SAM Needs to Operate in Run-Time

I recently finished a strategic engagement for a client who was looking for guidance on which processes would offer biggest bang for their buck.?

They too, had been through the experience of having invested in technology to make SAM go away, only to find out that this doesn’t work.?

Next, they decided to call in resellers to provide them with ELPs as audits and contract renewals loomed large.?Once more, they found out that knowing where you stand with a given vendor doesn’t provide you with a roadmap to get that ELP better – nor will it fix deep-rooted issues you have with other software vendors.?

I’m a huge fan of FinOps, as much for its practicality in defining what the discipline is and how best to resolve cost management in the cloud. ?

But what got me thinking about writing a new article was the recent announcement by the US OMB stating that all US government departments had to provide an inventory of all third party software on their IT estates following on from the SolarWinds breach of 2020.

Foundation-level inventory is going to answer that age-old observation of “You can’t manage what you don’t measure”.

Post-baselining inventory is where SAM should leap into the fore, and start making calls for recycling.?DO NOT fall into the well-trodden routine of thinking that an ELP/ Compliance Position is going to provide you with that “aha” moment of IT operations – it won’t.

Instead, set about making the core data for that ELP better from the outset - I return to an analogy I used about six months ago on LinkedIn:?

If you assembled all the ingredients you needed to bake a cake, and then you found out that the eggs were off, would you carry on baking the cake on the off-chance that the cake would turn out ok?

Recycling/ uninstalling software affords you the opportunity to:

• Lower patching and version control overheads on unused software
• Lower support overheads on those esoteric editions and versions of software that require legacy knowledge to maintain
• Lower threat vectors with a reduced number of points of entry and exit to the IT estate
• Reduce compliance risk! If uninstalled software was also unlicensed, then your compliance woes are instantly reduced
• Further reduce compliance risk! If uninstalled software was licensed, then those licenses can be reapplied to used installations that are unlicensed

But we’re not finished! Now that we have removed a lot of “dead wood” our next step should be to rationalize the titles we have installed:?How many flavours of Linux do we need on our IT estate? How many pdf readers? – the list goes on – what we are looking to do here is to reduce the quantity of software titles by classification/ operation.

Rationalising software affords you the opportunity to:

• Further reduce patching and version control overheads
• Further reduce knowledge management overheads in respect technical support
• Drive economies of scale and reduce contractual management overhead
• Make compliance easier to manage through a reduction in effort finding governing contracts and purchasing evidence

Finally (and this is an ISO-nerd special!) qualify the boundary of operation for your SAM scope – the ISO-esoteric term to be used here is the qualification of our “Statement of Applicability”. If areas of your business operate to their own flavour of IT operations then cut them loose! But be crystal clear on any reporting that your SAM reports exclude “Division X, or Cost Center Y”.

Now you can go and generate your compliance reports ??

A further point to note about the recommended approach above – this is not a one-time activity; returning to our FinOps framework mentioned above, in this domain you are operating in per-minute billing cycles, so time is money.?Recycling in the cloud is OPEX-reducing, recycling on-site is CAPEX-reducing.?Recycling in the cloud won’t make you any more or less compliant, but it will make you more cash-efficient.

I ended off the report with a thought whirring in my head:?SAM needs to operate in run-time.?Failure to maintain your SAM health will result in ill-defined contracts and your organisation being corralled to strike a good deal within the terms and conditions of a software contract – at which point you are bound over by the restrictions and limitations a software vendor is prepared to grant you.

What did I do with that final thought??Put an explaining paragraph around it and talk it to death??No, I typed it out, centered it and increased the font size to 14 before putting it in bold.

SAM needs to operate in run-time.