SAM. SOFTWARE ASSET MANAGEMENT Baseline Review. Engagement kit

Transcription

1 SAM SOFTWARE ASSET MANAGEMENT Baseline Review Engagement kit

2 Baseline Review SAM engagement kit Table of Contents How to use this document 3 Introduction 4 Inventory tool implementation guidance 8 Data interpretation 11 Step 3: Data analysis 16 Step 4: Final recommendations 26 Appendix 29 2

3 How to use this document Getting started The SAM Baseline Review engagement kit walks you through the complete cycle of an engagement. The kit begins with a general introduction describing what a SAM Baseline Review engagement is and the stages involved to complete one. The rest of the kit focuses on how to proceed with each stage. This includes which deliverables represent billable milestones at the end of each stage. At the end of the kit, within the Appendix, you will find additional information to help you with the engagement process as well as links to resources that offer useful information and details. Prerequisites Partners that participate in a SAM engagement must be a registered SAM Gold Partner or must have earned the SAM Solution Expertise criteria. 3

4 Baseline Review Introduction SAM SOFTWARE ASSET MANAGEMENT SAM: an industry-led best practice Software Asset Management (SAM) is a set of proven IT best practices that unite people, processes, and technology to control and optimize the use of IT assets across an organization. SAM can help organizations control costs as well as manage risk, optimize software licensing investments and grow IT systems while keeping their future goals in mind. The comprehensive international standard for SAM is ISO/IEC :2006 SAM Processes. This is a vendorindependent standard supported by much of the IT industry, including Microsoft. This standard provides customers with the ability to demonstrate good corporate governance in the highly complex area of IT. SAM also assists customers in making informed decisions about managing technology change. Adopting new technology requires a thoughtful approach and careful planning. It s important to understand not only license costs but other use and infrastructure impacts to avoid unintended consequences and financial implications. A fully implemented SAM program can help customers gain the insights they need to make informed decisions about technology migration and upgrades, server consolidation and virtualization, Cloud implementation, management of mobile devices, and cybersecurity. SAM Baseline Review engagement A SAM Baseline Review engagement provides the customer with a complete view of their current Microsoft product deployment and licensing position and their SAM maturity level. With this information, you can help the customer optimize their software investments. Customers will receive several key deliverables, including but not limited to: 1) SAM Baseline SOM Assessment Report 2) Established Deployment Position (EDP) 3) Effective License Position (ELP) 4) License Optimization Report Each customer should come away with an end-to-end, value-based SAM experience. Customers also will learn how to improve internal processes to lower costs, reduce risk, and improve productivity. By receiving an expert-level inventory snapshot that is clear and comprehensive, they ll be in a better position to work through IT challenges like SQL workload optimization, Cloud implementation, and virtualization. Your role is to facilitate the SAM engagement on behalf of Microsoft. When performing an analysis, you should record licensing and usage in accordance with the terms of Microsoft s licensing programs. You ll work with the customer s organization to conduct the engagement and interview SAM stakeholders such as procurement, HR, accounting/finance, IT managers and staff, business unit managers, and legal personnel to get a holistic view of the organization s infrastructure and current policies and procedures. 4

5 Baseline Review Introduction Foundation for strong IT governance A SAM Baseline Review is the core activity of any effort around SAM. If an organization does not have a foundational understanding of their IT environment, it will be difficult for them to develop a strategic forward-thinking plan. The baseline is useful for measuring: Software deployments Licensing position and requirements Tool needs based upon any gaps in data collection that may be identified Risks Strengths and weaknesses of an organization s existing IT infrastructure Maturity of SAM processes Partner benefits Develop long-term relationships by establishing credibility and demonstrating customer-focused problem-solving. Open the door to new business, new customers, and the opportunity to develop an on-going customer relationship. Increase services revenue at each organization by finding further opportunities that develop from the baseline, since most customers need to spend their time focusing on their own core business, and licensing can be complex. Enjoy lowered costs and improved profitability with the repeatable model of the SAM Baseline Review for multiple customers. Establish yourself as a trusted advisor by advising customers about the benefits of a solid SAM strategy with the SAM Optimization Model, and highlighting the overall benefits of incorporating SAM best practices throughout the customer s organization. Pave the road to specialized SAM engagements such as Cloud Productivity, Cybersecurity, Virtualization, and Mobile Device Management, which require the completion of a full scan of the customer s environment. Customer benefits Align software licenses and usage with business needs. Simplify acquisition, deployment, and management of software. Improve forecasting to help the IT department control expenditures. Control costs and minimize business and legal risks through more effective management of software assets. Achieve greater negotiating power with vendors and help get the most out of software investments. Develop an understanding of the organization s SAM maturity and create a roadmap to visualize the benefits and savings at each stage of SAM optimization. Save time and money by working with a partner with a deep knowledge of SAM. Identify opportunities to benefit from a specialized SAM engagement such as Cloud Productivity, Cybersecurity, Virtualization, and Mobile Device Management, which require the completion of a full scan of the customer s environment. Understand the current environment to help plan for future needs. 5

6 Baseline Review Introduction What to expect from a SAM engagement Every SAM engagement focuses on four phases PLANNING Identify your needs & goals Gather information on licensing, IT landscape & business organization Discuss project and arrange access & resources DATA COLLECTION Take inventory of hardware, software, and licenses using tools, questionnaires, and stakeholder interviews Gather information on process & procedures DATA ANALYSIS Review & validate all collected data Compare deployed assets with current utilization Map to an optimized environment based on your goals FINAL RECOMMENDATIONS Discuss final recommendations and engage in data-driven discussions to ensure your business needs & goals are met Deliverables Letter of Engagement Deliverables Established Deployment Position (EDP) Deliverables Effective License Position (ELP) License Optimization Report Deliverables Baseline SOM Assessment Report In addition to services, you can also help a Cloud customer adapt policies and procedures to encompass the change. SAM Cloud programs must take into account the real-time nature of the environment and speed and ease of provisioning services. Organizations end up actually relying more on SAM policies and procedures for Cloud contracting, deployment, and management than they would in a traditional environment with a longer product lifecycle. All work completed under this Statement of Work (SOW) will be provided in accordance with the Intelligent Asset Manager (I-AM) Terms of Use ( TOU ), available here. For Proof of Execution (PoE), you must include the following deliverables (listed below), due to Microsoft, upon the completion of the SAM engagement. Letter of Engagement Established Deployment Position (EDP) Effective License Position (ELP) Baseline SOM Assessment Report Letter of Confirmation (only required for certain countries) 6

7 Baseline Review Step 1: Planning SAM SOFTWARE ASSET MANAGEMENT A comprehensive software inventory provides the foundation for all SAM recommendations and guidance about how an organization can optimize their software assets and the procurement process going forward. This discovery process can also help organizations identify unwanted or unauthorized programs that could pose a security risk or are not covered by a current licensing agreement. For a SAM Baseline Review, collecting all relevant hardware and software inventory data from all users and devices in the environment is a standard best practice. The inventory and resulting data are important in determining whether software assets are licensed appropriately, managed optimally, and configured to support ongoing license compliance. The first stage of such an engagement focuses on planning. Within this stage, you will achieve the following: Gather information about the customer s environment Discuss the project and arrange access and resources Gathering customer information Your most important source is your customer. Customer conversations are key to an effective SAM engagement and should help provide the insights you need to fully understand the customer s environment. At the outset of the engagement you should ask questions to learn more about the organization, such as: At the outset of the engagement, you should collect the following inputs from the customer s premises: A complete background of the customer s existing IT infrastructure and environment including onpremises, Cloud and outsourced installations for all locations and/or divisions. Deployment inventory data coverage of no less than 90% from at least one (1) automated discovery tool for each customer location where Microsoft products are installed (see Data Collection Requirements) Entitlement data outside Microsoft Volume License Agreements from procurement and any applicable sources or suppliers which may include: o Original Equipment Manufacturer (OEM) o Full Packaged Product (FPP) / Retail o Outsourcer o Service provider (Hosters, etc.) o Additional reseller(s) o Changes to entitlements resulting from mergers, acquisitions or divestitures o Independent Software Vendors (ISV) o Any servers/environments managed by a Service Provider Licensing Agreement (SPLA) A full and confirmed list of affiliates, if they exist, and any relevant amendments to their Microsoft Volume License Agreements, including any license transfer documents, either granting or receiving licensing rights. Customer input on current SAM processes and level of maturity, as mapped to Microsoft s SAM Optimization Model framework and questionnaire (see Microsoft Baseline SOM Assessment Report) using stakeholder interviews. 7

8 Baseline Review Step 1: Planning o A minimum of three (3) stakeholders must be interviewed, representing decision-making roles in the following departments: Information Technology (IT), Procurement and Operations. o Input must also include an interview or feedback from one (1) stakeholder for each location and/or division (if the customer has multiple locations and/or divisions). Current IT infrastructure and organization diagrams that include locations, IT group names, SAM tool(s) or supporting processes in place and stakeholder names. Location of software entitlement, deployment and retirement records as well as level of access allowed. Office 365 and other Microsoft Online Services reservations and assignments. Any copies of recent SAM reports and SAM Self-Improvement Plans that have been created for internal stakeholders, including any evidence of stakeholder and executive review and sign-off (if available). The partner will collect the following inputs from Microsoft: Microsoft License Statement (MLS) including Microsoft Product and Services Agreement (MPSA) data where relevant. Discuss project and arrange access and resources Based on the preliminary information you ve gathered, you can create a full SOW. This plan will contain an outline for data collection and analysis, a detailed list of deliverables, and a timeline with deadlines. This establishes a customer s expectations and your accountability. Deliverables A Letter of Engagement is due to the customer and Microsoft at the beginning of the engagement. This letter provides the necessary Proof of Execution (PoE) in order for you to collect Channel Incentives payment. The letter must include at a minimum: A SOW for the engagement being performed, including a list of all customer deliverables Scope of the engagement, including any scope limitations Dates and timelines Your project team members and their relevant Microsoft Certified Professional (MCP) credentials A list of key contacts that must include names, titles, phone numbers, and addresses A planned disclosure of engagement deliverables to Microsoft A statement explaining that data collected by you from the customer s information system environment is transferred to Microsoft, and how Microsoft will use that data collected to generate reports necessary for you to effectuate the SAM services Consent from the customer to transfer data to Microsoft, any of its affiliates, and to the subprocessors Microsoft may employ to generate the reports necessary for the SAM services, including consent to transfer personal Information to the United States and other countries where Microsoft s subprocessors are located. Personal Information in this instance means any information provided by Microsoft or collected by you in connection with this agreement that (a) identifies or can be used to identify, contact, or locate the person to whom such information pertains, or (b) from which identification or contact information of an individual person can be derived. Personal Information includes, but is not limited to: name, address, phone number, fax number, and address. Additionally, to the extent any other information (such as but not necessarily limited to, a personal profile, unique identifier, and/or IP address) is associated or combined with Personal Information, then such information also will be considered Personal Information. 8

9 Baseline Review Step 1: Planning The Microsoft SAM Engagement data usage and privacy information document (i.e. Data Usage Guide). Reference to the Data Usage Guide, where appropriate. The Letter of Engagement must be in writing and signed by an authorized representative of your organization and the customer. You also must notify the Microsoft SAM Engagement Manager when the Letter of Engagement is uploaded into the required system as designated by Microsoft (currently, CHIP). Letter of Engagement Provides the customer with an overview of the SAM engagement. View sample report here. 9

10 Baseline Review Step 2: Data collection SAM SOFTWARE ASSET MANAGEMENT The objective of data collection is to develop a profile of the customer s current Microsoft software in their environment for analysis. Within this discovery stage, you ll take inventory of the customer s IT assets and licensing. This section contains a minimum list of required steps partners must take to ensure satisfactory levels of completeness and accuracy to build the basis for the required analysis and customer deliverables. Partners will ensure that all data collected will be stored securely and in accordance with the requirements set out in the I- AM TOUs. There are two main categories of data collection: 1) data related to the discovery and inventory of hardware and software assets and the mapping to licensing entitlements to complete the EDP and ELP proof of execution and 2) data related to the maturity level of the customer s SAM policies, procedures and practices to complete the SAM Optimization Model (SOM) Assessment proof of execution. Partners must ensure that the data collected is whole, complete and accurate through validation with secondary data sources. The data collection must cover the full scope of the customer s enterprise and all Microsoft products deployed within the environment. Any deviation or change to this scope needs to be approved by Microsoft, the partner and customer. You ll want to secure a clear, documented, and shared understanding of the customer s complete server estate (physical and virtual), license management processes and practices, offerings and use of Microsoft products, datacenters, and domains. Within this stage, you ll acquire a documented license responsibility per environment (internal, dedicated, co-located, license mobility) and for the whole scope of the engagement. This will come prior to data analysis and formation of a report. Take inventory of IT assets and licensing You need to prepare to take a full inventory of hardware and software deployments and licensing. This assessment includes how the technology is being used, and by whom. You can accomplish this through inventory tools, questionnaires, and stakeholder interviews. Before you can move forward, however, you must first work with the customer to establish the following parameters: Data collection requirements Choosing the right tool Scope inventory Implementing the inventory tool Gathering data Data collection requirements Data coverage means the percentage of total devices for which all required installation data has been obtained. Data coverage must reach at least 90% of all devices pertaining to this engagement. Where devices aren t joined to the directory or network, manual collection of data is acceptable (while maintaining the 90% data coverage requirement). Some specific guidance includes, but is not limited to: 10

11 Baseline Review Step 2: Data collection Data extract must be cross-referenced against a minimum of one (1) additional data source, including but not limited to: o Records from existing network performance/security monitoring and management tools o Network management frameworks o Virtual machine performance monitoring o Customer Human Resources (HR) records o Security sources (anti-virus) All trust accounts must be extracted to ensure no domains are missed. Extraction of user accounts by group (if applicable, e.g., for Citrix). Output includes a listing of user objects and the AD Groups they belong to. Identification of active users based upon the technique(s) employed by the customer (based on output from Step 1). Complete extraction of data from the customer s current management and inventory tools and the calculation of current coverage levels of existing tool(s). Inventory of any missing devices, including but not limited to devices that: o Do not report inventory o Are non-networked o Are unmanaged devices Virtual environment mapping output includes: o Clusters o Physical hosts o Virtual guests and virtual guest movement across physical hosts within the past 90 days to accurately calculate licensing needs for products such as Windows Server, SQL Server, etc. Identification of workstations and servers used by Microsoft Developer Network (MSDN ) subscribers. Products installed on these devices will be identified and excluded if appropriate. Facilitation of the identification of devices covered by MSDN subscriptions by employing various methods such as determining preferred user for devices, linking last logged-on user to devices, or soliciting feedback from customer personnel that have an MSDN subscription ( template can be provided.) This step should be completed as early as possible in the data collection phase. For server products that can be licensed in multiple ways (e.g., server/cal or per processor), the licensing metric applicable to each implementation must be identified. SQL Server output includes: o Version and edition o License type required for each SQL Server instance for customers with mixed licensing metric (server/cal, per processor or per core) o Confirmation of passive SQL Servers assigned Failover Rights Windows Server output includes: o Server name o Physical or virtual operating system environment o Operating system version and edition o Processor and core information System Center Server output includes: o Server names o Physical or virtual data o Component (e.g. System Center Configuration Manager (SCCM), System Center Virtual Machine Manager (SCVMM) version and edition) o Processor and core information 11

12 Baseline Review Step 2: Data collection SOM Assessment Complete the Microsoft SOM Assessment Report questions with answers provided by the customer through interviews. Choosing the right tool With the right inventory tool, you can collect a wide range of data points including software versions, onpremises software usage, and an analysis of applications or services already running in the Cloud. When choosing an inventory tool, keep in mind that each tool supplier has its own process framework. Tools don t all function the same way. Using multiple tools helps discover and analyze the data and provide a more robust view of a customer s environment. While in some cases the customer may already have an inventory tracking system, other tools may be able to augment the types of data that the customer s tool collects. Some considerations to keep in mind when choosing or recommending an inventory tool: What inventory tools are already deployed within the organization? What scope of the environment do they cover? What data points are they capable of capturing and reporting? Will deploying an agent-less or agent-based tool be more effective? What are the strengths and weaknesses of the tools being considered? Will one or more of the tools collect all required data points hardware, software, virtualization details across a variety of hypervisors (Hyper-V, VMware and XenServer, for example). Is it optimal to deploy and monitor a tool remotely or on-premises? How will the tool gather data from PCs, servers, and mobile devices that connect to the network remotely? If using an inventory tool that the customer already has in place, make sure it s configured correctly and can scan the full IT environment. Consider how the tool is licensed. The optimal tool will collect the right data and align with the customer s budget, whether the tool requires a license or subscription or is free. Scope of inventory For any SAM engagement, a standard best practice is to collect all relevant inventory and licensing data across all Windows-based computers in the environment. For a SAM Baseline Review, it s important to consider the minimum requirements based on customer goals. For customers looking to move some or all of their applications to a web-client delivery solution such as Office 365, the inventory tool s scope should cover all clients and a subset of servers to assess if systems are ready for the various Office 365 offerings. You should also determine the scope of devices that contain data to be collected. For customers running Active Directory Domain Services (or Directories in the case of multiple, separate domains/forests), include in scope all machines with Active Directory activity reported in the last 30 days (time frame can be adjusted according to customer circumstances). Implementing the inventory tool The standard approach for deploying an inventory tool for a SAM Cloud Productivity engagement includes preparing the environment for scanning and data collection. Use either a combination of available tools or iterative scans to continually increase coverage rates. 12

13 Baseline Review Step 2: Data collection Agent-less tools Understand domain, network, and firewall (as examples) considerations that can effect a tool s ability to access various portions of your customer s environment. Open firewalls, make firewall exceptions, deploy Group Policy Objects, and open specific ports, to ensure that the tool can access all the targeted machines. Agentless tools typically need to run multiple times, especially at different times of the day and days of the week to catch the variety of users, shifts, and time zones, depending on the organization. Agent-based tools Ensure agents are communicating regularly so that data remains current. Ensure agents are deployed to the scope of target machines. With the right refresh and agent coverage, data collection from an agent-based tool should be a single snapshot extraction no additional iterations should be necessary with the right refresh schedule and agent coverage. Gathering data When collecting information, consider taking the following actions: Ask the customer to confirm the full set of Microsoft products offered to end customers. Compare the results to the customer s current product reporting (invoicing) Ask relevant questions regarding the customer s environment that enable you to effectively plan data collection from an infrastructure and stakeholder perspective. By the end of this stage, you should have a clear picture of: o Environments o Datacenters o Number of servers (physical and virtual per environment/customer) o Deployment types o Type of virtualization software in use o Software inventory tools in use o Operations management software in use o Identification of other affiliates providing hosting services o Microsoft products and versions in use and features enabled o How servers and software are provisioned, decommissioned and tracked o Dates when each server was put into production o How the company manages user access Deliverables At the conclusion of this stage, you ll create a set of reports that summarize your findings including the following: EDP Provides details related to the customers Microsoft software deployments and usage data. View sample report here. The customer will have time to review and validate the preliminary reports and make final adjustments. 13

14 Baseline Review Step 3: Data analysis SAM SOFTWARE ASSET MANAGEMENT The SAM Baseline engagement data must be analyzed, reviewed and agreed upon with the customer as an accurate point-in-time reflection of the customer s current deployment and license position. This data, along with the additional customer inputs, will provide a basis for the development of solid license optimization recommendations and a robust SAM Optimization Model maturity assessment unique to the customer. Based on the inputs and data collection, the partner will complete the following required analysis: Reconciliation analysis between license entitlements and deployment data, including the application of license benefit and optimization rules (e.g. upgrades, downgrades, promotions, etc.). Review of the Microsoft SOM Assessment Report answers and results in each of the ten key competency areas identified in the SOM tool in order to prepare recommendations and next steps for the customer In addition, work with your customer to identify over-licensed and under-licensed software, and events that might have led the customer to any inaccuracies. Reconcile any licensing gaps, and provide the customer with guidance on the best way to manage their software assets most effectively going forward. This third stage of a SAM engagement focuses on achieving the following: Review & validate all collected data Compare deployed assets to entitlements Map to an optimized environment based on customer goals Interpret inventory data Review and validate all collected data A SAM engagement helps identify and document all product deployments, usage, and license entitlements. This includes combining the inventory data with other relevant data and information that may not be discoverable with most tools such as your browser readiness for an Office 365 migration, development needs to migrate workloads to Azure, and relationships between on-premises systems and Cloud systems. Compare deployed assets to entitlements One key benefit of a SAM engagement is that it gives you a clear picture of a customer s entire IT landscape, which you can then share with them. This includes an accurate view of all of a customer s license entitlements. By understanding these entitlements, you can help customers identify over-licensed and under-licensed software so they can purchase any necessary additions to bridge licensing gaps. The SAM Baseline engagement will also help to identify any license gaps eligible to be right-licensed while moving to the Cloud. This helps ensure that the customer is getting credit for everything they own. In addition, the engagement helps highlight ways in which a subscription model can impact budgeting and procurement, taking into account direct, indirect, and hidden costs. Discussions around a customer s current licensing program and future needs will also help to identify the optimal Volume Licensing choices going forward. 14

15 Baseline Review Step 3: Data analysis Map to an optimized environment based on customer s goals To optimize results, you have to take a holistic view of the customer s current state and intended goal, objectives, level of willingness to move, technical readiness, and cost considerations. These help determine the optimal Cloud solution recommendation. Recommended areas of analysis for optimization include the following: Assess whether the customer s appropriately licensed for their current deployment and usage state. We can then provide recommendations for the best licensing options to align with their future business plans. Analyze the customer s SAM process and provide recommendations to develop or improve them in support of ongoing optimization, management, and compliance. Determine whether systems are ready for Azure in their current configurations by identifying the Windows operating system and SQL Server software versions currently running to see if they are supported in Azure. You can find supported versions at Microsoft Server Software Support for Microsoft Azure Virtual Machines. Size the systems being assessed to understand system utilization and anticipated resource needs in Azure Virtual Machines. This requires collecting performance metrics, not simply a single scan of how a machine is running at a single point in time. Recommended metrics include the following: Azure Virtual Machine size CPU utilization (%) Estimated monthly usage Network use (GB) Storage use (GB) Network utilization in/out (MB) Identify applications and services that are already running in the Cloud and consider the most effective way to manage those solutions. For more detailed information on working with Microsoft Cloud management solutions, please read about the Enterprise Mobility Suite with Windows Intune, Azure Active Directory Premium, and Azure Rights Management. Look for areas of potential risk pertaining to running older software that is out of date or past end of support. In particular, try and track the following information: Devices not running updated software Devices running Windows XP Devices running Windows Server 2008 Memory utilization (MB) Disk I/O utilization (I/O operations per second) Interpret inventory data When reviewing the inventory tool output, look for anomalies such as client count results differing greatly from the number of employees. Question anything that seems unusual to ensure your analysis is an accurate representation of the customer s environment. Make sure you understand the relationships between on-premises systems (such as an employee database) and Cloud systems (such as payroll). Be aware that inventory data for Cloud computing may be accessed, delivered, and managed differently than data for on-premises solutions. Data from the inventory tool should be combined with data from other sources (IT service management and finance, for example) so informed decisions can be made that reflect all aspects of moving workloads to the Cloud, including the impact on total cost of ownership and return on investment. 15

16 Baseline Review Step 3: Data analysis The customer needs to know who is managing what in order to inventory assets properly. If the organization is using a service provider, clarify what was purchased and who is managing it. Over-licensing and under-licensing Based on your analysis, you ll be prepared to discuss the customer s current state, with clear information on places where they may be over-licensed or under-licensed. Ensure that you are fully aware of the installation or virtualization rights that your customer s products may have, via traditional product use rights, Software Assurance (SA) Benefits, or even via license grants documented in the Product List. Use the findings to talk about the benefits of being right-licensed, and discuss the licensing options that are available to help them achieve proper licensing. Address any licensing shortfalls that have been identified and explain the steps the customer should take to resolve their under-licensed position. Typically, the customer will follow their standard process and acquire the shortfall through their reseller using their existing Volume Licensing (VL) agreement. Agree on a timeline to resolve the shortfall within thirty days of identification is a reasonable time period. Help the customer by connecting their licensing shortfalls to gaps in their SAM management processes, highlighting areas of improvement. Often shortfalls do relate to issues with inadequate existing SAM processes; if processes had been in place and carried out properly, shortfalls would have been found earlier. The diagram below shows an example of over- and under-licensing and represents the basic information most companies will need to track as a starting point. Organizations with additional complexities will need to add additional fields to be complete. Product Name Version Edition License Type Installations Licensed Quantity License Excess or Shortfall Office 2010 Professional FPP Office 2013 Professional Plus VL Windows 7 Professional VL Windows 8 Enterprise OEM FPP = Full packaged product OEM = Original equipment manufacturer VL = Volume Licensing License rights vary depending on the type of license purchased You may find that the customer is over-licensed in some areas. They may have acquired more licenses than necessary, or be mistaken in their belief that software is being used. If it is discovered that they are not using the product, and if their license rights allow it, recommend that they reassign the product to another workload, or move the product to the Cloud if the customer has License Mobility rights. If the product is being used but there is a quantity mismatch or surplus, advise them to adjust their purchases to match their actual requirements. If the customer has active Software Assurance, there is the potential to step them up in the situation where they may need additional licenses for a higher edition of a product. 16

17 Baseline Review Data analysis SAM Assessment A SAM Assessment is a review of the customer s existing processes against the SAM Optimization Model framework, identifying improvement opportunities and associated ROI. The SAM Optimization Model (SOM) is a framework developed by Microsoft that is aligned with Microsoft Infrastructure Optimization (IO). SOM enables partners and customers to evaluate SAM effectively and objectively, in order to help them manage the life cycle of software assets with policies, procedures, tools, and a vision for the future. SOM provides an established set of criteria to help you make consistent SAM assessments and recommendations. Use this model to conduct an evaluation to determine how effectively your customer is managing software assets. The results from the assessment will form the basis for guidance you will provide the customer with ways to improve their SAM practices and a tailored road map to help them visualize the benefits and savings at each stage of SAM optimization. SAM Optimization Model & ISO SAM The SAM Optimization framework serves as the foundation and guidance for preparing to implement an effective SAM program that supports alignment with ISO standards. The model is based on the ISO/IEC standard, which is the gold standard for SAM processes. It identifies ten KPIs that focus on key processes an organization needs to follow to implement a SAM program. The SAM Optimization Model is a stepping stone to accomplish a complete end-to-end SAM program as defined within ISO/IEC , which outlines the requirements and certifications recommended for a comprehensive SAM program. Adopting both frameworks will help ensure that customers accurately and strategically implement and manage a successful ongoing SAM practice. 3. Long-term focus MS SOM Dynamic ISO SAM Tier 4 Largely Equivalent ISO SAM Tier 3 ISO SAM Tier 2 2. Subsequent focus MS SOM Rationalized ISO SAM Tier 1 Largely Equivalent 1. Initial focus MS SOM Standardized MS SOM Basic 17

18 Baseline Review Data analysis - SAM Assessment The Microsoft SOM infrastructure optimization maturity levels are: Basic Ad Hoc Little control over what IT assets are being used and where. Lacks policies, procedures, resources, and tools. Standardized Tracking Assets SAM processes exist as well as tool/data repository. Information may not be complete and accurate and is typically not used for decision making. Rationalized Active Management Vision, policies, procedures, and tools are used to manage the IT software asset lifecycle. Reliable information used to manage the assets to business targets. Dynamic Optimized Near real-time alignment with changing business needs. SAM is a strategic asset to overall business objectives. Basic SAM Standardized SAM Rationalized SAM Dynamic SAM Ad Hoc. Tracking Assets Active Management Optimized Little control over which IT assets are being used and where. Lacks policies, procedures, resources, and tools. SAM processes exist as well as tool/data repository. Information may not be complete or accurate and typically not used for decision making. Vision, policies, procedures, and tools are used to manage the software asset lifecycle. Reliable information used to manage the assets to business targets. Near real-time alignment with changing business needs.. Business competitive advantage through SAM. The first two levels, Basic and Standardized, are the initial focus points for an organization. As organizations increase their maturity, they will progress up to Rationalized, with the ultimate long-term goal of arriving at a Dynamic state. The Rationalized level is similar to the ISO SAM Tier 1 in the ISO model, and the Dynamic level corresponds generally to the ISO SAM Tiers 2, 3, and 4. For more information on the ISO model, see ISO/IEC :2012 Information technology Software asset management Part 1: Processes and tiered assessment of conformance. 18

19 Baseline Review Data analysis - SAM Assessment SOM maturity levels and key competencies The SOM Assessment is a systematic approach in which you compare Key Performance Indicators (KPIs) found within the customer s current environment against a defined model to determine a SAM maturity level. The objective is to gain an understanding of the organization s overall SAM maturity, highlight SAM strengths and weaknesses, and provide a roadmap for improvement. A SOM Assessment Report provides the customer with an assessment rating and SAM maturity level based on answers to SAM policy and procedure questions asked throughout the engagement and captured in the Microsoft SAM Assessment Report. The report also provides recommendations at each stage of the model, prioritizing the ones with the greatest impact for the customer. For each key competency area, you will identify the sources of data that need to be gathered, identify how to evaluate the data and what is to be determined, and then breakout the four maturity levels, using the tipping points for each level. SAM Optimization Model maturity levels BASIC STANDARDIZED RATIONALIZED DYNAMIC SAM Throughout Organization SAM Improvement Plan Hardware & Software Inventory Accuracy of Inventory License Entitlement Records Periodic Evaluation SAM Operations Mgmt & Interfaces Acquisition Process Deployment Process Retirement Process Project Manager assigned but SAM roles & responsibilities not defined No SAM development or communication plan No centralized inventory or < 68% assets in central inventory Manual inventory; no discovery tools Procurement manages contracts; not accessed by IT managers IT operations managed on ad-hoc basis SAM not considered part of M&A risk plan and company integration Assets purchased on a per project basis; without a review of current availability Assets deployed by end-users in distributed locations; no centralized IT Software is retired with hardware and is not harvested or reassigned Direct SAM responsibility is identified throughout organization SAM plan is defined and approved > 68%-95% of assets in inventory Inventory sources reconciled annually Complete entitlement records exist across organization Annual sign-off on SAM reports Operations manages separate asset inventories Software purchases use approved vendors Only approved software is deployed Unused software is harvested (where the license allows) and tracked within a centrally controlled inventory Each functional group actively manages SAM SAM Improvement is demonstrated > 95% - 98% of assets in Inventory Inventory sources reconciled quarterly Entitlement records reconciled with vendor records Quarterly sign-off on SAM reports Operations manages associated asset inventory Software purchases based on deployment/ entitlement reconciliation Software deployment reports are accessible to stakeholders Centrally controlled inventory of harvested licenses is maintained & available for reuse. Deployment & license records are updated SAM responsibilities defined in job descriptions across organization SAM goals part of executive scorecard; Reviewed regularly > 99% of assets in inventory Dynamic discovery tools provide near real-time deployment details SAM entitlement system interfaces with vendor entitlement to track usage System reconciliations and ITAM report available on demand All business units follow the same strategy, process & technology for SAM All purchases are made using a predefined asset catalog; based on metered usage Software is dynamically available to users on demand Automated process w/centralized control & tracking of all installed software, harvest options, internal reassignment and disposal 19

20 Baseline Review Data analysis - SAM Assessment As you assign the maturity level for each of the ten key competency areas, note the customer may be at different stages in the model meaning some areas will be Basic while others are Dynamic or Rationalized. Most customers will be in the Basic and Standardized maturity levels, but you will see some areas (for example, Acquisition Process) that could be Rationalized or even Dynamic. SOM Workbook The SOM Assessment Report Workbook is used to document the details on your maturity level assessment ratings for each of the key competency areas. The workbook provides a framework for your customer SAM optimization review. It will also enable you to capture the assessment ratings for each of the ten competency areas. Workbook contents Within the workbook there is a tab for each competency. In addition to the objectives and key questions, each tab contains a definition of the competency, risk considerations, guidance on how to evaluate the SAM optimization level, and the final assessment rating for the specific competency. You can also enter notes, as needed, at the bottom of each tab. The SAM Assessment Report tab, provides the consolidated assessment ratings across all ten competencies once they have been filled in by you. From this tab, you can save a copy of this summary information to to Microsoft by clicking the Create Final Report button. Note: You need to enable the Macro Option above in the Security Warning. The SAM Assessment Graph tab provides a graph based on the summary assessment data once it is all collected. The last tab, Competency Rating Information provides definitions for each competency and optimization level, along, with additional assessment guidance. To get started: Follow the directions on the Getting Started section of the Introduction tab. To set up the workbook for the customer: 1.Enable the macros in the security options 2.Enter the name of the Customer, in cell F2 3.Enter the Partner Name in cell F3 4.Enter the Partner MSPP ID in cell F4 5.Enter the OpportunityID or Agreement # in cell F5 20

21 Baseline Review Data analysis - SAM Assessment Filling out the Workbook Using the information you collect by questioning the customer and assessing their maturity level in each of the ten competencies (both explained in more detail below), you will record an Initial Observation and an Assessment Rating for each competency in the appropriate competency tab. The Assessment Rating is your analysis of the customer s maturity for a particular key competency. The (Initial) Observations is supporting information on why you selected the Assessment Rating. The SAM Assessment Report tab is organized by the key competencies and corresponding ISO categories, and the results. Once all observations and ratings are recorded, the information in the Current Optimization columns are auto filled based on the Assessment Rating you have selected as well as your Initial Observation. 21

22 Baseline Review Data analysis - SAM Assessment Creating a final report To create a final report, select the Create Final Report button, making sure that macros are enabled. Results from the workbook are also provided back in the form of a graph on the SAM Assessment Graph tab. This is an example of what the output graph will look like: 4 3 Basic Standardized Rationalised Dynamic SAM throughout organization SAM improvement plan Hardware and software inventory Accuracy of inventory License entitlement records Periodic self evaluation Operations management interfaces Acquisition process Deployment process Retirement process 22

23 Baseline Review Data analysis - SAM Assessment Deliverables Upon completion of this stage, you can offer key best practices to improve the customer s software asset management program going forward. ELP License Optimization Report Provides details related to license entitlements which are mapped to deployments and identifies any gaps or underutilization in your organization. Presents recommendations on how to optimize your infrastructure and improve licensing efficiencies. View sample report here. 23

24 Baseline Review Step 4: Final recommendations SAM SOFTWARE ASSET MANAGEMENT Final results The SAM Baseline engagement data must be analyzed, reviewed and agreed upon with the customer as an accurate point-in-time reflection of the customer s current deployment and license position. This data, along with the additional customer inputs, will also provide a basis for the development of solid license optimization recommendations and a robust SAM Optimization Model maturity assessment unique to the customer. Based on the inputs and data collection, the partner will complete the following required analysis: Reconciliation analysis between license entitlements and deployment data, including the application of license benefit and optimization rules (e.g. upgrades, downgrades, promotions, etc.). Review of the Microsoft SAM Assessment Report answers and results in each of the ten key competency areas identified in the SOM tool in order to prepare recommendations and next steps for the customer Additionally, SAM must take into account the speed and ease with which new services can be provisioned, configured, and released. This ease of implementation introduces organizational risks by decentralizing IT services. Because Cloud services appeal directly to business users, the risk exists that these services may be purchased outside the traditional software procurement and SAM processes. Deliverables The following deliverables are due to the customer at the end of the engagement A comprehensive view of the customer environment. A document with details related to all hardware and software currently deployed within the customer s IT infrastructure. The Effective License Position (ELP). A spreadsheet that provides details related to license entitlements and deployments. The spreadsheet must be produced using I-AM (Note: Defined in Deliverables to Microsoft). License Optimization Report. This report must contain the risks, liabilities, and issues associated with customer s current licensing practices and prioritized recommendations on how to better manage their licenses to minimize risks in the future. The report could also contain, but is not limited to: o Identification of all of the customer s Volume License Agreements (VLAs) with Microsoft and a recommendation on any beneficial consolidation. o Consumption information, detailing installed products that are unused or underutilized (e.g., no use in last six months). o Recommendations for a repeatable, simplified inventory collection process for future True-ups (for Enterprise Agreement customers only). o Additional customer-specific recommendations based on captured data and insights. 24

25 Baseline Review Step 4: final recommendations Microsoft Baseline SOM Assessment Report. The Microsoft Baseline SOM Assessment Report provides the customer with an Assessment Rating and SAM maturity level based on answers to SAM policy and procedure questions asked throughout the engagement. The report must also provide recommendations at each stage of the model, prioritizing the ones with the greatest impact on the customer. According to the scope of the engagement, this report will contain: o An Executive Summary. A high-level summary of project background and scope, engagement result, recommendations and next steps. o SOM Assessment and Recommendations. A summary of findings and results of the SOM maturity assessment. The SAM Partner must notify the Microsoft SAM Engagement Manager when the POE is uploaded into the required system as designated by Microsoft (currently, CHIP). POE includes the following deliverables due to Microsoft upon the completion of the SAM Engagement and must be provided as necessary POE in order for the partner to collect Channel Incentives payment: Established Deployment Position (EDP). The EDP, an I-AM generated Excel report, provides details related to the customers Microsoft software deployments and usage data. The software deployments are identified using discovery tools and manual inputs as outlined in the Data collection section. The partner must first input all relevant data into the customer Inventory Data Contract (CIDC) template, which will be uploaded into I-AM. The EDP will then be created by the partner using I-AM which is to be given to the customer and Microsoft. EDPs produced outside of I- AM will not be accepted as proof of execution. The EDP data must meet or exceed the minimum quality standards published in the current SAM Minimum EDP Quality Standards. Effective License Position (ELP). The ELP provides details related to license entitlements and deployments and is generated using I-AM. The ELP must be finalized in the I-AM. ELPs produced outside of I-AM will not be accepted. An encrypted ELP must be uploaded into the designated tool (currently CHIP) as proof of execution. Microsoft Baseline SOM Assessment Report. This must be the same Baseline SOM Assessment Report provided to the customer, as outlined above. Letter of Confirmation. (only applicable for customer countries listed below) o Required: China o Advised: India, Malaysia, Indonesia, Philippines, and Vietnam The Letter of Confirmation should be drafted after completion of the SAM engagement and requires customer s chop (stamp) or from customer corporate domain confirming provision of SAM engagement. The Letter of Confirmation must include the following statement: This is to confirm Microsoft SAM Partner <insert partner Name> has implemented SAM service <insert SAM Engagement Type> to customer <insert customer name>. 25

26 Baseline Review Step 4: final recommendations Due to customer Letter of Engagement Provides the customer with an overview of the SAM engagement. EDP ELP Provides details related to all hardware and software currently deployed within the customer s IT infrastructure. Offers details related to license entitlements and deployments. License Optimization Report SAM Baseline SOM Assessment Report Presents recommendations on how to optimize your infrastructure and improve licensing efficiencies. Provides the customer with an Assessment Rating and SOM maturity level based on answers to SAM policy and procedure questions asked throughout the engagement. Due to Microsoft Letter of Engagement Provides the customer with an overview of the SAM engagement. EDP ELP SAM Baseline SOM Assessment Report Letter of Confirmation (required for certain countries) Provides details related to all hardware and software currently deployed within the customer s IT infrastructure. Offers details related to license entitlements and deployments. Provides the customer with an Assessment Rating and SOM maturity level based on answers to SAM policy and procedure questions asked throughout the engagement (same report as given to customer). Requires customer s chop (stamp) or from the customer s corporate domain confirming provision of the SAM engagement (see previous page for list of countries required this letter). SAM resources SAM Partner eligibility, program overview, and partner incentive guides are located at 26

27 Appendix

28 Appendix Planning SAM SOFTWARE ASSET MANAGEMENT Resources Microsoft SAM Tools SAM Partner Playbook Microsoft Assessment and Planning (MAP) Toolkit 28

29 Appendix Data collection SAM SOFTWARE ASSET MANAGEMENT Tips and tricks Develop and use your own technology questionnaire and report template that specifically cover Cloud requirements that you can send to the customer in advance. Compare this feedback with your own findings. At the outset of the engagement, ensure that the customer has completed any necessary background checks and granted physical building access, and that you have scheduled all stakeholder interviews ahead of time to reduce the possibility of obstacles as the engagement moves forward. Because of the variety of Office 365 offerings, it can be useful to create a graphical representation of user profiles mapped to Office 365 offerings as a way to help visualize Office 365 needs in conversations with customers. Document any Cloud services that also connect to internal services, noting any dependencies and types of data moving back and forth. This information will help improve your understanding of the customer s system architecture and provide insights about implications for any changes or future plans. Multiple passes with the inventory tool, or with multiple tools, may be required to ensure all data is captured correctly. Naming conventions are important. Ask your customer what naming conventions are in place. Look to server names to help identify their function. Recommend that, as a best practice, your customer should use specific naming conventions going forward if necessary. Ensure that all administrator rights are lined up ahead of time and obtain all necessary data that can affect the engagement at the outset. Be sure to include and consider implications beyond the usual inventory data, including storage requirements, server application usage, internal and external access needs, seasonal changes to access, bring-your-own-device scenarios, mobile access, current and future plans, and warranty and end-of-life dates. Data protection laws differ by locale/country. For example, if you are inventorying client PCs, and access to a particular machine is open to someone in another country, know what data laws come into play. Be aware of any legal limitations around data, to help protect yourself and your customer. 29

30 Appendix Data collection Data Gathering Use the questions in the workbook to survey key customer stakeholders about a variety of elements that may impact their SAM program The customer may need help to determine what key personnel should receive the SAM Assessment Questionnaire. It s important to interview different people from different departments to triangulate the information. Each business role carries with it a unique perspective, and there may not be universal knowledge. For example, a procurement person may think all purchasing is decentralized, but by talking with IT, you may learn that IT makes purchases for their departments outside of the procurement process. Or, those responsible for retirement may not know to inform procurement that extra licenses are available. Review the questionnaire with them to ensure they understand the questions and to explain what the intention of each is. Help them to understand the questionnaire in the context of their overall SAM program. This questionnaire information provides a look at what each employee completing the questionnaire believes the current or as-is state of organization is for each key competency. For the key stakeholder, they will also identify what their desired future or to-be state is. This will provide you with insight that you can use when developing recommendations. Covering clients and a subset of servers to assess if systems are ready For Office 2013, check for: Operating system version Browser type and version on all machines Office suite version Microsoft.NET Framework CPU, memory, and free disk space For Office 365 Web Apps, check for: Operating system version Browser type and version on all machine For Microsoft Exchange and SharePoint Online, check for: Operating system version Office products installed Identify on-premises deployments of Exchange Server, SharePoint Server, Lync Server, and similar software to understand what functionality will be needed in Office 365. For customers looking at a Cloud delivery model like Microsoft Azure, the tool s scope will need to take certain dependencies into consideration. 30

31 Appendix Data collection - SAM Assessment Current Organization diagrams Gather details about the customer s organization, including: Customer size Locations Names of the various IT groups SAM tools they own and use Supporting SAM processes in use and stakeholder names SAM reports created for stakeholder or executive sponsors Current and historical reports will tell you what information is available to the stakeholders and executive sponsor. A key item is the evidence of review and sign-off, and by whom Identify how the reports are created, how often they are created and who has access to them SAM Improvement Plan This provides you information on what the customer believed was important to improve in their SAM program, how it was to be improved. Key items you want to see are: Evidence of stakeholder and executive sponsor review and budget approval to support the plan How often the improvement plan is updated and who has access to it Hardware and Software inventories This provides you information on the software deployments. Key details include: Entitlements, deployments and retirement How they were created and verified specifically, the processes and tools used for the inventory 31

32 Appendix Data collection - SAM Assessment Location of software inventories and who has access to them How is the inventory data made available? Are they dynamically created or created by a certain process then stored off so they can be review and used? Who has access to these inventories is there an access control list?approved software vendors Is there a defined list of vendors you can purchase or acquire software from? This list, if available, may be part of the procurement system Approved software titles is there a list of approved software that can be purchased or acquired? Is there a list of approved software that can be deployed? Is there a list of unknown for software that has not been classified as approved or disapproved? Some companies may have a DSL (definitive software library), which may be part of the customer s software approval process Customer Interviews Use customer interviews to fill in information gaps. During these conversations you have the chance to learn more about the atmosphere surrounding the SAM program. For example: Stakeholder objectives and goals Employees or other key resources like outsources or contract employees Customer s view of the processes Look for any road blocks the SAM program faces, what is missing, what the customer would like to see, integrations with other systems, etc. Tip: Plan logistics out to ensure you are able to schedule all interviews. One suggestion is to integrate the questionnaire questions into other SAM Baseline discussions and meetings that you ve already scheduled. Analysis Once the data has been collected you will develop a final report that provides the customer with the results of the assessment and your recommendations. As you perform the SAM Assessment, you should have documented your results in the SOM Workbook (as described in the SOM Workbook section) using the appropriate tab for each of the key competency areas as each key competency area is rated separately. Indicate your initial observations and your maturity rating based on the results of your analysis. Document the desired future for each competency area based on the customer s objectives, goals, restrictions and limitations. This will help you develop recommendations which are designed to increase the maturity level of the key competency areas. Note, some customers may only choose to focus on improving a limited number of key competency areas verses all of them. 32

33 Appendix Data collection - SAM Assessment Resources Microsoft Server Software Support for Microsoft Azure Virtual Machines Enterprise Mobility Suite 33

34 Appendix Data analysis SAM SOFTWARE ASSET MANAGEMENT Data interpretation and technical requirements Cloud solution requirements The following are examples of requirements for Microsoft Office 365 and Microsoft Azure. Office 365 requirements can vary by offering. For a comprehensive list of requirements, please review Office 365 Plan Options. Office 365 Requirements Before customers decide to move to Office 365, we recommend that you verify that their systems meet or exceed the minimum system requirements. For the best experience, Office 365 is designed to work with the following software: Current or immediately previous version of Microsoft Internet Explorer or Firefox, or the latest version of Chrome or Safari. All versions of Microsoft Office covered by Microsoft mainstream support. Office 365 does not have an operating system requirement, except that the operating system used must be supported by its manufacturer. However, there might be advanced Office 365 configuration options, features, scenarios, or tools that have explicit dependencies on an operating system or behave differently on different operating systems. The Microsoft Service Pack Support Life-cycle Policy requires customers to install Office service packs within 12 months of release. Office 365 requires compliance with this policy. Office 365 strongly recommends that customers accept automatic updates from Microsoft to help secure their environments and to have the best experience with Office 365. The minimum hardware requirements for Office 365 can be found here. Variable infrastructure resource requirements. Instances of roles and resources can be allocated as they are needed, as well as by architecting applications to take advantage of the elastic scale of Azure. Virtual machine hosting. In addition to offering traditional platform as a service advantages, Azure can host virtual machines. These virtual machines can run any Azure-supported operating system and can run applications in the same way that they would run on - premises. For a list of supported operating systems, see Overview of Azure Virtual Machines. Variable workload needs. A company may need to accommodate high levels of use only at peak times and then return to a lower, sustained level of use. Migrating these workloads to Azure can enable a customer to scale when necessary but avoid paying for higher levels of use on a consistent basis. Testing environments. A customer may require higher levels of use during the testing phase for a new application. By using Azure, the customer can increase capabilities for the testing period while avoiding substantial investment in hardware and resources that will be necessary only for a limited time. 34

35 Appendix Data analysis Additional Information Gathering Gathering inventory data is one step in defining a customer s licensing requirements. However, data from the inventory needs to be combined with additional sources in order to make informed licensing decisions. This additional information helps provide the context that is required for accurate license allocations but is not discoverable via most discovery tools. Your most important source is your customer. Customer conversations are key to an effective Software Asset Management (SAM) engagement and should help provide the additional insight needed to fully assess and understand the customer s environment. Here are some suggestions about additional items to discuss with the customer: Review the customer s intended licensing model so you can correlate details such as the use scenario of each instance and user access in order to confirm the appropriate licensing model is used. Profile servers carefully, being sure to identify active and passive servers, if servers are internal or external facing, and the extent of any virtual server environments. Insights around server scenarios will better prepare you for licensing discussions, and also lay the groundwork for additional engagements such as SQL Workloads, Cybersecurity, or Virtualization. Identify all test and development servers, watching out for servers labeled as development that are actually running as production. You can also use this information as the foundation for a Non-production SAM engagement. When reviewing the tool output, look for anomalies such as client count results differing greatly from the number of employees. Ensure your analysis is an accurate representation of the customer s environment. Data from the inventory tool should be combined with data from other sources (ITSM, finance, etc.) so informed decisions can be made. The customer needs to know who is responsible for managing each environment in order to inventory assets properly. If they are using a service provider, clarify with them: What have they actually bought? Did they buy a system or are they paying a third party to manage it? Tips and Tricks Naming conventions are important, particularly when it comes to servers. Ask your customer what naming conventions are in place. Look to server names to help identify function. If necessary, recommend the best practice of using specific naming conventions going forward. Be aware of different Product Use Rights and licensing rules for different product versions and editions. Maintain a file with information on each for quick reference. 35

36 Appendix Data analysis Resources Office 365 System Requirements HA aspx Office 365 Plan Options Office 365 Deployment Guide Overview of Azure Virtual Machines SharePoint 2013 on Azure Infrastructure Services Office 365 System Requirements - Client Side Standardized SAM Assessment Workbook (English) Standardized SAM Assessment Workbook (Available in 25 localized languages) SAM Assessment - ISO Updates Only (zip file) International Organization for Standardization (ISO) SAM Standards ISO/IEC : Information technology -- Software asset management -- Part 5: Overview and vocabulary ISO/IEC : Information technology -- Software asset management -- Part 2: Software identification tag ISO/IEC : Information technology -- Software asset management -- Part 1: Processes and tiered assessment of conformance SAM Optimization Model SAM Resources BSA SAM Advantage Training Course Aligned to the ISO/IEC Standard SAM Partner Playbookhttps://assets.microsoft.com/en-us/SAM-Services-Partner-Playbook.zip 36

37 Appendix SAM policies SAM SOFTWARE ASSET MANAGEMENT As you work to finalize the SAM Baseline Review and help the customer to understand what software they have deployed, how it s being used and by whom, and how it s licensed, the next step is to help the customer review or write policies and procedures to ensure ongoing proper software asset management. Establishing standard practices can help them become more efficient, avoid unnecessary costs and business risks, and streamline the entire organization. At a minimum, policies should cover software acquisition, use, and disaster recovery. As a starting point, basic templates and other useful resources are available for download. Best Practices for the IT Department It is important that those involved in the procurement or provisioning process and those individuals responsible for purchasing licenses are in communication and work together toensure that additional deployments of software and hardware are licensed appropriately. Gaps can exist when one function of IT is responsible for fulfilling a request but another resource in the workflow manages accountability for the actual licensing. SAM policies should address the need to properly educate the IT department in the complexities and ramifications of various IT solutions. Regulatory compliance SAM policies should address the organization s regulatory anddata security compliance requirements and take into account the monitoring of hardware, software, networking, and firewalls that is required for regulatory and data security certifications. Business compliance requirements may include the Payment Card Industry Data Security Standard (DSS), SOX, HIPAA, Electronic Records, and Electronic Submissions. Data sovereignty should also be considered. Be familiar with any requirements for your country or area so you can share them with your customer. The customer s home country may have strict restrictions on whether data can be stored or accessed from virtual servers or applications outside the country or area. Data privacy laws should also be considered. Some industries such as health and financial services may require that personal data remain within a designated region or country. Make sure that you are familiar with rules and regulations for any country or area where virtual servers may be hosted or accessed. License Compliance SAM policies should be in place to anticipate and control procurement and accessibility servers, desktops, and applications. Software and server licensing programs are typically counted on a per user basis, but in certain circumstances such as desktop and application virtualization, licenses are counted per device. It is important to address these potential risks. User groups should be created and managed by the IT team to ensure that applications and servers are only provided to those that require them. Mismanaged accessibility of applications can lead to instances of noncompliance if not planned in advance and managed appropriately. 37