Practical Management of Software Compliance
About 30% of the CIS-SAM exam — see all 5 domains.
This is the largest domain and the heart of SAM Professional. The goal is to turn raw data into a defensible, reconciled license position and then act on it.
Entitlements, allocations, and use rights
An entitlement records what your organization is legally permitted to do with a software product: how many rights you purchased, the license metric that governs counting, the publisher/product, the purchase and contract references, and any upgrade, downgrade, or second-use rights. Entitlements are matched to software models so that rights line up with the licensable units that installations normalize to.
An allocation assigns specific rights from an entitlement to a particular user or device. Allocations matter most for named-user and per-device metrics, where the question "who/what is this license assigned to?" determines compliance. Use rights (upgrade/downgrade rights, multi-use, virtualization rights, and product use rights published by the vendor) modify how raw consumption is counted; for example, a license for a newer edition may cover an older installed edition through downgrade rights.
Reconciliation and the Effective License Position (ELP)
Reconciliation is the engine that compares rights owned (entitlements) against rights consumed (normalized installations and measured usage) for each software model, then produces a software model result with a compliance status (Compliant or Not Compliant) and the surplus or shortfall of rights. The reconciled output is the Effective License Position: the single number that tells you, per publisher and product, whether you have enough licenses.
Reconciliation depends on three things being correct: (1) installs normalized and matched to the right software model, (2) each entitlement carrying the correct license metric (the metric is a field on the entitlement, not on the software model), and (3) entitlements assigned to those models. Only licensable products under management are reconciled, and installs that were never normalized are not attributed to a product, so they drop out of the count. A frequent exam trap: an entitlement recorded with the wrong metric miscounts consumption, and the fix is on the entitlement.
True-up is the corrective purchase that closes a shortfall surfaced by the ELP; the reconciled position is what you take into a vendor true-up or audit defense. Surplus positions feed cost-optimization (harvesting and not re-buying).
License metrics
A license metric defines how consumption is counted. You must recognize the major families:
- Per-device / per-installation: one right per installed copy or per machine.
- Named user: one right per uniquely identified user; usage and allocation to users drive the count.
- Concurrent user: rights consumed by simultaneous active users.
- Per-core: count physical (or virtual) cores on the host; requires accurate CPU/core data on the device CI.
- Core factor (Oracle): physical cores multiplied by a core factor taken from the vendor's core factor table (processor-type-dependent), then rounded per vendor rules. Oracle Processor licensing for Database and options (Partitioning, RAC, etc.) uses this on premises; in AWS or Azure, SAM counts vCPUs instead of applying the core factor table.
- IBM PVU (Processor Value Unit): cores multiplied by a per-core PVU value from IBM's PVU table; total PVUs determine licenses. RVU (Resource Value Unit) is a related IBM metric.
- Sub-capacity (an IBM PVU/RVU counting model, versus full capacity): licensing only the virtual capacity actually allocated (e.g., vCPUs in a VM) rather than full host (full-capacity) capacity, subject to vendor eligibility and tooling rules. Accurate VM-to-host relationships are essential.
Per-core, core-factor, PVU, and sub-capacity all break if the host's core count, processor type, or virtualization topology is wrong, which is why this domain leans heavily on the host CI being accurate.
Remediation
When the ELP shows exposure or waste, remediation closes the gap: reclaim unused installs (uninstall/harvest where usage data shows software unused), reassign harvested rights, purchase additional entitlements (true-up) where reclamation is insufficient, or apply use rights you had not been crediting. Software usage data (last-used date, run frequency) is the primary evidence for reclamation candidates.
Exam traps (Domain 3)
- The license metric lives on the entitlement, not the software model. A wrong metric miscounts consumption: fix the entitlement, not the model.
- Allocation (to a user/device) is distinct from entitlement (what you own). Multi-select questions test the difference.
- Sub-capacity is not automatic; it requires correct virtualization data and vendor eligibility.
- True-up is a purchase action driven by the reconciled shortfall, not a recount.
Sample questions from this domain
Three of the 90 in this domain, with the reasoning. The full set is in the question bank.
What does software license reconciliation in SAM produce?
- A. A compliance position comparing entitlements owned to licenses consumed ✓
- B. Normalized discovery models that match each install to a publisher and product
- C. Lifecycle phases, such as End of Support, for each installed software version
- D. Usage records showing how often each installed application is launched
Why: Reconciliation compares the rights owned on entitlements with the licenses consumed by installs and usage, and the result is a compliance position (product results of Compliant or Not Compliant). Matching installs to a publisher and product through discovery models is normalization, which happens before reconciliation. Lifecycle phases such as End of Support come from lifecycle data kept current by the Content Service. Usage records are brought into Software Usage by usage integrations; reconciliation reads them but does not create them.
If consumed licenses exceed owned entitlements for a software model, what is the resulting compliance state?
- A. Partially Normalized (publisher and product matched)
- B. Not Compliant (shortfall/exposure) ✓
- C. Compliant (surplus/over-licensed)
- D. In Progress (true-up pending)
Why: When consumption exceeds the rights owned, the product result is Not Compliant: there is a shortfall and audit exposure. Compliant with a surplus is the opposite case, where rights owned exceed consumption. Partially Normalized is a normalization status for a discovery model, not a compliance result. In Progress is a reconciliation run status, not the compliance state of a product.
Which SAM feature recommends actions to resolve non-compliance, such as purchasing more licenses or reclaiming unused installs?
- A. Software remediation / remediation options ✓
- B. Content Service / normalization library
- C. Consumption rules / license pools
- D. Software lifecycle reports / lifecycle data
Why: Remediation options on reconciliation results (Purchase Rights, Create Allocations, Remove Allocations, Remove Unlicensed Installs, Remove Unallocated Installs) recommend the actions that close a compliance gap. The Content Service keeps the normalization library current so installs can be identified; it does not recommend compliance actions. Consumption rules and license pools restrict or reserve rights for entities such as departments or locations. Lifecycle data reports product and version phases such as End of Support, which informs upgrade planning, not license remediation.