Software asset management (SAM) is a business practice that involves managing and optimizing the purchase, deployment, maintenance, utilization, and disposal of software applications within an organization. According to the Information Technology Infrastructure Library (ITIL), SAM is defined as “…all of the infrastructure and processes necessary for the effective management, control and protection of the software assets…throughout all stages of their lifecycle.†Fundamentally intended to be part of an organization’s information technology business strategy, the goals of SAM are to reduce information technology (IT) costs and limit business and legal risk related to the ownership and use of software, while maximizing IT responsiveness and end-user productivity. SAM is particularly important for large corporations in regard to redistribution of licenses and managing legal risks associated with software ownership and expiration. SAM technologies track license expiration, thus allowing the company to function ethically and within software compliance regulations. This can be important for both eliminating legal costs associated with license agreement violations and as part of a company's reputation management strategy. Both are important forms of risk management and are critical for large corporations' long-term business strategies.
SAM is one facet of a broader business discipline known as IT asset management, which includes overseeing both software and hardware that comprise an organization’s computers and network.
Role within organizations
An Introduction to Asset Manager software - This screencast provides a brief overview of Asset Manager software. Use this software to manage company assets and check them in or out to your employees. Locate assets quickly using a barcode...
SAM can serve many different functions within organizations, depending on their software portfolios, IT infrastructures, resource availability, and business goals.
For many organizations, the goal of implementing a SAM program is very tactical in nature, focused specifically on balancing the number of software licenses purchased with the number of actual licenses consumed or used. In addition to balancing the number of licenses purchased with the amount of consumption, an effective SAM program must also ensure that the usage of all installed software is in keeping with the terms and conditions of the specific vendor license agreement. In doing so, organizations can minimize liabilities associated with software piracy in the event of an audit by a software vendor or a third party such as the Business Software Alliance (BSA). SAM, according to this interpretation, involves conducting detailed software inventories on a periodic basis to determine the exact number of software consumption, comparing this information with the number of licenses purchased, reviewing how the software is being used in respect to the terms and conditions and establishing controls to ensure that proper licensing practices are maintained on an ongoing basis. This can be accomplished through a combination of IT processes, purchasing policies and procedures, and technology solutions such as software inventory tools.
Counting installations is the most common means of measuring license consumption but some software is licensed by number of users, capital, processors or CPU Cores.
More broadly defined, the strategic goals of SAM often include (but are not limited to) the following:
- Reduce software and support costs by negotiating volume contract agreements and eliminating or reallocating underutilized software licenses
- Enforce compliance with corporate security policies and desktop/server/mobile standards
- Improve worker productivity by deploying the right kinds of technology more quickly and reliably
- Limit overhead associated with managing and supporting software by streamlining and/or automating IT processes (such as inventory tracking, software deployment, issue tracking, and patch management)
- Establish ongoing policies and procedures surrounding the acquisition, documentation, deployment, usage and retirement of software in an effort to recognize long-term benefits of SAM
SAM Technology
A number of technologies are available to support key SAM processes:
- Software inventory tools intelligently “discover†software installed across the computer network, and collect software file information such as title, product ID, size, date, path, and version.
- License manager solutions provide an intelligent repository for license entitlements which can then be reconciled against data provided by Software inventory tools to provide the organization with an 'Effective License Position' or view of where the organization is under-licensed (at risk of a compliance audit) or over-licensed (wasting money on unnecessary software purchases).
- Software metering tools monitor the utilization of software applications across a network. They can also provide real-time enforcement of compliance for applications licensed based on usage.
- Application control tools restrict what and by whom particular software can be run on a computer as a means of avoiding security and other risks.
- Software deployment tools automate and regulate the deployment of new software.
- Patch management tools automate the deployment of software patches to ensure that computers are up-to-date and meet applicable security and efficiency standards.
- Request management tools allow employees to place requests for software products using a centralized form and process specifically designed to capture and assess specific license requirements as well as to manage and track the procurement and deployment process.
- Product catalog tools capture product specific information such as name, edition, version and license agreement types as well as other key top level information for products used within the business. This information normalizes product naming conventions with the organization and allows mapping between other technologies tools used in the composite SAM solution.
International Organization for Standardization (ISO)
The latest version of the SAM standard from ISO is 19770-1:2012. This revised standard is designed to allow the implementation of SAM processes to be "accomplished in multiple staged increments or tiers." Part 1 of the standard details SAM processes including control environment, planning and implementation, inventory, verification and compliance, operations management and life cycle. In 2003, the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) began working with the SAM industry to develop a standard of best practices for software asset management programs. Standard ISO/IEC 19770-1:2006, Information technology â€" software asset management â€" Part 1, was published by the ISO and IEC in May 2006.
ISO/IEC 19770-2:2015: Software identification tag; establishes specifications for tagging software to optimize its identification and management. The current version was published in 2015 and is a revision to the 2009 original Software ID Tag standard. Using software identification tags or SWID tags makes discovery a simpler and more accurate process that can be verified by software vendors if they audit an organisations entire estate. SWID tags are implemented and supported by many vendors including IBM, Microsoft and Adobe.
ISO/IEC 19770-3: Entitlement Management Schema outlines a technical schema which can be used to encapsulate license details including contract information, entitlements, rights, limitations and details about invoice, PO numbers, etc. This is currently at FDIS (Final Draft International Standard) stage and is due to be published in 2016.
ISO 55000:2014 is the new international standard for asset management and was ratified in January 2014. It provides an overview of asset management, its principles and terminology, and the expected benefits from adopting a comprehensive asset management strategy. This standardisation is driving increased interest in the whole asset management market, including asset management software, and is particularly interesting to asset-intensive organisations including Utilities, Chemical and Transport companies. 19770-1 is aligned with this standard.
ISO 55000:2014 can be applied to all types of assets and by all types and sizes of organization. It is intended to be used for managing physical assets in particular, but it can also be applied to other asset types. By itself it does not cover many of the requirements for IT and Software Asset Management, such as licensing, and the additional controls which are needed in general for software (e.g. for access and integrity), and for complex control situations such as SaaS and BYOD. These additional requirements are being incorporated in edition 3 of ISO/IEC 19770-1 which is based on ISO 55000:2014. Publication is not likely until 2017.
Issues with scalability
An example of issues faced when scaling up discovery tools is with Microsoft's System Centre Configuration Manager (SCCM). Using SCCM Metering Rules to monitor software usage across a small estate or a small number of applications is relatively easy and reliable given the total number of unique executables (.exe files) and the number of instances of each executable. Turning on Metering Rules for every packaged application and every executable in a large estate quickly makes the volume of data generated unmanageable and expensive to maintain. Most SAM tools which consume SCCM data rely on these Metering Rules to understand usage.
See also
- IT asset management
- License manager
- Software licensing audit
- Financial Software
References
External links
- Business Software Alliance (BSA)
- Federation Against Software Theft (FAST)
- 19770-1:2006
- ISO/IEC Information Centre
- International Business Software Managers Association (IBSMA)
- International Association of Information Technology Asset Managers (IAITAM)
- Software & Information Industry Association (SIIA)
- Top 200 SAM Terms â€" A Glossary
- Australian Software Asset Management Association (ASAMA)
- Principles of Software Asset Management
