Tech Views

Demystifying Software Asset Management

Harish Agarwal focuses on the best practices to manage processes for software procurement, deployment, maintenance and retirement

Software Asset Management (SAM) is all of the infrastructure and processes necessary for the effective management, controls and protection of the software assets within an organization, throughout all stages of their lifecycle.

—ITIL Best Practices Guide: Software Asset Management

Harish Agarwal

At a time when world economies are slowing down and organizations are looking for ways to trim spending while still maintaining regulatory compliance, managements are seeking practical ideas on ‘how’ to optimize cash from their CIOs. SAM provides answers to the operative question ‘How’. But, ‘What exactly does SAM stand for?’ Simply put, SAM is a set of processes that helps efficient management of software assets within an organization.

What is the need for SAM?

• Generate business value from IT
• Better risk management
• Cost savings

It lays out a set of best practices which help organizations better manage software procurement, deployment, maintenance and retirement processes. Organizations often encounter challenges around centralized procurement and decentralized deployment which can be effectively dealt with SAM. With software being an intangible asset several organizations are virtually unaware of their software assets.

Many a time managing and tracking software licenses becomes an arduous task with glaring irregularities that leads to unnecessary costs. Compounding this scenario is the absence of tools to determine software deployment across the organization. To cite an example common for most organizations, as a part of the employee leaving process, the hardware inventory gets updated while the software is ignored. In such scenarios IT administrators are led to believe that the software is being utilized which is contrary to reality. This ignorance results in a gap between what is perceived and the actual usage of software. SAM helps address this gap.

Today SAM is an international standard defined in the ISO/IEC19770 standard that closely supports IT Service Management as defined in ISO/IEC 20000.

The main objective for a SAM process is to establish good corporate governance over an enterprise’s software assets. It helps manage, control and protect an organization’s software assets, including risks arising from the use of those software assets. Many organizations are unaware of their IT assets, where they are located or who owns them. They grapple with licensing implications of software and may not be confident of a positive outcome if subjected to an audit. It is a challenge for such organizations to know how much the IT infrastructure is costing the business and how to effectively manage the total cost of ownership. Therefore, SAM not only keeps the business out of trouble, but strengthens its IT management processes.

The SAM Action Plan involves people, processes and technology

People: One of the foremost steps that organizations need to undertake is to identify individuals within each business unit to be responsible for maintaining licensing information, such as usage measurements, that relates to specific software vendors and products. Further, there are a set of processes that an organization needs to implement across the lifecycle of the software. These include;

Processes:

• Implement a process to prevent or detect when software purchases are made outside of the central procurement process
• Implement a process to identify and remove software that has been installed outside the authorized deployment process
• Undertake a project to identify and remove hardware that is still held by the business but no longer in use
• Review the disposals process for adequacy. Educate the business and IT so that the process works in practice
• Implement a process to identify and investigate machines that do not appear on the network after a defined period of time and to identify software for which historic licence entitlement records do not exist and resolve this through a combination of obtaining confirmations of entitlement from vendors and rectifying imbalances

Technology: Finally, technology plays a defining role in increasing efficiency and reducing the risk of data duplication. For this, the organizations are required to undertake a project to identify and consolidate disparate data sources relating to asset management. Agree and document which teams are responsible for the management and oversight of these data sources. One must also consider the level of administration rights assigned to end-users with a view to reducing rights to a level suitable for their role. Then, continue with the project to implement SMS (Software Management System). As part of this, the organization needs to determine how best to leverage SMS technology within the current environment, including integration with existing tools and consider future deployment over the server estate to increase the breadth of information available to management.

A SAM review helps organizations assess the maturity of the ‘As Is’ SAM process and to determine the current state of software assets used by them. This essentially is a two pronged approach. Firstly, Software Asset Management Maturity Assessment helps gather information necessary to measure the maturity of the organization’s SAM process against leading standards and frameworks such as ISO and ITIL in order to identify potential risks and opportunities. Secondly, Current State Assessment of Software Assets help determine the organization’s current state of software assets and the effectiveness of the current SAM processes and controls.

Benefits of SAM

Organizations reap both long terms and short terms benefits from SAM. In the short-term, the adoption of SAM processes can help an organization bridge the gap between over and under licensing. It also provides the management with a competitive edge on negotiations with software vendors and re-sellers. It helps in reduction in helpdesk support cost and systematic phase out of software which is not supported. The rapid growth experienced by organizations over the past decade has lead to heterogeneous IT environment increasing the support cost. The standardization of applications while reducing the helpdesk support cost also increases resilience of the environment toward security threats. And finally strengthens the organization’s ability to provide accurate data on software deployment, at any point of time, reducing vendor audits.

In the long-term, SAM can facilitate the management of business risks, including the risk of interruption to IT services, deterioration in the quality of IT services and damage to public image arising from any of the above. SAM also plays a crucial role, which gains more prominence in these turbulent times, of effective cost control. It covers multiple aspects like reducing the direct costs of software and related assets, through the use of volume licensing arrangements and redeployment of old licenses. In addition, it reduces time and cost for negotiating with suppliers because of better information availability. Infrastructure costs for managing software and related assets can also be reduced, by ensuring that required processes are efficient and effective. Further, IT support costs can also be reduced through improved SAM processes. Better forecasting and budgeting of license requirements through SAM ensures optimal cost savings for the organization. And finally, the organization is able to enjoy reduced costs on account of better productivity of users having lesser IT related issues.

SAM provides a distinct competitive advantage to organizations as it helps them in improved decision-making because of more complete and accurate information that is readily available with them. Entities can develop the ability to deploy new software quickly in response to market conditions and align IT more closely with business needs, thus ensuring that all users have access to appropriate software and applications. SAM also enhances the organization’s ability to handle the IT aspects of business acquisitions, mergers or demergers more quickly.

Sources:

• ISO/IEC 19770: Standard on Information Technology – Software Asset Management
• ISO/IEC 20000: Deals with delivery of IT services and IT Service Management

Harish Agarwal is Associate Director, Technology Risk Services Practice, Ernst & Young. The views expressed herein are the personal views of the author and do not necessarily represent the views of Ernst & Young Global or any of its member firms.