All rights reserved. No part of this document shall be reproduced, stored in a retrieval system, or transmitted by any means, electronic,

mechanical, photocopying, recording, or otherwise, without permission from 1E. No patent liability is assumed with respect to the use of the

information contained herein. Although every precaution has been taken in the preparation of this document, 1E and the authors assume no

responsibility for errors or omissions. Neither is liability assumed for damages resulting from the information contained herein. The 1E name is a

registered trademark of 1E in the UK, US and EC. The 1E logo is a registered trademark of 1E in the UK, EC and under the Madr id protocol.

NightWatchman is a registered trademark in the US and EU.

PRAGMATIC SOFTWARE GOVERNANCE DISCOVER HOW DYNAMICALLY CONTROLLING YOUR LICENSE ESTATE LEADS TO A

SOFTWARE BALANCE AND PROTECTS YOUR ORGANIZATION

GEOFF COLLINS

MARTIN ANDERSON

1E

APRIL 2011

ABSTRACT: This whitepaper sets out the 1E view of software governance and compliance, highlighting that the

correct approach is not to overspend and overprovision, but nor is it to wait for your chosen software vendors to

audit your enterprise. The answer is to get the balance ‘just right’.

© 1E 2011 2

Contents

Too much or not enough? ......................................................................................................................................... 3

What’s the recipe? .................................................................................................................................................... 4

Liability and control ................................................................................................................................................... 7

Getting it just right .................................................................................................................................................... 9

References .............................................................................................................................................................. 10

© 1E 2011 3

Too much or not enough?

“63% of software vendors cited revenue generation as their number one reason for operating a compliance

program, while 50% also want to protect their intellectual property rights.”

Software compliance without tears, Ernst & Young, February 10, 20111

Like Goldilocks and her porridge, when it comes to software governance and compliance, every organization needs

to get things ‘just right’. Spend too much in a climate of restricted spending, overprovisioning on software licenses

that you think you might need, and you impact budgets and your ability to invest in strategic projects. By contrast,

spend too little and when software vendors approach you about your installed software base you run the risk of non-

compliance, fines and legal action.

But what constitutes a sensible level of control? Effectively minimizing the cost of licensing and managing software,

while not exposing your enterprise to the risk of an audit is the key, but it’s often not as straightforward as it might

appear. Some projects aimed at understanding and managing software compliance run on for many years and

struggle to demonstrate any return on investment. But equally, the solution cannot be so simple as to hope for the

best and shout ‘help’ when the auditors arrive.

Getting it ‘just right’ is not as easy as it looks.

© 1E 2011 4

What’s the recipe?

“Gartner continues to see increasing incidence of software vendor audits, making it critical

that customers negotiate with an understanding of how license compliance can be

accomplished consistently and cost-effectively.”

Key Issues for IT Asset Management and Procurement, Gartner, 25 February 20092

No organization wants to be unprepared and have their business interrupted by a software audit. They may be able

to struggle through one but there is no guarantee that these are single occurrences. Every enterprise can and should

be prepared for that inevitable visit before it happens. But to be prepared you need to answer three fundamental

questions: ‘What do I have installed?’ ‘What do I own?’ and, most importantly, ‘What do I actually need?’

What software do I have installed?

The first step to compliance is getting control of what has been installed in your enterprise. Many times even

answering this seemingly simple question can be a real struggle even if they have a top of the line systems

management solution in place. The unfortunate truth for many organizations is that it will boil down to an

approximation based on some raw data because of the uncontrolled manner in which software is installed and

inventoried.

The root of the problem lies in the vagaries of product information, with inconsistent and incomplete product names,

versions and editions often published without a common format. Some standards of how software should run on

Windows platforms do exist. However, the enforcement on ISVs to follow these standards is not strictly controlled. For

instance, even though many operating systems offer file attributes, not all software publishers take advantage of these

features. And in the event that software offerings do include relevant attributes, a lack of formal quality assurance can

significantly lessen consistency.

Software bundling is a common practice when releasing software that supports commoditized functionality, such as

web services. Again, publishers rarely change details in the registry entries or file attributes to indicate that the

software is bundled, so systems management tools typically cannot differentiate bundles from full products requiring

associated licenses. From the software vendor’s perspective, identification of suites or bundles is not their concern

which is why they do not build such identification into their products. As a result, the reported software inventory is

artificially inflated to contain items for which users can rarely prove entitlement.

These inconsistencies are then compounded by the presence of ‘try before you buy’ evaluations, unrecognized by

systems management tools and often downloaded by users direct to the desktop without the knowledge of the IT

department. Installations such as these are not localized to individual users either. Rather, it is more the case that

one person in a department begins to independently use a piece of software which they have installed and then via

word of mouth they push others in their group to do the same. This problem worsens when we consider that

applications can be downloaded through the Internet or via portals or installed using flash drives or disks.

Then there is the issue of data collection itself. The traditional approach employs systems management tools to

examine the software for registry entries, file attributes and product identification data embedded in the code to

produce an inventory. An inventory of your desktops, notebooks and servers should give you visibility of all the

software you have installed. But when used for this purpose, systems management tools frequently produce a lot of

© 1E 2011 5

‘noise’. From a software developer’s perspective the information that accompanies the file wasn’t intended to assist

the IT Administrator’s inventory and identification process in so much as it was intended to help the software

development and debugging process.

To begin with the inventory will be full of software that you don’t need to know about, including hot fixes, drivers,

toolbars, plugins and Java Runtime licenses. It will also contain duplicates caused by those inconsistent product

names, versions and editions, usually leading to double counting and inaccurate results. All of this data needs to be

cleaned, often as part of a laborious manual process. Once you’ve been through all that, you then need to filter your

results just to identify the software that is commercially licensable.

It is perhaps not surprising then, in a recent survey conducted by Opinion Matters on behalf of 1E, that two in every

three respondents in organizations with more than 500 employees said they found preparing for software vendor

audits challenging.3

So let’s assume you’ve been able to identify what you have installed. How do you understand how much of it is

actually yours?

What do I own?

The ability to track purchase information for licenses is much more difficult than many organizations realize or care

to admit. This is typically because the information is not held in one central source, but by a number of individuals or

departments and in a myriad of different formats.

License details will be found in your accounting and purchasing departments, recorded on spreadsheets or detailed

in finance applications. They will be stored on paper, filed away in cabinets somewhere by your IT team. They could

even appear in marketing or sales, purchased from a high street store on expenses having been authorized by a line

manager. They may not have even been recorded at all! Some organizations will freely admit that because some

SAM tools are so large and complex they would rather wait for a vendor to come to them with an audit rather than

try to manage the process themselves.

1E’s own research would suggest that nearly 50% of enterprises still use spreadsheets to record software licenses,

with almost 9% still using a paper-based filing system and a staggering 14% using nothing whatsoever.3

Larger enterprises also operate on an international basis, from multiple sites and in many different countries, each of

which might have their own purchasing, finance or IT teams and their own local procedures governing software

purchases. Indeed, that same research would suggest that 43% of organizations manage their software regionally,

39% by department and 20% on a project-by-project basis.3 Ian Blatchford, a partner with Ernst & Young, agrees,

saying “Customers feel that their own decentralized structures often make it harder to keep track of usage around

the organization - as does their increasingly complicated suite of IT packages."4

Additionally there are many organizations that have scattered licenses and overlaps in software functions due to

mergers and acquisitions. This often gets overlooked and causes both over payment in software due to duplication in

job functions but also liability from lost tracking of licenses.

Inevitably, many organizations will be forced by the sheer complexity of uncovering and recording all this data to

assign a project team to the job of gathering license information across the business. Some will even need to contact

vendors and other sources, increasing still further the risk of an audit.

© 1E 2011 6

Now let’s assume you have been able to accurately identify what software you have installed and how much of it you

own. The last part of the story is to understand how much of what you have is actually needed.

What do I actually need?

This question could be rephrased as, “What am I actually using?”

A review of your software estate may well determine how many copies of applications are installed on your systems

and whether or not you have paid for those licenses, but you also need to determine which of these software

applications are actually being used, by whom and how often.

Without usage data, you may be purchasing software based on perceived requirements or user requests, not actual

need. Usage data plays an important role in determining which applications should be included in a standard image

and how many standard images may be needed to meet the different requirements of users. It also plays a part in

monitoring and controlling the use of unauthorized applications and in preventing the downloading of insecure, non-

approved software. Having control of software licenses in your environment also reduces the risk of expensive

penalties and legal exposure.

The true realization comes when you see that software usage and license liability are tightly coupled topics that can

be addressed in order to keep your software installation and purchasing decisions optimal. Software which is

installed and used would fall into the category of “I need this software” however software which is installed yet not

licensed wouldn’t. We would refer to this as waste. But what if, in addition to waste you had software which was a

liability with respect to licensing? – I.e. installed copies of software for which your organization hadn’t purchased

licenses for yet. It’s in your best interest to know the usage information for this group of systems as well in order to

make prudent purchasing decisions.

Once you know what software you have, how often you’re are using it, and how much your organization has

purchased, you have the information you need to make informed business decisions. Once you can make informed

business decisions, you can put software in place to automate these and keep your environment in an optimal state.

© 1E 2011 7

Liability and control

“In a survey of attendees at our IT Asset Management, Procurement and IT Financial

Management Conference conducted in November 2010, 61% of the 144 respondents

said they had been audited by at least one software vendor in the past 12 months.”

IT Asset Managers Should Prepare Now, Gartner, 2 March 20115

But even if you can find out what you have, how often you’re using it and how much you’re paying for it, how do you

manage your liability and control your risk?

In the vast majority of cases organizations fall out of compliance by accident rather than by design. It may take you

many months (or in some cases years) to audit your software licenses, ownership and usage in preparation for that

audit. But how are you going to keep that information up-to-date ready for next year or the year after that. You don’t

know when a software vendor will request an audit, just that they surely will.

While perhaps there has been a tendency over the years to shy away from discussing software compliance, it

remains the primary goal for many organizations in reviewing their software licenses. 40% of the enterprises Opinion

Matters questioned said this was their main concern, with a further 22% highlighting reduced business risk.3

It’s not just a question of identification; it’s also a question of control and the ability to take action in order to

remediate a problem. With this in mind, software license management tools provide the next and arguably most

important step in the process.

Audit data, as we have seen, can only contribute towards compliancy if it is combined with entitlement data,

obtained from recording purchases and reports from vendors. For many enterprises, this ‘true up’ could be an almost

entirely manual process requiring analysis of general ledger postings and tracking back to accounts payable to find

the invoices. Furthermore, it could be out of date in a matter of days. The key point here is that license management

tools need to be “plugged-in” to the active software estate to consistently present compliance status to the IT

department.

Advanced license management tools automate the correlation of installation, ownership and critically need,

providing a central resource for ongoing compliancy while responding to and reducing liability in the short, medium

and long term. The ability for a license management tool to control compliance is considered a base from which a

complete compliance program can be built. The control of this data must be automatic, ‘active’ and ongoing. It must

be continually tracked and monitored, alerting appropriate managers when the business falls out of compliance or is

overbuying licenses and thereby wasting money.

Rather than simply identifying what has, or has not, been purchased, sophisticated tools can manage centralized

deployment and removal of applications, auto-reclaim unused software on one client machine and deploy to another

and even ‘rent’ applications to users on a temporary basis for only as long as they need them. They can also reduce

or even remove purchased but unused applications, known as ‘shelfware’, from the business. It is these elements of

advanced control that set some software license tools apart.

© 1E 2011 8

More importantly, your enterprise will enjoy immediate cost savings from improved software allocation, volume

license discounts, better price points, accurate asset depreciation and more - all while eliminating the risks

associated with software non-compliance, lack of policy enforcement and inappropriate or unnecessary usage.

© 1E 2011 9

Getting it just right

“Software audits are increasing. Organizations must fund IT asset management disciplines or will risk high,

unexpected financial liability due to software compliance problems. Having good asset management can

reduce the time and pain of a software vendor audit.”

IT Asset Managers Should Prepare Now, Gartner, 2 March 20115

Uniquely focused on software waste, AppClarity™ from 1E delivers compliance without complexity by filtering out

irrelevant license data to show just licensable software, organizing it by financial impact or vendor so you can quickly

focus your compliance efforts.

AppClarity enables your organization to make immediate reductions in software costs by analyzing all your

applications instantly and providing you with actionable results, reducing your spend within one month. By

identifying the software you actually use, then automatically removing what you don’t need and reallocating to

reduce license liability, AppClarity enables you to financially quantify all software waste by identifying and controlling

unused software across your whole enterprise.

AppClarity also reduces business risk by controlling unapproved and prohibited software installs (such as torrent-like

applications), automating software removal to protect your organization. From a security perspective this has the

added benefit of reducing your entire company’s attack surface.

Using a simple traffic light status to show compliance, together with additional guidance on how that compliance was

calculated, AppClarity provides comprehensive reporting for vendor audits with just a few mouse clicks, reducing the

cost and time it takes for your enterprise to prepare for any software vendor audit. Never again will you need to

conduct manual ‘true ups’ and labor intensive audits.

Through feature identification techniques, AppClarity also has the ability to provide reports and actions where

“functional overlap” is taking place in your organization. This means that AppClarity can help reduce overspending

due to two applications being purchased and installed which provide the same features and functions to the user

community.

By making sense of what software you have, why you have it, and where and how it is being used, AppClarity allows

you to make informed strategic and operational decisions, putting you in a much stronger negotiating position when

renewing maintenance or purchasing additional licenses. And it does this on a continual basis, month-on-month,

year-on-year.

Deploying AppClarity alongside other 1E products like Shopping™ delivers a solution that further enhances license

control by offering the opportunity to rent applications on a short term basis to users, so that short term needs do

not become long term liabilities.

Getting it ‘just right’ is possible; you just have to know where to look.

© 1E 2011 10

References

1 Software compliance without tears Monitoring customers’ software usage in a complex world, February 10, 2011.

Available from: http://www.ey.com/Publication/vwLUAssets/Software_compliance_without_tears_-

_Monitoring_customers_software_usage_in_a_complex_world/$FILE/EY_-

_Software_compliance_without_tears_Monitoring_customers_software_usage_in_a_complex_world.pdf

2 Key Issues for IT Asset Management and Procurement, February 25, 2009. Available from:

http://www.gartner.com/DisplayDocument?doc_cd=165771&ref=g_rss

3 Software Efficiency Report 2011. Opinion Matters survey on behalf of 1E, 2011

4 Software compliance without tears. Software asset management survey, Ernst & Young March 2011

5 Survey Analysis: Survey Shows Another Increase in Software Vendor Audits; IT Asset Managers Should Prepare

Now, March 2, 2011. Available from: http://www.gartner.com/DisplayDocument?id=1569814&ref=g_fromdoc