C-ASWCM flashcards

36 cards. Read the term and the definition here. The deck at the top of this page is optional.

Effective License Position

Entitled quantity minus consumed quantity for a given product, metric, and scope. Positive means headroom; negative means a shortfall requiring purchase or remediation.

Entitlement Record

Documented right to use software: publisher, product, edition, metric, quantity, effective dates, contract reference, and license type. It is the baseline for reconciliation.

Downgrade Rights

Contractual right to install an earlier version of a licensed product instead of the current one. Verify in the agreement; it is not automatic across all publishers or programs.

Named vs Concurrent

Named user licensing counts every identified individual who may access the software. Concurrent licensing counts only simultaneous sessions, capping peak usage rather than headcount.

Core Factor

A multiplier applied to physical processor cores to derive licensable core counts. Values differ by processor family and are defined in the publisher's licensing guide.

Consumption-Based Licensing

Billing by metered usage such as hours, transactions, or API calls over a period. Reconciliation uses usage metering, not installed counts, and true-up occurs at billing intervals.

SAM Policy Hierarchy

Policy states intent, standards state mandatory requirements, procedures describe execution steps, and work instructions detail single tasks. Auditors test approval and review evidence at each level.

SAM Steering Committee

Executive governance body that sets SAM priorities, approves funding, resolves cross-functional conflicts, and reviews compliance and cost performance quarterly. Operational execution is delegated to a working group.

RACI in SAM

Responsible performs the work, Accountable owns the outcome, Consulted provides input, Informed receives updates. Each SAM process area needs exactly one accountable owner.

ISO/IEC 19770-1

International standard defining SAM process areas including control environment, planning, inventory, verification, and lifecycle management. Used as a maturity reference and audit framework.

Segregation of Duties

Control principle separating incompatible responsibilities, such as purchase approval and entitlement recording. It prevents single-person manipulation of compliance data and reduces fraud risk.

Agent-Based Discovery

Inventory software installed on each endpoint that reports installed applications, versions, and usage. Provides deep data but requires deployment coverage and agent health monitoring.

Agentless Discovery

Remote scanning using protocols such as WMI, SSH, or SNMP to collect inventory without installed agents. Easier to deploy but limited by credentials, firewall rules, and device availability.

Software Normalization

Mapping raw discovery strings such as product name, version, publisher, and executable to a recognized catalog entry. Unnormalized records cannot be reliably reconciled against entitlements.

Discovery Coverage

Devices reporting inventory divided by known devices from directories, CMDB, or MDM. Reconciliation credibility depends directly on this percentage and on recency of scans.

Shadow IT

Software or SaaS procured outside approved channels. Detected through network and proxy logs, SSO identity records, and expense data because agents cannot see browser-based tools.

Reconciliation Cadence

Scheduled frequency for comparing entitlements to consumption. Monthly for high-value or consumption-based products, quarterly otherwise, with dated snapshots retained as audit evidence.

Evidence Quality Tiers

Ranking of discovery sources by reliability: signed installer or registry evidence highest, then file metadata, then process or network signatures, then manual attestation. Document the tier per source.

Audit Evidence Sets

Three required defense artifacts: entitlement proof from contracts and invoices, dated deployment snapshots, and the documented reconciliation methodology. Missing evidence is typically treated as unlicensed.

Publisher Audit Timeline

Sequence from notification through scoping and NDA, data collection, publisher analysis, findings, and settlement. Log every request and response date to enforce contractual notice and scope limits.

Compliance Risk Score

Likelihood multiplied by impact. Likelihood reflects metric ambiguity, coverage gaps, and prior findings; impact reflects true-up cost, legal fees, and service disruption.

Audit Clause Terms

Contract provisions governing notice period, scope and frequency limits, auditor qualifications, confidentiality, and cost allocation. Review before signing and before responding to any audit notice.

Self-Audit

Internal reconciliation performed before publisher engagement: compute effective license position, remediate clear shortfalls, and prepare defensible positions on ambiguous metrics such as cores and virtualization.

Shelfware

Entitled licenses that were purchased but never deployed or used. Quantified as unused units times unit price and treated as a primary reclamation and negotiation target.

License Reharvesting

Reassigning licenses from leavers or inactive users to new demand within contract reassignment rules. Reharvest rate measures how much new demand is met without new spend.

FinOps Lifecycle

Cloud cost management cycle of inform, optimize, and operate. Inform covers tagging and showback; optimize covers rightsizing and commitments; operate covers budgets and anomaly alerts.

BYOL vs License-Included

Bring-your-own-license uses existing entitlements on cloud workloads and requires mobility rights and eligible hosts. License-included bundles licensing into the cloud rate.

Orphaned Cloud Resources

Unattached storage volumes, old snapshots, and idle instances left after workload changes. They generate recurring charges without business value and are common optimization findings.

SAM Maturity Model

Progression from reactive and ad hoc, through defined and documented, to managed and measured, then optimized and predictive. Each level requires specific evidence artifacts.

Phased SAM Implementation

Sequence of assess current state, define policy and scope, deploy discovery, normalize catalog, reconcile and remediate, then operationalize reporting and continuous improvement.

SAM Stakeholder Map

Sponsors such as CIO and CFO, data providers in IT operations, contract owners in procurement, risk owners in security and legal, and demand owners in business units.

SAM Reporting Tiers

Executive reports cover cost, risk, and compliance status; management reports cover effective license position and remediation progress; operational reports cover coverage gaps and exceptions.

Contract Repository

Central store of agreements with key dates, renewal terms, audit clauses, and entitlement quantities linked to SAM records. Missing linkage creates compliance blind spots.

Auto-Renewal Trap

Clause automatically extending a contract unless notice is given within a set window. Track deadlines and begin negotiation 90 to 180 days before expiry to preserve leverage.

Vendor Scorecard

Annual assessment of publishers and resellers on compliance responsiveness, support quality, roadmap alignment, pricing stability, and audit fairness. Informs consolidation and negotiation strategy.

True-Up and True-Down

Contract mechanisms adjusting licensed quantities at defined intervals. True-up adds licenses for overuse; true-down reduces committed quantities, often with eligibility limits and notice requirements.