Audit Defense Your Playbook For License Compliance Audits

Transcript

Audit Defense Your playbook for license compliance audits Introduction President of Aspera Technologies Inc. Christof Beaupoil Co-founded Aspera in 2000 13 year’s experience in software asset and license management Masters in Mechanical Engineering and Information Technology Certified ITIL Foundation and Licensing Specialist Led numerous license management projects for international corporations Agenda 10 Steps 1. Announcement / Audit Announcement Letter (AAL) 2. Access / Confidentiality / NDA 3. Procedures / Data Formats / Tools 4. Timeline 5. Data collection 6. Data verification 7. Licensing Compliance Table (LCT) 8. Settlement 9. Transfers 10. Back to production 1 Announcement Audit Announcement Letter (AAL) IBM: Sends Audit Announcement Letter (AAL) Requests starting date of the review Names contracted auditor Sets vague scope Customer: To IBM      Communicates SPOC Negotiates starting date Questions scope Questions right to audit Questions auditor (already in accountant role?) Internal     DO NOT buy any licenses until settlement DO NOT try to remove software DO NOT disclose any information until confidentiality agreement is signed NOBODY other than SPOC communicates with IBM 2 Access / Confidentiality / NDA / Scope Auditor: Requests uncontrolled deep access into your organization Tries to establish timeline Customer: To Auditor      Grants NO unrestricted access (“darkroom”) Grants NO access to non IBM data (e.g. 3rd party vendors, customer data) Auditor may not keep data after audit NO sweetener clause (Auditor may not profit from audit result) DOES NOT agree on timeline to Step 4 Internal   Teams up:  Upper Management  Legal  IT  Procurement  License experts  Local license managers Welcome to the TLA/FLA World of IBM Welcome to the TLA/FLA World of IBM (1/3) Agreements: IPLA International Program License Agreement (see §11) ILAN International License Agreement for Non-Warranted Programs ILAE International License Agreement for Evaluation of Programs ILAR International License Agreement for Early Release of Programs IPAA International Passport Advantage Agreement (incl. SubCapacity Attachment) ELA Enterprise Licensing Agreement CEO Complete Enterprise Option ESSO (International) Enterprise Software & Service Option Welcome to the TLA/FLA World of IBM (2/3) Licenses: S&S Support & Subscription SLA Software License Agreement  LI License Information (edition and version specific)  PLET/GA Program Announcement Letter / General Availability FTL Fixed Term Licenses PoE Proof of Entitlement FCT Flexible Contract Terms Welcome to the TLA/FLA World of IBM (3/3) Metrics: PVU Processor Value Unit VC Virtual- (a.k.a. Sub-) Capacity RVU Resource Value Unit AUTH Authorized User FL Floating User … … … FUSSI Floating User Single Session Single Install AUSI Authorized User Single Install 3 Procedures Data Formats and Tools Auditor: Provides ASA Workbooks Provides scripts/instructions Requests on-sites Customer: To Auditor      Reviews and extends ASA Workbook Requests full details on FastPass reports (auditor may not withhold information/details) Questions Missing Base License (MBL) rules Agrees on rules for transitioned vendors and PoE (hard-copy vs. invoices, POs) Imposes own procedures and (scan) tools Internal    Starts contract review and entitlement collection Evaluates available internal tools and resources Agrees to internal timeline for data collection 4 Timeline Auditor: Will propose unfeasible timeline (time-pressure works only in favor of IBM) Customer: To Auditor     Extends times for data collection Adds steps for review of any output Auditor produces Introduces Quality Gates that need to be passed before next phase starts Agrees on time frames, not dates Internal  Plans for a long timeline (12 – 18 months) 5 Data Collection Auditor: Provides FastPass / PPAO extract Reviews collected data / requests additional information  Screenshots  Script output Customer: To Auditor   Many IBM metrics require additional data collection via script / admin log on Does not provide script output without review:    Count inactive/legacy users High watermarks Concurrent limited to timeframes Internal  Focuses on ENTITLEMENT collection     PoEs Missing base licenses Loads license data and assembles effective license position May restrict auditor’s access to selected information – but may not withhold access to licensing relevant data 5.1 Passport Advantage Online (PPAO) Key Focus Missing licenses: Transited Vendors (FileNet, Cognos, SPSS,…) Missing trade-ups Missing Site Numbers Transferred entitlements (negative numbers) Delayed/faulty transmission from reseller Purchased outside of PPA:      Embedded Passport Advantage Express Enterprise Licensing Agreement (ELA) Complete Enterprise Option (CEO) (International) Enterprise Software & Service Option (ESSO/iESSO) Export option is available only per site – Auditor has Access via FastPass and can provide full export 5.2 ILMT Over counting: Missing Bundle Rules (Check LI) Hyper Threading Counting of Deactivated Cores (Check LI) Wrong product/edition Incomplete product names (e.g. missing edition) Ghost installs/false positives Keeps high water marks Virtual vs. full capacity Does not apply failover/standby/testing/clustering rules (Check LI) 6 Data Verification Auditor: May ask to verify data in on-site visits  Positive testing: Picks server from workbook and confirms data  Negative testing: Picks device that is NOT in workbook and confirms no IBM software on it  May try/ask to run additional scripts Customer: To Auditor  Restricts auditor’s physical access – but answers license relevant questions and provides data for verification Internal    Checks all workbooks for problems described in 5.x Loads workbooks – this will show additional gaps and inconsistencies Use License data/compliance view in audit environment to close inconsistencies in workbooks (choose edition, choose metric) 7 Licensing Compliance Table (LCT) Auditor: Manually assembles LCT – always has errors/interpretations Will not include S&S without base licenses Uses Version less for products under maintenance Draft status -> will push for EXIT Meeting Customer: To Auditor   Does NOT agree to present LCT to IBM (Exit Meeting) until numbers are corrected, confirmed, and agreed In EXIT Meeting: Explicitly mentions any disagreements with the auditor, makes sure included in meeting minutes Internal   Compares to internal compliance view Checks for:        Multi metric products Not considered licenses Wrong editions Not applied bundling rules Sub-capacity vs. full capacity Release dates for out of S&S positions Over-licensing (Change in metric? Change in product name?) 8 Settlement & Audit Relief IBM: Will make a settlement proposal based on §11.2 “Resolution” of IPLA:  Missing base license: Purchase license with two years of RETRO S&S  Missing S&S: Purchase reinstatement with two years of RETRO S&S  Typically applies valid discount level Will propose audit relief (no legal action) only for disclosed incompliance / resists base-lining Customer: To IBM      Uses installation dates for less retro S&S Uses documented disagreements on LCT as leverage Pushes for base-lining No partial settlements Includes ALL negotiated terms into settlement agreement Internal  Makes sure that executive management understands the audit results 9 Transfers IBM: Settlement was for Group Balance Will request to create internal compliance per site Might audit single sites in the future Customer: To IBM   Receiving site triggers transfers on PPAO through transfer form (IBM) Giving site gives approval Internal   Joins base licenses and S&S in same site Negotiates internal cost allocation 10 Back to Production IBM: n/a Customer: To IBM  Makes sure that agreed license position is properly reflected in PPAO Internal    Adds “baseline” / new licenses to the production system Applies audit/settlement rules and exceptions to the system (e.g. bundling rules, DG rights, metric selections, full/sub-capacity decisions) Sets up process to maintain manually collected software data Thank You Questions? The Company Aspera Technologies Inc.  Founded in 2000  Co-founders and management team: Christof Beaupoil – Co-founder, President, Aspera Technologies Inc. Bernhard Boehler – Co-founder, CEO, Aspera GmbH Olaf Diehl – Managing Director, Business Development & Operations Keith Sauvant – Co-founder, Managing Director, Research & Development  Parent company: USU Software AG  Employees: 92  Partners in: Australia, Benelux, France, Scandinavia, South Africa, and the UK  Portfolio: Tools, LaaS, Managed Services, Master Catalog, Consulting, Project Management  Customers: 24 Fortune Global 500 companies, very large, large, and medium sized organizations, government and civil services bodies Awards, Certifications, and Evaluations Awarded: Best Asset Management Solution KPMG certifies Aspera SmartTrack This tool assessment and certification was provided by KPMG Deutschland AG. and Best Web Services Solutions Aspera SmartTrack reached 100% with the maximum level of accuracy for Lab Simulation and Request Catalog. Best IT Services ECPweb.com Tools Manager – Annual Evaluation Aspera is the market leader. SmartTrack best meets the demands of large companies who wish to effectively manage software assets for their server and desktop environments. Contact North America: Europe: Aspera Technologies Inc. 470 Atlantic Ave., 4th Floor Boston, MA 02210 Aspera GmbH Dennewartstrasse 25-27 52068 Aachen, Germany Your personal contact: Shawn Smith Tel.: +1 508-473-6373 Email: [email protected] Your personal contact: Alexander Lodenkemper Tel.: +49 241-963-3290 Email: [email protected] www.aspera.com Aspera GmbH and Aspera Technologies Inc. check and update the information in this presentation on an ongoing basis. Despite this, data may have changed. Therefore, Aspera cannot be held liable for the up-to-dateness of this document. The content and structure of this document are protected by copyright. Any reproduction of the information and data contained herein, especially the use of texts, text passages or illustrations, requires written prior consent of Aspera Technologies. Aspera, SmartTrack, FlowControl, ICM, CMM, FM, MM, and the license management logo are registered trademarks of Aspera GmbH in Germany and/or other countries.