International Symposium on Software Composition

Software asset management

Software asset management (SAM) is a business practice that involves managing and optimizing the purchase, deployment, maintenance, utilization, and disposal of software applications within an organization. According to the Information Technology Infrastructure Library (ITIL), SAM is defined as “…all of the infrastructure and processes necessary for the effective management, control and protection of the software assets…throughout all stages of their lifecycle.” Fundamentally intended to be part of an organization’s information technology business strategy, the goals of SAM are to reduce information technology (IT) costs and limit business and legal risk related to the ownership and use of software, while maximizing IT responsiveness and end-user productivity. SAM is particularly important for large corporations in regard to redistribution of licenses and managing legal risks associated with software ownership and expiration. SAM technologies track license expiration, thus allowing the company to function ethically and within software compliance regulations. This can be important for both eliminating legal costs associated with license agreement violations and as part of a company's reputation management strategy. Both are important forms of risk management and are critical for large corporations' long-term business strategies.

SAM can serve many different functions within organizations, depending on their software portfolios, IT infrastructures, resource availability, and business goals.

For many organizations, the goal of implementing a SAM program is very tactical in nature, focused specifically on balancing the number of software licenses purchased with the number of actual licenses consumed or used. In addition to balancing the number of licenses purchased with the amount of consumption, an effective SAM program must also ensure that the usage of all installed software is in keeping with the terms and conditions of the specific vendor license agreement. In doing so, organizations can minimize liabilities associated with software piracy in the event of an audit by a software vendor or a third party such as the Business Software Alliance (BSA). SAM, according to this interpretation, involves conducting detailed software inventories on a ongoing basis to determine the exact number of software licenses consumed, comparing this information with the number of licenses purchased, reviewing how the software is being used in respect to the terms and conditions and establishing controls to ensure that proper licensing practices are maintained on an ongoing basis. This can be accomplished through a combination of IT processes, purchasing policies and procedures, and technology solutions such as software inventory tools.

Counting installations is the most common means of measuring license consumption but some software is licensed by number of users, capital, processors or CPU Cores.

ISO/IEC 19770-1:2017: IT Asset Management Systems Requirements is a process framework to enable an organization to incorporate ITAM (including SAM) processes and policies sufficient to satisfy corporate governance requirements and ensure effective support for IT service management overall. The implementation of SAM processes to be "accomplished in multiple staged increments or tiers." Part 1 of the standard details SAM processes including control environment, planning and implementation, inventory, verification and compliance, operations management and life cycle.

ISO/IEC 19770-2:2015: Software identification tag; establishes specifications for tagging software to optimize its identification and management. The current version was published in 2015 and is a revision to the 2009 original Software ID Tag standard. Using software identification tags or SWID tags makes discovery a simpler and more accurate process that can be verified by software vendors if they audit an organisations entire estate. SWID tags are implemented and supported by many vendors including IBM, Microsoft and Adobe.

An example of issues faced when scaling up discovery tools is with Microsoft's System Centre Configuration Manager (SCCM). Using SCCM Metering Rules to monitor software usage across a small estate or a small number of applications is relatively easy and reliable given the total number of unique executables (.exe files) and the number of instances of each executable. Turning on Metering Rules for every packaged application and every executable in a large estate quickly makes the volume of data generated unmanageable and expensive to maintain. Most SAM tools which consume SCCM data rely on these Metering Rules to understand usage.