CIS-SAM Study Guide: Certified Implementation Specialist, Software Asset Management (SAM Professional)

Trademark disclaimer: ServiceNow, Now Platform, and all related product and release names are trademarks of ServiceNow, Inc. This guide is an independent, original commercial exam-preparation work and is not affiliated with, endorsed by, or sponsored by ServiceNow, Inc. All factual content is grounded in publicly available official ServiceNow documentation and learning resources; see grounding.md for source URLs.

How to use this guide. Domains below are ordered by exam weight (heaviest first), so your study time tracks the blueprint. The two largest domains, Practical Management of Software Compliance (30%) and Data Integrity (28%), together account for well over half the exam, so master those first. Each section gives the concepts in original prose, followed by the platform mechanics and the common exam traps. A consolidated Fast-recall cheat list sits at the end.

Domain 3: Practical Management of Software Compliance (30%)

This is the largest domain and the heart of SAM Professional. The goal is to turn raw data into a defensible, reconciled license position and then act on it.

Entitlements, allocations, and use rights

An entitlement records what your organization is legally permitted to do with a software product: how many rights you purchased, the license metric that governs counting, the publisher/product, the purchase and contract references, and any upgrade, downgrade, or second-use rights. Entitlements are matched to software models so that rights line up with the licensable units that installations normalize to.

An allocation assigns specific rights from an entitlement to a particular user or device. Allocations matter most for named-user and per-device metrics, where the question "who/what is this license assigned to?" determines compliance. Use rights (upgrade/downgrade rights, multi-use, virtualization rights, and product use rights published by the vendor) modify how raw consumption is counted; for example, a license for a newer edition may cover an older installed edition through downgrade rights.

Reconciliation and the Effective License Position (ELP)

Reconciliation is the engine that compares rights owned (entitlements) against rights consumed (normalized installations and measured usage) for each software model, then produces a software model result with a compliance status (Compliant or Not Compliant) and the surplus or shortfall of rights. The reconciled output is the Effective License Position: the single number that tells you, per publisher and product, whether you have enough licenses.

Reconciliation depends on three things being correct: (1) installs normalized and matched to the right software model, (2) each entitlement carrying the correct license metric (the metric is a field on the entitlement, not on the software model), and (3) entitlements assigned to those models. Only licensable products under management are reconciled, and installs that were never normalized are not attributed to a product, so they drop out of the count. A frequent exam trap: an entitlement recorded with the wrong metric miscounts consumption, and the fix is on the entitlement.

True-up is the corrective purchase that closes a shortfall surfaced by the ELP; the reconciled position is what you take into a vendor true-up or audit defense. Surplus positions feed cost-optimization (harvesting and not re-buying).

License metrics

A license metric defines how consumption is counted. You must recognize the major families:

Per-device / per-installation: one right per installed copy or per machine.
Named user: one right per uniquely identified user; usage and allocation to users drive the count.
Concurrent user: rights consumed by simultaneous active users.
Per-core: count physical (or virtual) cores on the host; requires accurate CPU/core data on the device CI.
Core factor (Oracle): physical cores multiplied by a core factor taken from the vendor's core factor table (processor-type-dependent), then rounded per vendor rules. Oracle Processor licensing for Database and options (Partitioning, RAC, etc.) uses this on premises; in AWS or Azure, SAM counts vCPUs instead of applying the core factor table.
IBM PVU (Processor Value Unit): cores multiplied by a per-core PVU value from IBM's PVU table; total PVUs determine licenses. RVU (Resource Value Unit) is a related IBM metric.
Sub-capacity (an IBM PVU/RVU counting model, versus full capacity): licensing only the virtual capacity actually allocated (e.g., vCPUs in a VM) rather than full host (full-capacity) capacity, subject to vendor eligibility and tooling rules. Accurate VM-to-host relationships are essential.

Per-core, core-factor, PVU, and sub-capacity all break if the host's core count, processor type, or virtualization topology is wrong, which is why this domain leans heavily on the host CI being accurate.

Remediation

When the ELP shows exposure or waste, remediation closes the gap: reclaim unused installs (uninstall/harvest where usage data shows software unused), reassign harvested rights, purchase additional entitlements (true-up) where reclamation is insufficient, or apply use rights you had not been crediting. Software usage data (last-used date, run frequency) is the primary evidence for reclamation candidates.

Exam traps (Domain 3)

The license metric lives on the entitlement, not the software model. A wrong metric miscounts consumption: fix the entitlement, not the model.
Allocation (to a user/device) is distinct from entitlement (what you own). Multi-select questions test the difference.
Sub-capacity is not automatic; it requires correct virtualization data and vendor eligibility.
True-up is a purchase action driven by the reconciled shortfall, not a recount.

Domain 2: Data Integrity: Attributes and Sources (28%)

Compliance is only as trustworthy as the data feeding it. This domain is about getting clean, normalized, de-duplicated data into SAM.

Software discovery and normalization

Raw software is collected from inventory sources and lands as discovered software in installation records. Normalization turns each raw record (raw publisher/product/version strings, often messy like "Msft Corp") into a normalized software discovery model with a standard publisher, product, version, and edition, so that one real product no longer appears under many slightly different names. Reconciliation then matches normalized discovery models to software models using each model's criteria (publisher, product, version condition).

Discovery models that the normalization library cannot match get the normalization status Match Not Found (partial matches are Partially Normalized), and they can be manually normalized (status Manually Normalized). Best practice is to keep the normalization library current with Content Service updates so the bulk of normalization happens automatically and ongoing.

The Content Service

The SAM Content Service is an optional ServiceNow cloud service that keeps the normalization library (publishers, products, and normalization rules) and lifecycle (EOL/EOS) data current. Subscribing means customers do not hand-build normalization content. License metrics ship out of the box and with publisher packs, which are separate add-on plugins, not Content Service content. Newly applied content normalizes future and re-processed installs; it does not retroactively change already-completed reconciliation results until reconciliation reruns, a common exam point.

Data sources

SAM consumes software inventory and usage from multiple sources:

ServiceNow Discovery (agentless, MID Server based) and Agent Client Collector.
Microsoft SCCM / Configuration Manager via the Service Graph Connector for SCCM (and the SCCM Software Usage plugin for usage/metering data).
Microsoft Intune via the Service Graph Connector for Intune (modern/mobile and remote endpoints).
Other third-party inventory tools.

When the same device arrives from multiple sources (e.g., Discovery and SCCM), CMDB Identification and Reconciliation (IRE) uses identification rules to match and de-duplicate so you do not get duplicate CIs or double-counted installs. Data source precedence decides which source "wins" for a given attribute.

Attributes that drive counting

License metric on the entitlement: decides how consumption is counted for the rights you own.
Host/device CI link on each install: ties consumption to a machine; essential for per-core.
CPU / core count and processor type on the host: essential for per-core, core-factor, and PVU.
VM-to-host relationship: essential for sub-capacity and cluster-wide Oracle/IBM counts.
User reference on the install: essential for named-user metrics.
Edition and version: affect which software model and entitlement apply and which use rights are available.

Exam traps (Domain 2)

Unnormalized installs cause undercounting; the root cause of a low count is usually "installs not normalized," not "entitlement missing."
Duplicate installs from two sources inflate counts; resolve via IRE/identification rules, not by deleting one source blindly.
Missing core/CPU data on hosts silently corrupts per-core/PVU/Oracle positions.
Missing user reference breaks named-user reconciliation.
A Content Service update normalizes data but does not rewrite past reconciliation results automatically; reconciliation must rerun.

Domain 1: Software Asset Core Overview & Fundamentals (14%)

SAM Professional is the dedicated application that ingests software discovery data, manages entitlements, and produces a reconciled compliance position. It sits on top of the CMDB (which stores the CIs SAM consumes) and works alongside Hardware Asset Management (HAM) and ITSM, but only SAM reconciles software licenses.

The data hierarchy: Publisher → Product → Software Model. One publisher offers many products; one product can have many software models (different versions/editions). A software model is the licensable unit (a specific edition/version of a product) and is what both installations (via normalization) and entitlements link to.

The pipeline: discover/import software → normalize discovered software (normalization library, kept current by the Content Service) and match it to software models → match entitlements to models → reconcile → produce the Effective License Position → remediate. The business outcome of reconciliation is the comparison of owned vs. consumed, revealing compliance, surplus, or audit exposure.

Core capabilities of SAM Pro include software normalization, entitlement and contract management, license reconciliation/ELP, software usage and reclamation, lifecycle (EOL/EOS) insight, and SaaS license management.

Exam traps (Domain 1)

The CMDB stores CI data SAM consumes; it does not itself reconcile licenses.
Software model = edition/version (licensable unit), not a server, contract line, or discovery probe.
Know the direction of the hierarchy (publisher → product → model), not the inverse.

Domain 5: Extending SAM (15%)

SAM for SaaS / SaaS License Management

SAM extends beyond on-prem installs to SaaS subscriptions. SaaS License Management integrates with cloud providers, most notably Microsoft 365 (Office 365) and Adobe Creative Cloud, to pull subscription entitlements and actual usage (active vs. inactive accounts, last-activity). The value is identifying unused or under-used SaaS subscriptions for reclamation/downgrade and right-sizing renewals, mirroring on-prem reconciliation but for subscription seats. Dashboards (e.g., the Office 365 & Adobe Cloud dashboard) and the license usage view / workbench surface optimization candidates. Compliance compares the rights you own with assigned subscriptions (true-up cost); activity thresholds in reclamation rules flag stale subscriptions for reclamation.

Publisher packs

Publisher packs are add-on plugins (for example Adobe, Citrix, IBM, Microsoft, Oracle, SAP, VMware, and Engineering Applications) that add publisher-specific license metrics, reconciliation logic, and Software Publisher Analytics dashboards for complex licensing (for example Oracle options or IBM PVU). They do not supply normalization content; normalization comes from the normalization library and Content Service updates.

Software model lifecycle and retirement

SAM keeps lifecycle data for products and versions as phases such as General Availability, End of Support (EOS), End of Extended Support, and End of Life (EOL), often supplied by the Content Service. This drives risk reporting (unsupported software), refresh planning, and model retirement.

CMDB / CSDM alignment

SAM data must align to the Common Service Data Model (CSDM): software installs reference host CIs, and software models map cleanly. Good CSDM/CMDB alignment is what makes per-core, virtualization, and reclamation calculations trustworthy.

Exam traps (Domain 5)

SaaS management uses actual usage / activity to find waste, not just seat counts.
Publisher packs improve accuracy for specific vendors; they are not generic.
Lifecycle (EOL/EOS) is largely content-driven and is recorded as product and version lifecycle phases.

Domain 4: Operational Integration of Software Processes (13%)

This domain connects SAM to ongoing IT operations and other ServiceNow processes.

Inventory and usage integrations

SCCM integration: import software inventory and usage via the Service Graph Connector for SCCM; the SCCM Software Usage plugin brings metering/usage data used for reclamation.
Intune integration: import modern/remote-endpoint inventory via the Service Graph Connector for Intune.
Reclamation rules: rules (including SCCM-usage-driven rules) identify unused installs and can trigger software installation optimization and removal (reclaim) workflows, often via Flow or requests to uninstall.

Cadence and operations

Run discovery, content updates, and reconciliation on a regular cadence so the ELP stays current; content changes only take effect on the next normalization/reconciliation run.
Troubleshoot failed SCCM/Intune imports by checking source-record completeness (missing required fields), connector configuration, and import/transform logs.

Procurement and contracts

Entitlements link to contracts and procurement records (purchase orders, software contracts, maintenance/support agreements). This ties owned rights to commercial reality, supports renewal management, and feeds true-up decisions.

Exam traps (Domain 4)

Usage/metering for reclamation typically comes from the SCCM Software Usage data, not bare inventory.
Content/discovery changes require a rerun to affect results; scheduling cadence matters.
First troubleshooting step for failed imports is usually source data / required fields, then connector config.

Fast-recall cheat list

Hierarchy: Publisher → Product → Software model (licensable unit = edition/version).
Pipeline: Discover/import → normalize to software model → match entitlements → reconcile → Effective License Position (ELP) → remediate.
Content Service = optional ServiceNow cloud service that keeps the normalization library and EOL/EOS lifecycle data current. Subscribe for automatic, ongoing normalization. Publisher packs are separate add-on plugins that add publisher-specific license metrics, reconciliation, and dashboards.
Normalization maps messy raw strings to normalized discovery models; unmatched ones get Match Not Found and can be manually normalized.
Entitlement = what you own (with metric, use rights). Allocation = rights assigned to a specific user/device. Use rights = upgrade/downgrade/multi-use that change the count.
Reconciliation compares owned vs. consumed per software model → Compliant or Not Compliant, with surplus or shortfall. The license metric is set on the entitlement, not the model.
Metrics: per-device, named user, concurrent user, per-core, Oracle core factor (core factor table), IBM PVU (PVU table) / RVU, sub-capacity (virtual capacity, needs VM-host data).
ELP drives true-up (close shortfall) and harvesting (use surplus).
Reclamation uses usage data (last-used) to find unused installs; SCCM Software Usage is the common usage source.
Data sources: ServiceNow Discovery (MID Server), Agent Client Collector, SCCM (Service Graph Connector + Software Usage), Intune (Service Graph Connector), third-party tools.
De-dup across sources via CMDB IRE / identification rules; data source precedence decides winning attributes.
Per-core / Oracle / PVU require accurate CPU/core count, processor type, VM-to-host on the host CI.
Named user requires the user reference on the install.
SAM for SaaS: integrates Microsoft 365 and Adobe Creative Cloud; compliance compares owned rights with assigned subscriptions, and activity data finds stale subscriptions for reclamation/right-sizing.
Lifecycle: EOL/EOS largely content-driven; recorded as product and version lifecycle phases (GA, End of Support, End of Extended Support, End of Life).
CSDM/CMDB alignment underpins trustworthy per-core, virtualization, and reclamation results.
Applying new normalization content (a Content Service update) normalizes future/re-processed installs but does not rewrite completed reconciliation until it reruns.
Cadence: schedule discovery + content updates + reconciliation regularly to keep the ELP accurate.