Publisher Audits represent the vast majority of formal audits. 14

15 BSA Member Companies External Forces: Industry Publisher Alliances Business Software Alliance Facts 35% 2011 USA World Piracy Rate 19% 42% 54% 65% Value $ $9.7 Billion $63.4Billion The Magnitude of the problem: From the 2011 BSA/IDC Global Piracy Study From BSA website: visit for additional information. 15

16 External Forces: Software & Information Industry Association SIIA Facts: Whistle Blowing Those reporting piracy can receive up to $1M rewards Using Illegal software OR content (newspapers, articles) Typically from Employees, Vendors, or SIIA Members SIIA Participating Companies SIIA Audit Process: Contacted by / Question Source (if reliable) Notify publisher, get authority to pursue Forward to outside counsel Counsel requests cooperative audit president If unlicensed copies found SIIA requires Uninstall illegal copies Purchase required licenses Pay significant fines and penalties Implement company wide compliance policies If company refuses to cooperate, SIIA can/will sue for copyright infringement on behalf of software publisher From SIIA website: visit for additional information. 54% 65% 16

17 Breaking Down Compliance Practicalities: The Six Processes Needed to Support a Compliance Program 1. Track Entitlements: Acquisition artifacts (Locatable Vendor Contracts; Searchable PO, payment and receipt records) Approval /allocation artifacts (supporting financial allocations to specific users/bus /Apps/Projects) Entitlements definitions, organization and tracking (Within contracts: Administrative tracking and maintenance of rights by product/platform/version) 2. Track Deployment: Deployment records (physical/logical) In advanced shops, the CMDB being timely and appropriately updated and supported by robust change management, release management and configuration management processes Establish active decommissioning processes (how counts are actively decremented as platforms and apps and specific servers are sunset or taken out of the environment and, via linkage to HR systems, when individuals leave the organization) Link deployments to Strategic Portfolio Review (See Optimization) and to the activities of the tsar of sunsetting 3. Control Physical Media Assets: Establish process for Media Storage and Access (management and control of Gold disks and other physical media assets) 17

18 Breaking Down Compliance Practicalities: The Six Processes Needed to Support a Compliance Program 4. Measure Usage: Measurement/Scanning (identifying what s on the machines; using different tools for different platforms, such as SMS for Wintel; Tivoli for Unix; IBM Tivoli License Compliance Manager for z/os [was Isogon s SoftAudit ] for mainframe) Tracking other usage records for validation (e.g., utilities that report detail on capped partitions, usage high watermarks, and other usage profile info that might not be captured in a static periodic scan) Understanding and administering License Use restrictions, Entity; Organization; Location; User, etc. 5. Administer a Reconciliation Process: Comparison (ideally automated) of acquisition/entitlements/approval artifacts with deployment installation/usage info Design and implement mitigation activities (Buying to remedy shortfalls, or reducing usage to force deployments to match entitlements) Periodic True-ups/downs with suppliers 6. Create Policies /Communications: Compliance Policy Development and Maintenance Communication Program Create linkage with HR Policies 18

19 Compliance Practicalities: Do I have to Boil the Ocean? Implementing the 6 processes for every piece of software in your environment may seem impossible Common attitude: If I can t resolve to be perfect, then I m just going to wait until I get my first audit letter. Message of Hope: For every category of process there is a maturity model that begins with simple awareness of the issue 19

20 Compliance Practicalities: Do I have to Boil the Ocean? Let prioritization be your guide Choosing the top vendors by spend and risk will help you do the following: Address the majority of your portfolio (the familiar 80/20 rule) Design, pilot and establish processes that can be rolled out for the entire portfolio It s OK to start small, but you must start The compliance processes and policies that you promulgate through your organization and attempt to implement begin to form your defense against punitive audit findings (see optional program checklist for those who leave a card with your address ) * The BSA* has excellent training resources for any firm wishing to formalize their compliance program Visit for additional information. 20

21 The Other Half of the Problem: Software Portfolio Optimization 21

22 What is Software Portfolio Optimization? It addresses a complex set of questions about the right fit: To put it most simply What s the least we can buy in the most efficient way (lowest unit cost and fewest suppliers) to meet the company s requirements and to be in compliance with our licenses? 22

23 What is Software Portfolio Optimization? It may appear superficially to describe a Sourcing function, but it s much deeper and more proactive Portfolio optimization seeks the following: 1. Optimal Functional Consolidation 2. Optimal Product Consolidation 3. Optimal Supplier Consolidation 23

24 What is Software Portfolio Optimization? By another analogy, it addresses how to best manage the ecology of software usage raising the concepts of: Need Use/Consumption Desired Benefit Surplus Recycling 24

25 Breaking Down Optimization Practicalities Part I: Discovery Do a forensic review of your artifacts in the following priority order: Financial and budget documents Current costs (info can be collected in expanding circles as practical: Actual license and maintenance cost, cost of associated technology environments [if any]), Systems Architecture Relationship of Software Products to key client applications Systems Architecture Standards Establish the strategic standing of individual products with the Architecture group Software Asset management records (the link with compliance) Software entitlement information Software deployment records/current usage 25

26 Perform a Stakeholder survey on products: To get maximum buy-in (and to avoid pitting experts against users) create and administer a survey process that quickly captures information about products relative to multiple aspects of need and adoption: Valid business requirements for function Current directional nature of the product within organization (being adopted? being sunset?) Need for level of support (Platinum, Gold, Silver?...Are you able to drop support completely?) Perform a Stakeholder survey on processes: To understand your organization s current and planned ability to support and sustain optimization: Financial Controls IT Sourcing Breaking Down Optimization Practicalities Part I: Discovery (continued) Systems Architecture/Technology Standards Board Software Asset Management/Software Compliance program (Tools) Contracts Management (Tools) 26

27 Breaking Down Optimization Practicalities: Survey results create Preliminary Action Recommendations 27

28 Breaking Down Optimization Practicalities Part II: The Roadmap Review, document and organize the findings and develop recommendations and an action plan that includes: Organized survey results Findings on current or planned tools and processes that will support or inhibit implementation of optimization initiative: Prescriptive action plans that prioritize and calendar specific optimization/rationalization activities Identification of implementation risks and assumptions A reusable process to roll out to additional high impact product categories (if piloted on a single category and through the documentation of lessons learned) Identification of subsequent phase activities such as: Improvement of supporting tools and processes Implementing a software lifecycle management approach that will stay aligned with evolving business technology requirements through periodic iteration of the survey process 28

29 Bringing the Two Halves Together: New IT Organizational Model Technology Business Operations (TBO) Change TBO Agent? 29

30 Technology Business Operations (TBO): An Organizational Model for IT; The Other of IT Functions CIO The TBO Functions optimally enable the delivery of core IT services through efficiency and business alignment Asset Tracking and Reporting Asset Audits - Reconciliation CMDB Asset Management Recycling and Disposition AMO (Applications) Financial Management Budget Forecasting Business Cases Chargeback - Transfer Pricing Cost Management Invoice Analysis ITO (Infrastructure) Vendor Management Compliance Contract Management Outsourcing Governance Sourcing TBO Customer Management Communications Customer Relationship Management Demand Management Project Portfolio Management (PMO) Work Intake 30

31 Technology Business Operations (TBO): Related Functions Supporting both Compliance and Optimization Under Single Stable Model CIO AMO (Applications) ITO (Infrastructure) TBO Asset Management Financial Management Vendor Management Customer Management Asset Tracking and Reporting Asset Audits - Reconciliation CMDB Recycling and Disposition Budget Forecasting Business Cases Chargeback - Transfer Pricing Cost Management Invoice Analysis Compliance Contract Management Outsourcing Governance Sourcing Communications Customer Relationship Management Demand Management Project Portfolio Management (PMO) Work Intake 31

32 TBO: Definition of the Required Function WHAT: WHO: WHY: A cross-functional IT business office that optimally enables the efficient delivery of the core IT function (both applications and infrastructure) An organization staffed with subject matter experts in IT Finance, Sourcing, and Technology Management To manage the increasing complexity and vendor management focus of the Corporate IT Function RESULTS IN: Processes that sustain the alignment with internal customer business goals by matching spend to value. The only durable way to solve the problem of ownership and change agency 32

33 Characteristics Moving up the Vendor Management Maturity Model Level 1 Basic Level 2 Standard Level 3 Advanced Level 4 Dynamic Lacking or Limited: IT buying is done without processes; Multiple resellers used without coordination EXAMPLE: Separate vendor relationships inconsistently managed by SMEs No consistent storage of Agreements No knowledge of vendor spend Minimal Outsourcing Governance Uncoordinated Improvements: IT buying is organized under a larger sourcing function; some consistent processes exist; there is some consolidation of resellers for efficiency Some management of major IT vendors, primarily based around executing annual commitments (e.g., true-ups and renewals) Some physical and some online storage of major agreements Info on IT vendor spend and multiple vendor relationships comes from budgeting process and sourcing organization Periodic Outsourcing Governance meetings mostly related to operational issues Cross-Functional Focus: IT buying is organized under a larger sourcing function with consistent processes across all regions and affiliates; strategic reseller relationships established Top 10 major IT vendors are managed with QBRs and other formal periodic assessments Online and physical storage of all major agreements via a single tool Integrated info on IT vendor spend is available and is used to leverage relationships Appropriate Outsourcing Governance meetings occur regularly to manage ops, consumption,, and business issues; formal program exists to educate stakeholders in the key agreement terms Dynamic Integration: IT buying is organized under a larger sourcing function with consistent processes across all regions and affiliates; strategic reseller relationships consolidated and optimized All major and mid-size IT vendors are managed with QBRs and other formal periodic assessments Online and physical storage of all major agreements via a single tool with links into the CMDB Integrated info on IT vendor spend and on forecasted demand is available and actively used to optimize relationships Appropriate Outsourcing Governance meetings occur.etc. VM function fully integrated with Asset Management, Fin Mgmt. and Customer Mgmt. Reacting Controlling Optimizing Innovating 33

34 TBO Supports the Stability and Evolution of Vendor Management As long as compliance and optimization processes are viewed as independent initiatives without a stable organizational home, they always risk loss of ownership The only way to assure their evolution and protect them from organizational distractions is to make them a formal part of the IT Organization through the TBO model 34

35 Conclusion Software license compliance and software portfolio optimization are often treated separately in the industry because addressing their distinctive issues seems to require two different ways of thinking: Pure administrative tracking versus seeking to understand and serve requirements at the lowest cost Compliance is the fundamental activity and the current environment is one of increasing risk and exposure There are 6 basic processes necessary to implement a practical compliance program Prioritization based on spend and risk/exposure offers you a starting point Software portfolio optimization means addressing requirements at the least cost The approach outlined here begins with financial and process discovery; proceeds with a structured survey of requirements and results in the development of a roadmap for license portfolio optimization The most effective way to address both Compliance and Optimization requires implementation of an IT organizational model called Technology Business Operations or TBO Adopting the TBO model resolves the problem of functional ownership and the missing change agent The highest level in the Vendor Management maturity model can only be reached and sustained with the implementation of the TBO model 35

36 Contact Information Chris Herman Senior Consultant Mobile: