C-ASWCM cheat sheet

SAM scope covers four lifecycle stages: requisition, procurement, deployment/management, and retirement/decommission; each stage has distinct controls and owners.

The SAM policy hierarchy is policy (intent) → standard (mandatory requirement) → procedure (how-to) → work instruction; evidence of approval and review cadence is what auditors test.

Governance bodies: a SAM steering committee sets priorities and funding; a SAM operational/working group executes; RACI assigns accountable owner per process area.

Core SAM process interfaces: procurement (PO to entitlement), IT service management/CMDB (discovery to CI), finance (depreciation, cost allocation), and security (vulnerability and end-of-life risk).

Key performance indicators: entitlement coverage (installed vs. licensed), reconciliation accuracy (variance resolved within cycle), publisher-audit readiness, and cost per managed asset.

ISO/IEC 19770-1 defines SAM process areas (control environment, planning, inventory, verification, lifecycle) and is used as the maturity reference framework.

Maturity model levels typically progress: reactive/ad hoc → defined and documented → managed and measured → optimized and predictive; each level requires evidence artifacts.

Segregation of duties: the person who approves a software purchase should not also approve the entitlement record used to justify compliance.

Metric types: per-device, per-user (named vs. concurrent), per-processor/core (with core-factor rules), per-server, per-instance, and consumption-based (per-hour, per-transaction).

Entitlement record fields: publisher, product, version/edition, metric, quantity, effective dates, contract/PO reference, license type (perpetual, subscription, term), and usage restrictions.

Perpetual licenses grant indefinite right to use a fixed version/edition; software assurance or subscription adds upgrades, support, and sometimes additional rights.

Downgrade rights allow use of an earlier version under a current license; upgrade rights require active coverage - both must be verified against the contract, not assumed.

Second-use/backup and disaster-recovery rights are contract-specific; cold DR instances are commonly exempt, warm/hot instances usually require licenses.

Virtualization rules often hinge on license mobility, host affinity, and whether licensing follows the physical host or the virtual machine; record the rule source in the entitlement.

Consumption-based (cloud/SaaS) entitlements are reconciled by usage metering over a period, not by installed count; true-up is at the billing or contract anniversary.

Effective license position (ELP) = entitled quantity − consumed quantity by metric and scope; a positive ELP is headroom, negative is a shortfall requiring purchase or remediation.

Discovery methods: agent-based (installed on endpoint), agentless (WMI/SSH/SNMP scan), network scan, and inventory imports from MDM, endpoint management, or cloud APIs; each has coverage gaps.

Normalization maps raw discovery strings (name, version, publisher, executable, registry key) to a recognized product/edition catalog entry; unnormalized data cannot be reconciled.

Evidence quality tiers: signed installer/registry evidence > file-version metadata > process or network signature > manual attestation; document the tier per data source.

Deduplication rules: one installation per device per product-version, exclude stale records (no scan in N days), and reconcile multi-source conflicts by precedence order.

Reconciliation steps: extract entitlements, extract normalized consumption, apply licensing rules (cores, virtualization, shared use), compute ELP, assign remediation owner.

Coverage metric = devices reporting ÷ known devices (from AD/CMDB/MDM); a reconciliation is only as trustworthy as its coverage percentage.

Shadow IT and SaaS discovery use network/proxy logs, SSO identity logs, and expense/PO data since agents cannot see browser-based or personally purchased tools.

Reconciliation cadence: monthly for high-value or consumption-based products, quarterly for the remainder; retain snapshots as audit evidence with timestamps.

Audit defense relies on three evidence sets: entitlement proof (contracts, invoices, PO), deployment evidence (dated discovery snapshots), and the reconciliation methodology document.

Typical audit timeline: notification → scoping/NDA → data collection (often 30 days per request) → publisher analysis → findings/true-up → settlement; track every request and response date.

Self-audit before publisher engagement: compute ELP internally, remediate obvious shortfalls, and prepare a defensible position on ambiguous metrics (cores, virtualization, shared use).

Risk scoring: likelihood (metric ambiguity, coverage gaps, prior findings) × impact (true-up cost, legal fees, service disruption); rank products and remediate highest first.

Common findings: unlicensed installs from unmanaged devices, over-deployment after hardware refresh, expired subscriptions still in use, and virtualization/core-factor undercounts.

Remediation options: purchase true-up, uninstall/decommission, renegotiate entitlement, or migrate to a compliant alternative; document the decision and effective date.

Contractual audit clauses specify notice period, scope limits, auditor qualifications, confidentiality, and cost allocation - review before signing and before responding.

Retain audit evidence for the contract's record-retention period (commonly the term plus several years); missing evidence is treated as unlicensed in most settlements.

Reclaim candidates: unused installs (no launch in N days), duplicate tools, shelfware (entitled but never deployed), and over-provisioned editions; quantify savings as units × unit price.

License reharvesting: reassign licenses from leavers or inactive users within the contract's reassignment rules; track reharvest rate as a KPI.

Cloud cost levers: right-sizing, reserved/committed-use discounts, savings plans, spot for fault-tolerant workloads, and deletion of orphaned storage/snapshots.

FinOps lifecycle: inform (showback/chargeback, tagging) → optimize (rightsizing, commitments) → operate (budgets, anomaly alerts, unit economics).

SaaS management controls: SSO/identity inventory, license assignment reconciliation against active users, renewal calendar, and auto-reclaim of dormant seats.

Bring-your-own-license (BYOL) vs. license-included must be modeled per workload; BYOL requires mobility rights and often dedicated-host eligibility.

Total cost of ownership comparison includes subscription fees, support, migration effort, training, and exit costs - not just the headline per-unit price.

Optimization governance: an approval gate before any new purchase that checks existing ELP headroom first; target zero net-new spend while positive headroom exists.

Phased implementation: assess current state → define policy and scope → deploy discovery → normalize catalog → reconcile and remediate → operationalize reporting and continuous improvement.

Stakeholder map: CIO/CFO (sponsor, cost), IT operations (deployment data), procurement (contracts), security (risk/EOL), legal (audit clauses), and business unit owners (demand).

Quick wins to build credibility: top-10 publisher reconciliation, leaver license reclamation, and renewal calendar with advance notice before auto-renewal.

Reporting tiers: executive (cost, risk, compliance status), management (ELP by product, remediation progress), operational (coverage gaps, unnormalized records, exceptions).

Dashboards should show effective license position trend, discovery coverage percentage, open remediation items with owners and due dates, and upcoming renewals.

Communication cadence: monthly operational review, quarterly steering committee, and event-driven escalation for audit notices or major non-compliance findings.

Change management: publish SAM standards, train requesters on the procurement gate, and embed license checks into the software request and onboarding workflows.

Program success measures: reduced audit findings, lower cost per managed asset, improved coverage, and shortened time-to-reconcile - baselined at program start.

Contract anatomy: license grant, metric definitions, pricing schedule, maintenance/assurance rate, term and renewal, audit clause, true-up/true-down terms, and termination.

Negotiation levers: volume tiers, multi-year price locks, co-terminus dates, payment terms, training/support inclusions, and caps on future price escalation.

Renewal discipline: track notice deadlines (auto-renew traps), start negotiation 90–180 days ahead, and benchmark pricing against prior invoices and market data.

Audit clause negotiation targets: reasonable notice, defined scope and frequency limits, confidentiality/NDA, qualified independent auditor, and dispute-resolution path.

Metric definitions must be explicit in the contract (what counts as a user, a core, an instance); ambiguity is the primary source of true-up disputes.

Vendor scorecard criteria: compliance responsiveness, support quality, roadmap alignment, pricing stability, and audit fairness; review annually.

Consolidation strategy: reduce the number of resellers/contracts per publisher to gain leverage and simplify entitlement tracking; document all reseller entitlements centrally.

Maintain a contract repository with key dates, renewal terms, and entitlement quantities linked to the SAM entitlement records; missing linkage creates compliance blind spots.