Practical Management of Software Compliance
About 30% of the CIS-SAM exam — see all 5 domains.
This is the largest domain and the heart of SAM Professional. The goal is to turn raw data into a defensible, reconciled license position and then act on it.
Entitlements, allocations, and use rights
An entitlement records what your organization is legally permitted to do with a software product: how many rights you purchased, the license metric that governs counting, the publisher/product, the purchase and contract references, and any upgrade, downgrade, or second-use rights. Entitlements are matched to software models so that rights line up with the licensable units that installations normalize to.
An allocation assigns specific rights from an entitlement to a particular user or device. Allocations matter most for named-user and per-device metrics, where the question "who/what is this license assigned to?" determines compliance. Use rights (upgrade/downgrade rights, multi-use, virtualization rights, and product use rights published by the vendor) modify how raw consumption is counted — for example, a license for a newer edition may cover an older installed edition through downgrade rights.
Reconciliation and the Effective License Position (ELP)
Reconciliation is the engine that compares rights owned (entitlements) against rights consumed (normalized installations and measured usage) for each software model, then produces a software model result with a compliance status: compliant, over-licensed (surplus), or non-compliant (shortfall/exposure). The reconciled output is the Effective License Position — the single number that tells you, per publisher and product, whether you have enough licenses.
Reconciliation depends on three things being correct: (1) installs normalized to the right software model, (2) each model carrying the correct license metric, and (3) entitlements matched to those models. If a model has installs but no license metric, reconciliation cannot count consumption for it — a frequent exam trap.
True-up is the corrective purchase that closes a shortfall surfaced by the ELP; the reconciled position is what you take into a vendor true-up or audit defense. Surplus positions feed cost-optimization (harvesting and not re-buying).
License metrics
A license metric defines how consumption is counted. You must recognize the major families:
- Per-device / per-installation — one right per installed copy or per machine.
- Named user — one right per uniquely identified user; usage and allocation to users drive the count.
- Concurrent user — rights consumed by simultaneous active users.
- Per-core — count physical (or virtual) cores on the host; requires accurate CPU/core data on the device CI.
- Core factor (Oracle) — physical cores multiplied by a core factor taken from the vendor's core factor table (processor-type-dependent), then rounded per vendor rules. Oracle Processor licensing for Database and options (Partitioning, RAC, etc.) uses this.
- IBM PVU (Processor Value Unit) — cores multiplied by a per-core PVU value from IBM's PVU table; total PVUs determine licenses. RVU (Resource Value Unit) is a related IBM metric.
- Sub-capacity — licensing only the virtual capacity actually allocated (e.g., vCPUs in a VM) rather than full host (full-capacity) capacity, subject to vendor eligibility and tooling rules. Accurate VM-to-host relationships are essential.
Per-core, core-factor, PVU, and sub-capacity all break if the host's core count, processor type, or virtualization topology is wrong — which is why this domain leans heavily on the host CI being accurate.
Remediation
When the ELP shows exposure or waste, remediation closes the gap: reclaim unused installs (uninstall/harvest where usage data shows software unused), reassign harvested rights, purchase additional entitlements (true-up) where reclamation is insufficient, or apply use rights you had not been crediting. Software usage data (last-used date, run frequency) is the primary evidence for reclamation candidates.
Exam traps (Domain 3)
- A software model with installs but no license metric cannot be counted — fix the model, not the entitlement.
- Allocation (to a user/device) is distinct from entitlement (what you own). Multi-select questions test the difference.
- Sub-capacity is not automatic; it requires correct virtualization data and vendor eligibility.
- True-up is a purchase action driven by the reconciled shortfall, not a recount.
Sample questions from this domain
Three of the 90 in this domain, with the reasoning. The full set is in the question bank.
What does software license reconciliation in SAM produce?
- A. A compliance position comparing entitlements owned to licenses consumed ✓
- B. A network topology map
- C. A backup of the CMDB
- D. A list of failed login attempts
Why: Reconciliation compares owned entitlements against consumed licenses to yield the compliance position. It does not produce login logs, CMDB backups, or topology maps.
If consumed licenses exceed owned entitlements for a software model, what is the resulting compliance state?
- A. Retired
- B. Non-compliant (shortfall/exposure) ✓
- C. Compliant with surplus
- D. Allocated
Why: When consumption exceeds entitlements, the position shows a shortfall, indicating non-compliance and audit exposure. A surplus is the opposite case, while retired and allocated are unrelated states.
Which SAM feature recommends actions to resolve non-compliance, such as purchasing more licenses or reclaiming unused installs?
- A. Software remediation / remediation options ✓
- B. The knowledge feedback widget
- C. Incident SLA definitions
- D. The survey engine
Why: SAM remediation provides options to close compliance gaps, such as buying licenses, reallocating, or reclaiming unused installs. SLAs, surveys, and knowledge feedback are unrelated to license remediation.