Software Asset Management
Encyclopedia
Software asset management (SAM) is a business practice that involves managing and optimizing the purchase, deployment, maintenance, utilization, and disposal of software applications within an organization. According to the Information Technology Infrastructure Library
(ITIL), SAM is defined as “…all of the infrastructure and processes necessary for the effective management, control and protection of the software assets…throughout all stages of their lifecycle.”
Fundamentally intended to be part of an organization’s information technology business strategy, the goals of SAM are to reduce information technology
(IT) costs and limit business and legal risk related to the ownership and use of software, while maximizing IT responsiveness and end-user productivity
. SAM is one facet of a broader business discipline
known as IT asset management
, which includes overseeing both software and hardware
that comprise an organization’s computers and network
.
For many organizations, the goal of implementing a SAM program is very tactical in nature, focused specifically on balancing the number of software licenses purchased with the number of actual copies installed. In doing so, organizations can minimize liabilities associated with software piracy in the event of an audit by a software vendor or a third party such as the Business Software Alliance
(BSA). SAM, according to this interpretation, involves conducting detailed software inventories on a periodic basis to determine the exact number of software installations, comparing this information with the number of licenses purchased, and establishing controls to ensure that proper licensing practices are maintained on an ongoing basis. This can be accomplished through a combination of IT processes, purchasing policies and procedures, and technology solutions such as software inventory tools.
More broadly defined, the strategic goals of SAM often include (but are not limited to) the following:
(ISO) and the International Electrotechnical Commission
(IEC) began working with the SAM industry to develop a standard of best practices for software asset management programs. Standard ISO/IEC 19770-1:2006, Information technology – software asset management – Part 1, was published by the ISO and IEC in May 2006. Part 1 of the standard details SAM processes including control environment, planning and implementation, inventory, verification and compliance, operations management and life cycle.
ISO/IEC 19770-2:2009 – Part 2: Software identification tag; establishes specifications for tagging software to optimize its identification and management.
Using software identification tags or SWID tags makes discovery a simpler and more accurate process that can be verified by software vendors if they audit an organisations entire estate.
Using metering rules to monitor software deployment and usage across a small estate is relatively easy and reliable given the total number of unique executables (.exe files) and the number of instances of each executable. If you try turning on metering rules for every packaged application and every executable in a large estate the volume of data generated quickly becomes unmanageable and expensive to maintain.
Information Technology Infrastructure Library
The Information Technology Infrastructure Library , is a set of good practices for IT service management that focuses on aligning IT services with the needs of business. In its current form , ITIL is published in a series of five core publications, each of which covers an ITSM lifecycle stage...
(ITIL), SAM is defined as “…all of the infrastructure and processes necessary for the effective management, control and protection of the software assets…throughout all stages of their lifecycle.”
Fundamentally intended to be part of an organization’s information technology business strategy, the goals of SAM are to reduce information technology
Information technology
Information technology is the acquisition, processing, storage and dissemination of vocal, pictorial, textual and numerical information by a microelectronics-based combination of computing and telecommunications...
(IT) costs and limit business and legal risk related to the ownership and use of software, while maximizing IT responsiveness and end-user productivity
Productivity
Productivity is a measure of the efficiency of production. Productivity is a ratio of what is produced to what is required to produce it. Usually this ratio is in the form of an average, expressing the total output divided by the total input...
. SAM is one facet of a broader business discipline
Discipline
In its original sense, discipline is referred to systematic instruction given to disciples to train them as students in a craft or trade, or to follow a particular code of conduct or "order". Often, the phrase "to discipline" carries a negative connotation. This is because enforcement of order –...
known as IT asset management
IT asset management
IT asset management is the set of business practices that join financial, contractual and inventory functions to support life cycle management and strategic decision making for the IT environment...
, which includes overseeing both software and hardware
Hardware
Hardware is a general term for equipment such as keys, locks, hinges, latches, handles, wire, chains, plumbing supplies, tools, utensils, cutlery and machine parts. Household hardware is typically sold in hardware stores....
that comprise an organization’s computers and network
Computer network
A computer network, often simply referred to as a network, is a collection of hardware components and computers interconnected by communication channels that allow sharing of resources and information....
.
Role within organizations
SAM can serve many different functions within organizations, depending on their software portfolios, IT infrastructures, resource availability, and business goals.For many organizations, the goal of implementing a SAM program is very tactical in nature, focused specifically on balancing the number of software licenses purchased with the number of actual copies installed. In doing so, organizations can minimize liabilities associated with software piracy in the event of an audit by a software vendor or a third party such as the Business Software Alliance
Business Software Alliance
The Business Software Alliance is a trade group established in 1988 and representing a number of the world's largest software makers and is a member of the International Intellectual Property Alliance...
(BSA). SAM, according to this interpretation, involves conducting detailed software inventories on a periodic basis to determine the exact number of software installations, comparing this information with the number of licenses purchased, and establishing controls to ensure that proper licensing practices are maintained on an ongoing basis. This can be accomplished through a combination of IT processes, purchasing policies and procedures, and technology solutions such as software inventory tools.
More broadly defined, the strategic goals of SAM often include (but are not limited to) the following:
- Reduce software and support costs by negotiating volume contract agreements and eliminating or reallocating underutilized software licenses
- Enforce compliance with corporate security policies and desktop standards
- Improve worker productivity by deploying the right kinds of technology more quickly and reliably
- Limit overhead associated with managing and supporting software by streamlining and/or automating IT processes (such as inventory tracking, software deployment, issue tracking, and patchPatch (computing)A patch is a piece of software designed to fix problems with, or update a computer program or its supporting data. This includes fixing security vulnerabilities and other bugs, and improving the usability or performance...
management) - Establish ongoing policies and procedures surrounding the acquisition, documentation, deployment, usage and retirement of software in an effort to recognize long-term benefits of SAM
SAM Technology
A number of technologies are available to support key SAM processes:- Software inventory tools intelligently “discover” software installed across the computer networkComputer networkA computer network, often simply referred to as a network, is a collection of hardware components and computers interconnected by communication channels that allow sharing of resources and information....
, and collect software file information such as title, product ID, size, date, path, and version. Some inventory tools compare software inventory data with purchasing information to reveal license deficits and ensure that organizations remain compliant with their licensing agreements. - Software meteringSoftware meteringSoftware metering refers to several areas:*Tracking and maintaining software licenses. One needs to make sure that only the allowed number of licenses are in use, and at the same time, that there are enough licenses for everyone using it. This can include monitoring of concurrent usage of software...
tools monitor the utilization of software applications across a network. They can also provide real-time enforcement of compliance for applications licensed based on usage. - Application control tools restrict what and by whom particular software can be run on a computer as a means of avoiding security and other risks.
- Software deploymentSoftware deploymentSoftware deployment is all of the activities that make a software system available for use.The general deployment process consists of several interrelated activities with possible transitions between them. These activities can occur at the producer site or at the consumer site or both...
tools automate and regulate the deployment of new software. - PatchPatch (computing)A patch is a piece of software designed to fix problems with, or update a computer program or its supporting data. This includes fixing security vulnerabilities and other bugs, and improving the usability or performance...
management tools automate the deployment of software patches to ensure that computers are up-to-date and meet applicable security and efficiency standards.
International Organization for Standardization (ISO)
In 2006, the International Organization for StandardizationInternational Organization for Standardization
The International Organization for Standardization , widely known as ISO, is an international standard-setting body composed of representatives from various national standards organizations. Founded on February 23, 1947, the organization promulgates worldwide proprietary, industrial and commercial...
(ISO) and the International Electrotechnical Commission
International Electrotechnical Commission
The International Electrotechnical Commission is a non-profit, non-governmental international standards organization that prepares and publishes International Standards for all electrical, electronic and related technologies – collectively known as "electrotechnology"...
(IEC) began working with the SAM industry to develop a standard of best practices for software asset management programs. Standard ISO/IEC 19770-1:2006, Information technology – software asset management – Part 1, was published by the ISO and IEC in May 2006. Part 1 of the standard details SAM processes including control environment, planning and implementation, inventory, verification and compliance, operations management and life cycle.
ISO/IEC 19770-2:2009 – Part 2: Software identification tag; establishes specifications for tagging software to optimize its identification and management.
Using software identification tags or SWID tags makes discovery a simpler and more accurate process that can be verified by software vendors if they audit an organisations entire estate.
Issues with scalability
An example of issues faced when scaling up discovery tools is with Microsoft's System Centre Configuration Manager (SCCM).Using metering rules to monitor software deployment and usage across a small estate is relatively easy and reliable given the total number of unique executables (.exe files) and the number of instances of each executable. If you try turning on metering rules for every packaged application and every executable in a large estate the volume of data generated quickly becomes unmanageable and expensive to maintain.