Discover how dynamically controlling your license estate leads to a software balance and protects your organization.

1. PRAGMATIC SOFTWARE GOVERNANCE
DISCOVER HOW DYNAMICALLY CONTROLLING YOUR LICENSE ESTATE LEADS TO A
SOFTWARE BALANCE AND PROTECTS YOUR ORGANIZATION
GEOFF COLLINS
MARTIN ANDERSON
1E
APRIL 2011
ABSTRACT: This whitepaper sets out the 1E view of software governance and compliance, highlighting that the
correct approach is not to overspend and overprovision, but nor is it to wait for your chosen software vendors to
audit your enterprise. The answer is to get the balance ‘just right’.
All rights reserved. No part of this document shall be reproduced, stored in a retrieval system, or transmitted by any means, electronic,
mechanical, photocopying, recording, or otherwise, without permission from 1E. No patent liability is assumed with respect to the use of the
information contained herein. Although every precaution has been taken in the preparation of this document, 1E and the author s assume no
responsibility for errors or omissions. Neither is liability assumed for damages resulting from the information contained herein. The 1E name is a
registered trademark of 1E in the UK, US and EC. The 1E logo is a registered trademark of 1E in the UK, EC and under the Madr id protocol.
NightWatchman is a registered trademark in the US and EU.

2. Contents
Too much or not enough? ......................................................................................................................................... 3
What’s the recipe? .................................................................................................................................................... 4
Liability and control ................................................................................................................................................... 7
Getting it just right .................................................................................................................................................... 9
References .............................................................................................................................................................. 10
© 1E 2011 2

3. Too much or not enough?
“63% of software vendors cited revenue generation as their number one reason for operating a compliance
program, while 50% also want to protect their intellectual property rights.”
Software compliance without tears, Ernst & Young, February 10, 20111
Like Goldilocks and her porridge, when it comes to software governance and compliance, every organization needs
to get things ‘just right’. Spend too much in a climate of restricted spending, overprovisioning on software licenses
that you think you might need, and you impact budgets and your ability to invest in strategic projects. By contrast,
spend too little and when software vendors approach you about your installed software base you run the risk of non-
compliance, fines and legal action.
But what constitutes a sensible level of control? Effectively minimizing the cost of licensing and managing software,
while not exposing your enterprise to the risk of an audit is the key, but it’s often not as straightforward as it might
appear. Some projects aimed at understanding and managing software compliance run on for many years and
struggle to demonstrate any return on investment. But equally, the solution cannot be so simple as to hope for the
best and shout ‘help’ when the auditors arrive.
Getting it ‘just right’ is not as easy as it looks.
© 1E 2011 3

4. What’s the recipe?
“Gartner continues to see increasing incidence of software vendor audits, making it critical
that customers negotiate with an understanding of how license compliance can be
accomplished consistently and cost-effectively.”
Key Issues for IT Asset Management and Procurement, Gartner, 25 February 20092
No organization wants to be unprepared and have their business interrupted by a software audit. They may be able
to struggle through one but there is no guarantee that these are single occurrences. Every enterprise can and should
be prepared for that inevitable visit before it happens. But to be prepared you need to answer three fundamental
questions: ‘What do I have installed?’ ‘What do I own?’ and, most importantly, ‘What do I actually need?’
What software do I have installed?
The first step to compliance is getting control of what has been installed in your enterprise. Many times even
answering this seemingly simple question can be a real struggle even if they have a top of the line systems
management solution in place. The unfortunate truth for many organizations is that it will boil down to an
approximation based on some raw data because of the uncontrolled manner in which software is installed and
inventoried.
The root of the problem lies in the vagaries of product information, with inconsistent and incomplete product names,
versions and editions often published without a common format. Some standards of how software should run on
Windows platforms do exist. However, the enforcement on ISVs to follow these standards is not strictly controlled. For
instance, even though many operating systems offer file attributes, not all software publishers take advantage of these
features. And in the event that software offerings do include relevant attributes, a lack of formal quality assurance can
significantly lessen consistency.
Software bundling is a common practice when releasing software that supports commoditized functionality, such as
web services. Again, publishers rarely change details in the registry entries or file attributes to indicate that the
software is bundled, so systems management tools typically cannot differentiate bundles from full products requiring
associated licenses. From the software vendor’s perspective, identification of suites or bundles is not their concern
which is why they do not build such identification into their products. As a result, the reported software inventory is
artificially inflated to contain items for which users can rarely prove entitlement.
These inconsistencies are then compounded by the presence of ‘try before you buy’ evaluations, unrecognized by
systems management tools and often downloaded by users direct to the desktop without the knowledge of the IT
department. Installations such as these are not localized to individual users either. Rather, it is more the case that
one person in a department begins to independently use a piece of software which they have installed and then via
word of mouth they push others in their group to do the same. This problem worsens when we consider that
applications can be downloaded through the Internet or via portals or installed using flash drives or disks.
Then there is the issue of data collection itself. The traditional approach employs systems management tools to
examine the software for registry entries, file attributes and product identification data embedded in the code to
produce an inventory. An inventory of your desktops, notebooks and servers should give you visibility of all the
software you have installed. But when used for this purpose, systems management tools frequently produce a lot of
© 1E 2011 4

5. ‘noise’. From a software developer’s perspective the information that accompanies the file wasn’t intended to assist
the IT Administrator’s inventory and identification process in so much as it was intended to help the software
development and debugging process.
To begin with the inventory will be full of software that you don’t need to know about, including hot fixes, drivers,
toolbars, plugins and Java Runtime licenses. It will also contain duplicates caused by those inconsistent product
names, versions and editions, usually leading to double counting and inaccurate results. All of this data needs to be
cleaned, often as part of a laborious manual process. Once you’ve been through all that, you then need to filter your
results just to identify the software that is commercially licensable.
It is perhaps not surprising then, in a recent survey conducted by Opinion Matters on behalf of 1E, that two in every
three respondents in organizations with more than 500 employees said they found preparing for software vendor
3
audits challenging.
So let’s assume you’ve been able to identify what you have installed. How do you understand how much of it is
actually yours?
What do I own?
The ability to track purchase information for licenses is much more difficult than many organizations realize or care
to admit. This is typically because the information is not held in one central source, but by a number of individuals or
departments and in a myriad of different formats.
License details will be found in your accounting and purchasing departments, recorded on spreadsheets or detailed
in finance applications. They will be stored on paper, filed away in cabinets somewhere by your IT team. They could
even appear in marketing or sales, purchased from a high street store on expenses having been authorized by a line
manager. They may not have even been recorded at all! Some organizations will freely admit that because some
SAM tools are so large and complex they would rather wait for a vendor to come to them with an audit rather than
try to manage the process themselves.
1E’s own research would suggest that nearly 50% of enterprises still use spreadsheets to record software licenses,
with almost 9% still using a paper-based filing system and a staggering 14% using nothing whatsoever.3
Larger enterprises also operate on an international basis, from multiple sites and in many different countries, each of
which might have their own purchasing, finance or IT teams and their own local procedures governing software
purchases. Indeed, that same research would suggest that 43% of organizations manage their software regionally,
39% by department and 20% on a project-by-project basis.3 Ian Blatchford, a partner with Ernst & Young, agrees,
saying “Customers feel that their own decentralized structures often make it harder to keep track of usage around
4
the organization - as does their increasingly complicated suite of IT packages."
Additionally there are many organizations that have scattered licenses and overlaps in software functions due to
mergers and acquisitions. This often gets overlooked and causes both over payment in software due to duplication in
job functions but also liability from lost tracking of licenses.
Inevitably, many organizations will be forced by the sheer complexity of uncovering and recording all this data to
assign a project team to the job of gathering license information across the business. Some will even need to contact
vendors and other sources, increasing still further the risk of an audit.
© 1E 2011 5

6. Now let’s assume you have been able to accurately identify what software you have installed and how much of it you
own. The last part of the story is to understand how much of what you have is actually needed.
What do I actually need?
This question could be rephrased as, “What am I actually using?”
A review of your software estate may well determine how many copies of applications are installed on your systems
and whether or not you have paid for those licenses, but you also need to determine which of these software
applications are actually being used, by whom and how often.
Without usage data, you may be purchasing software based on perceived requirements or user requests, not actual
need. Usage data plays an important role in determining which applications should be included in a standard image
and how many standard images may be needed to meet the different requirements of users. It also plays a part in
monitoring and controlling the use of unauthorized applications and in preventing the downloading of insecure, non-
approved software. Having control of software licenses in your environment also reduces the risk of expensive
penalties and legal exposure.
The true realization comes when you see that software usage and license liability are tightly coupled topics that can
be addressed in order to keep your software installation and purchasing decisions optimal. Software which is
installed and used would fall into the category of “I need this software” however software which is installed yet not
licensed wouldn’t. We would refer to this as waste. But what if, in addition to waste you had software which was a
liability with respect to licensing? – I.e. installed copies of software for which your organization hadn’t purchased
licenses for yet. It’s in your best interest to know the usage information for this group of systems as well in order to
make prudent purchasing decisions.
Once you know what software you have, how often you’re are using it, and how much your organization has
purchased, you have the information you need to make informed business decisions. Once you can make informed
business decisions, you can put software in place to automate these and keep your environment in an optimal state.
© 1E 2011 6

7. Liability and control
“In a survey of attendees at our IT Asset Management, Procurement and IT Financial
Management Conference conducted in November 2010, 61% of the 144 respondents
said they had been audited by at least one software vendor in the past 12 months.”
IT Asset Managers Should Prepare Now, Gartner, 2 March 20115
But even if you can find out what you have, how often you’re using it and how much you’re paying for it, how do you
manage your liability and control your risk?
In the vast majority of cases organizations fall out of compliance by accident rather than by design. It may take you
many months (or in some cases years) to audit your software licenses, ownership and usage in preparation for that
audit. But how are you going to keep that information up-to-date ready for next year or the year after that. You don’t
know when a software vendor will request an audit, just that they surely will.
While perhaps there has been a tendency over the years to shy away from discussing software compliance, it
remains the primary goal for many organizations in reviewing their software licenses. 40% of the enterprises Opinion
3
Matters questioned said this was their main concern, with a further 22% highlighting reduced business risk.
It’s not just a question of identification; it’s also a question of control and the ability to take action in order to
remediate a problem. With this in mind, software license management tools provide the next and arguably most
important step in the process.
Audit data, as we have seen, can only contribute towards compliancy if it is combined with entitlement data,
obtained from recording purchases and reports from vendors. For many enterprises, this ‘true up’ could be an almost
entirely manual process requiring analysis of general ledger postings and tracking back to accounts payable to find
the invoices. Furthermore, it could be out of date in a matter of days. The key point here is that license management
tools need to be “plugged-in” to the active software estate to consistently present compliance status to the IT
department.
Advanced license management tools automate the correlation of installation, ownership and critically need,
providing a central resource for ongoing compliancy while responding to and reducing liability in the short, medium
and long term. The ability for a license management tool to control compliance is considered a base from which a
complete compliance program can be built. The control of this data must be automatic, ‘active’ and ongoing. It must
be continually tracked and monitored, alerting appropriate managers when the business falls out of compliance or is
overbuying licenses and thereby wasting money.
Rather than simply identifying what has, or has not, been purchased, sophisticated tools can manage centralized
deployment and removal of applications, auto-reclaim unused software on one client machine and deploy to another
and even ‘rent’ applications to users on a temporary basis for only as long as they need them. They can also reduce
or even remove purchased but unused applications, known as ‘shelfware’, from the business. It is these elements of
advanced control that set some software license tools apart.
© 1E 2011 7

8. More importantly, your enterprise will enjoy immediate cost savings from improved software allocation, volume
license discounts, better price points, accurate asset depreciation and more - all while eliminating the risks
associated with software non-compliance, lack of policy enforcement and inappropriate or unnecessary usage.
© 1E 2011 8

9. Getting it just right
“Software audits are increasing. Organizations must fund IT asset management disciplines or will risk high,
unexpected financial liability due to software compliance problems. Having good asset management can
reduce the time and pain of a software vendor audit.”
IT Asset Managers Should Prepare Now, Gartner, 2 March 20115
Uniquely focused on software waste, AppClarity™ from 1E delivers compliance without complexity by filtering out
irrelevant license data to show just licensable software, organizing it by financial impact or vendor so you can quickly
focus your compliance efforts.
AppClarity enables your organization to make immediate reductions in software costs by analyzing all your
applications instantly and providing you with actionable results, reducing your spend within one month. By
identifying the software you actually use, then automatically removing what you don’t need and reallocating to
reduce license liability, AppClarity enables you to financially quantify all software waste by identifying and controlling
unused software across your whole enterprise.
AppClarity also reduces business risk by controlling unapproved and prohibited software installs (such as torrent-like
applications), automating software removal to protect your organization. From a security perspective this has the
added benefit of reducing your entire company’s attack surface.
Using a simple traffic light status to show compliance, together with additional guidance on how that compliance was
calculated, AppClarity provides comprehensive reporting for vendor audits with just a few mouse clicks, reducing the
cost and time it takes for your enterprise to prepare for any software vendor audit. Never again will you need to
conduct manual ‘true ups’ and labor intensive audits.
Through feature identification techniques, AppClarity also has the ability to provide reports and actions where
“functional overlap” is taking place in your organization. This means that AppClarity can help reduce overspending
due to two applications being purchased and installed which provide the same features and functions to the user
community.
By making sense of what software you have, why you have it, and where and how it is being used, AppClarity allows
you to make informed strategic and operational decisions, putting you in a much stronger negotiating position when
renewing maintenance or purchasing additional licenses. And it does this on a continual basis, month-on-month,
year-on-year.
Deploying AppClarity alongside other 1E products like Shopping™ delivers a solution that further enhances license
control by offering the opportunity to rent applications on a short term basis to users, so that short term needs do
not become long term liabilities.
Getting it ‘just right’ is possible; you just have to know where to look.
© 1E 2011 9

10. References
1
Software compliance without tears Monitoring customers’ software usage in a complex world, February 10, 2011.
Available from: http://www.ey.com/Publication/vwLUAssets/Software_compliance_without_tears_-
_Monitoring_customers_software_usage_in_a_complex_world/$FILE/EY_-
_Software_compliance_without_tears_Monitoring_customers_software_usage_in_a_complex_world.pdf
2
Key Issues for IT Asset Management and Procurement, February 25, 2009. Available from:
http://www.gartner.com/DisplayDocument?doc_cd=165771&ref=g_rss
3
Software Efficiency Report 2011. Opinion Matters survey on behalf of 1E, 2011
4
Software compliance without tears. Software asset management survey, Ernst & Young March 2011
5
Survey Analysis: Survey Shows Another Increase in Software Vendor Audits; IT Asset Managers Should Prepare
Now, March 2, 2011. Available from: http://www.gartner.com/DisplayDocument?id=1569814&ref=g_fromdoc
© 1E 2011 10