Software Licence and Contract Technical Review: [Product or contract name]
Technical review of the licences and contract terms behind a piece of
commercial or open source software in a solution: products and
editions, licence metrics, the effective licence position (deployment
against entitlement), virtualisation, container and cloud rules, open
source obligations by SPDX identifier, audit and verification clauses,
support and SLA terms, data and exit terms, risks and negotiation
positions. Structure aligned with ISO/IEC 19770-1:2017 (IT asset
management systems, with Amd 1:2024), the entitlement schema concept of
ISO/IEC 19770-3:2016 and SPDX 3.0.1 (ISO/IEC 5962:2021 is the ISO
edition of SPDX 2.2.1) for licence identifiers. Replace every
[bracketed] value and every row marked Example. This is a
documentation format, not legal advice: contract interpretation belongs
to your legal counsel.
Document control
| Field | Value |
|---|
| Document ID | [SLR-001] |
| Vendor or licensor | [Vendor legal entity name] |
| Contract references | [Master agreement ID], [Order form IDs], [Product terms version and date] |
| Products in scope | [Product A edition], [Product B edition] |
| Solution or programme | [Solution name and ID] |
| Review trigger | [Design approval / Signature / Renewal / Platform migration / Audit notice] |
| Version | [0.1] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@solution-architect] |
| Approvers/reviewers | [@itam-manager], [@procurement-lead], [@legal-counsel], [@security-architect] |
| Contract term and renewal date | YYYY-MM-DD to YYYY-MM-DD, notice by YYYY-MM-DD |
| Classification | [Confidential: commercial terms] |
| Last updated | YYYY-MM-DD |
Approvals
| Role | Name | Decision | Date |
|---|
| Solution architect | [@name] | [Approve / Approve with conditions / Reject] | YYYY-MM-DD |
| IT asset manager | [@name] | [Decision] | YYYY-MM-DD |
| Procurement | [@name] | [Decision] | YYYY-MM-DD |
| Legal counsel | [@name] | [Decision] | YYYY-MM-DD |
| Budget owner | [@name] | [Decision] | YYYY-MM-DD |
Revision history
| Version | Date | Author | Change summary |
|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft from order forms and deployment data |
| 0.2 | YYYY-MM-DD | [@name] | Example: Added cloud rules after vendor clarification letter |
| 1.0 | YYYY-MM-DD | [@name] | Example: Approved; negotiation positions sent to procurement |
Contents
1. Scope and review method
1.1 Scope
| In scope | Out of scope |
|---|
| Example: Database Server Enterprise edition and options, all environments, entities A and B | Desktop productivity software (separate review) |
| Example: Open source components shipped inside the customer-facing application | Open source tools used only on developer workstations |
| [Item] | [Item] |
1.2 Review method
- Collect the contract set (section 2) and record the order of precedence between documents.
- Extract each metric definition and its counting rule word for word into your working notes (do not paste vendor text into this document if it is confidential), then summarise it in section 3.
- Collect deployment evidence from discovery tools, cloud inventories, hypervisor exports and the CMDB; date every extract.
- Compute the effective licence position per product and metric (section 4).
- Apply the virtualisation and cloud rules (section 5) and recompute where they change the count.
- Scan the software bill of materials for open source licences (section 6).
- Review audit, support, data and exit terms (sections 7 to 10).
- Rate findings (section 11) and agree recommendations (section 12) with procurement and counsel.
1.3 Evidence register
| ID | Evidence | Source system | Extract date | Owner |
|---|
| EV-001 (Example) | Hypervisor host and cluster export with CPU model, sockets, cores | Virtualisation manager | YYYY-MM-DD | [@infra-lead] |
| EV-002 (Example) | Installed software discovery report | Discovery agent | YYYY-MM-DD | [@itam-manager] |
| EV-003 (Example) | Identity provider export of users assigned to the application | Identity provider | YYYY-MM-DD | [@iam-lead] |
| EV-004 (Example) | SBOM of release 4.2 in SPDX 3.0.1 JSON-LD | Build pipeline | YYYY-MM-DD | [@dev-lead] |
| [EV-NNN] | [Evidence] | [System] | YYYY-MM-DD | [@owner] |
2. Contract documents and entitlements
2.1 Contract set and order of precedence
| Rank | Document | Version or date | Incorporated by reference? | Notes |
|---|
| 1 (Example) | Order form 2026-03 | Signed YYYY-MM-DD | No | Quantities, prices, term |
| 2 (Example) | Master licence agreement | Version [n], signed YYYY-MM-DD | No | Audit, liability, termination |
| 3 (Example) | Product-specific licensing terms | Dated [month year] | Yes, version at order date | Metric definitions |
| 4 (Example) | Vendor partitioning or cloud policy document | Dated [month year] | [Yes / No / Unclear: ask counsel] | Virtualisation rules |
| [n] | [Document] | [Version] | [Yes / No] | [Notes] |
2.2 Entitlement record
Record each entitlement in the shape the ISO/IEC 19770-3 entitlement schema expects: who owns the right, for which product and version, under which metric, how many units, for which period, with which restrictions. A machine-readable entitlement record makes reconciliation repeatable.
| Entitlement ID | Product, edition, version | Metric | Quantity | Licence type | Term | Use restrictions | Proof of entitlement |
|---|
| ENT-001 (Example) | Database Server Enterprise 19 and later | Processor core (with core factor) | 48 | Perpetual | From YYYY-MM-DD | Named entities A and B; country list in schedule 2 | Order form 2026-03 line 1 |
| ENT-002 (Example) | Database Partitioning option | Processor core | 32 | Perpetual | From YYYY-MM-DD | Must match the base licence metric on the same hosts | Order form 2026-03 line 3 |
| ENT-003 (Example) | Reporting suite | Named user | 1,000 | Subscription | 3 years | Internal users only; no external access | Order form 2026-03 line 5 |
| ENT-004 (Example) | Observability SaaS | Host per month | 500 | Subscription | 1 year | Overage billed monthly at list price | Order form 2026-04 |
| ENT-005 (Example) | PDF rendering library 3.1, commercial edition | Server instance | 2 | Subscription | 1 year | Server-side rendering service only | Order form 2026-05 |
| [ENT-NNN] | [Product] | [Metric] | [Qty] | [Perpetual / Subscription / Term] | [Term] | [Restrictions] | [Proof] |
2.3 Entitlement quality checks
- Every entitlement has a proof document (order form, invoice and licence certificate) and the document is stored in the ITAM repository.
- Perpetual licences with lapsed support are flagged: many vendors restrict version upgrades or reinstatement without back-support fees.
- Entitlements acquired through mergers are checked for assignment rights: the licence may not have transferred to the surviving entity.
- Entitlements bought by one legal entity and used by another are checked against the affiliate definition in the master agreement.
3. Licence metrics
3.1 Metric catalogue
| Metric ID | Metric | Unit counted | Counting rule summary (own words) | Peak or point in time | Clause |
|---|
| MET-001 (Example) | Processor core with core factor | Physical cores on every host where the software is installed or runs | Multiply cores by the vendor core factor for the CPU family; round up | Highest count during the measurement period | Product terms section [n] |
| MET-002 (Example) | Named user | Distinct individuals authorised to use the software | Authorised, not active; device-sharing does not reduce the count | Point in time at audit | Product terms section [n] |
| MET-003 (Example) | Concurrent user | Sessions open at the same moment | Licence server enforces the cap | Peak | Product terms section [n] |
| MET-004 (Example) | Virtual CPU or virtual machine | vCPUs assigned to VMs running the software | Counted per VM; hyper-threading may count each thread | Peak | Cloud policy section [n] |
| MET-005 (Example) | Subscription seat | Seats assigned in the SaaS admin console | Reassignment allowed after [n] days | At invoice date | Order form |
| MET-006 (Example) | Consumption | Usage units such as host-hours, API calls, GB ingested | Billed in arrears; commitment drawn down first | Continuous | Order form |
| [MET-NNN] | [Metric] | [Unit] | [Rule] | [Peak / Point] | [Clause] |
3.2 Metric behaviour under change
| Architectural change | Metric affected | Typical effect | Check |
|---|
| Add a disaster recovery site with a standby copy | Core, VM | A standby copy is often licensable unless the contract grants a failover right with a day limit | Read the failover clause; record the day limit |
| Move from VMs to containers on a shared cluster | Core, vCPU | Counting may extend to every node the container can be scheduled on | Confirm whether node pinning or a vendor-approved container policy limits the count |
| Expose an internal application to partners | Named user, internal-use restriction | External users may be prohibited or need a different licence type | Check the definition of user and permitted use |
| Add an integration that reads from the product | Indirect use or multiplexing | Users behind middleware may count as users of the product | Check indirect access and multiplexing clauses |
| Replace on-premises hosts with newer CPUs | Core factor | Higher core counts per socket raise the licence count | Recompute section 4 before purchase |
| Scale out on a public cloud | vCPU, consumption | Elastic peaks may set the licence count | Agree whether averages or peaks apply |
4. Deployment versus entitlement
4.1 Effective licence position
Example calculation for MET-001: four database hosts with two sockets of 16 cores each give 4 x 2 x 16 = 128 physical cores. With an illustrative core factor of 0.5, the requirement is 128 x 0.5 = 64 licences. ENT-001 holds 48, so the shortfall is 16. The partitioning option (ENT-002, 32 licences) runs on the same four hosts and also needs 64, so its shortfall is 32.
| Line | Product and metric | Deployed quantity | Rule applied | Required | Owned | Position | Evidence |
|---|
| ELP-001 (Example) | Database Server Enterprise, MET-001 | 128 cores on 4 hosts | Core factor 0.5 (illustrative) | 64 | 48 | Shortfall 16 | EV-001, EV-002 |
| ELP-002 (Example) | Partitioning option, MET-001 | 128 cores on the same 4 hosts | Option follows base metric | 64 | 32 | Shortfall 32 | EV-001, EV-002 |
| ELP-003 (Example) | Reporting suite, MET-002 | 1,180 authorised users | Authorised individuals | 1,180 | 1,000 | Shortfall 180 | EV-003 |
| ELP-004 (Example) | Observability SaaS, MET-006 | 430 hosts average, 520 peak | Billed on monthly peak | 520 | 500 | Overage 20 | Vendor console export |
| [ELP-NNN] | [Product, metric] | [Qty] | [Rule] | [n] | [n] | [Surplus / Shortfall / Balanced] | [EV-NNN] |
4.2 Financial exposure
Use list prices from the contract or price list only for exposure; the negotiated price is a later step. Mark every number as an estimate.
| Line | Shortfall units | Unit licence price | Licence exposure | Annual support rate | Back-support exposure (years) | Total exposure |
|---|
| ELP-001 (Example) | 16 | USD 47,500 | USD 760,000 | 22% (USD 167,200 per year) | 2 years: USD 334,400 | USD 1,094,400 |
| ELP-003 (Example) | 180 | USD 400 per user per year | USD 72,000 per year | Included | Not applicable | USD 72,000 per year |
| [ELP-NNN] | [n] | [Price] | [Amount] | [Rate] | [Amount] | [Amount] |
4.3 Surplus and shelfware
| Line | Product | Owned | Used | Unused | Unused share | Action |
|---|
| SHF-001 (Example) | Collaboration SaaS seats | 500 | 430 | 70 | 14% | Reduce at renewal; reharvest after 60 days inactivity |
| [SHF-NNN] | [Product] | [n] | [n] | [n] | [%] | [Action] |
5. Virtualisation, container and cloud rules
5.1 Partitioning and virtualisation
| Rule ID | Situation | Rule as understood (own words) | Source and date | Confidence | Question for vendor |
|---|
| VR-001 (Example) | Software in VMs on a shared hypervisor cluster | Vendor treats soft partitioning as not limiting; all physical cores in the cluster where the VM could run may count | Vendor partitioning policy, dated [month year] | Medium: policy may not be contractual | Is the policy incorporated into our contract? |
| VR-002 (Example) | Hard partitioning on approved technologies | Counting limited to cores assigned to the partition | Same policy, section [n] | High | None |
| VR-003 (Example) | Live migration between clusters | Every cluster the VM can move to may count | Same policy | Medium | Does a technical block on migration limit the count? |
| VR-004 (Example) | Containers on a shared orchestration cluster | Count may follow nodes where the workload can be scheduled | No vendor document found | Low | Check with the vendor; request written confirmation |
| [VR-NNN] | [Situation] | [Rule] | [Source] | [High / Medium / Low] | [Question] |
5.2 Public cloud and bring your own licence
Cloud rules come in three families. Classify each product before you design the target platform.
- Licence included: the cloud provider's price includes the licence; no entitlement is consumed, but you cannot reuse the licence elsewhere.
- Bring your own licence (BYOL) or licence mobility: existing entitlements are applied to cloud instances under the vendor's rules. Rules typically restrict which providers are "authorised", how vCPUs convert to licences, whether dedicated hosts are required and whether active support is a precondition.
- Marketplace or subscription: the vendor sells a cloud-specific subscription through the provider's marketplace, billed with cloud consumption.
| Rule ID | Product | Target platform | Family | Conversion or condition (own words) | Source and date | Check with vendor |
|---|
| CR-001 (Example) | Database Server Enterprise | Public cloud provider X, shared tenancy | BYOL | Vendor policy counts a fixed number of vCPUs per licence on named authorised clouds | Vendor cloud policy, dated [month year] | Confirm provider X is on the authorised list on the signature date |
| CR-002 (Example) | Operating system | Public cloud provider X | Licence included | Pay per instance-hour; existing entitlements not reused | Provider price page, checked YYYY-MM-DD | Not needed |
| CR-003 (Example) | Application server | Dedicated hosts | BYOL with dedicated host | Licence follows physical cores of the dedicated host | Product terms section [n] | Confirm whether outsourcer-managed dedicated hosts are permitted |
| [CR-NNN] | [Product] | [Platform] | [Family] | [Condition] | [Source] | [Question] |
5.3 Design implications
| Design option | Licences required | Annual cost (estimate) | Licensing risk | Recommendation |
|---|
| Example: Keep databases on a dedicated four-host cluster with hard partitioning | 32 core licences (hard partition limits the database to 64 of the 128 cores; 64 x 0.5 = 32) | USD [amount] | Low | Preferred if capacity fits |
| Example: Run databases on the shared 12-host cluster | 192 core licences | USD [amount] | High: soft partitioning dispute | Reject |
| Example: Move to the cloud provider's managed service with licence included | 0 owned licences consumed | USD [amount] | Low licensing risk, higher run cost | Compare in the TCO analysis |
6. Open source licences and obligations
6.1 Distribution model
| Question | Answer | Effect |
|---|
| Is the software distributed to third parties (download, device, on-premises install)? | [Yes / No] | Distribution triggers notice and, for copyleft licences, source offer obligations |
| Is it offered only as a hosted service? | [Yes / No] | Most copyleft obligations do not trigger, except network-copyleft licences such as AGPL-3.0 |
| Are components modified? | [Yes / No] | Modification of copyleft files usually extends source obligations to the changes |
| Are components linked statically or dynamically? | [Static / Dynamic / Both] | Relevant to weak-copyleft licences such as LGPL; ask counsel |
6.2 Licence categories
| Category | Typical SPDX identifiers | Main obligations (own words) | Default policy |
|---|
| Permissive | MIT, BSD-3-Clause, Apache-2.0 | Keep copyright and licence notices; Apache-2.0 adds a patent licence, a NOTICE file and change notices | Allowed |
| Weak copyleft | LGPL-2.1-only, MPL-2.0, EPL-2.0 | Share source of the covered files or library, including modifications; allow relinking where required | Allowed with review |
| Strong copyleft | GPL-2.0-only, GPL-3.0-or-later | Distribution of a combined work may require source for the whole work under the same licence | Review by counsel before use in distributed products |
| Network copyleft | AGPL-3.0-only | Users interacting over a network may be entitled to the source of the modified program | Not allowed in hosted products without approval |
| Source-available, not open source | BUSL-1.1, SSPL-1.0 | Usage restrictions, for example on offering a competing service; not OSI approved | Treat as commercial; legal review required |
| Exceptions | Classpath-exception-2.0, LLVM-exception | Narrow the copyleft effect for linking; write as GPL-2.0-only WITH Classpath-exception-2.0 | Record the full expression |
6.3 Component licence register
| Component ID | Component and version | Declared licence (SPDX expression) | Concluded licence | Use | Modified? | Obligation | Status |
|---|
| OSS-001 (Example) | HTTP client library 5.2 | Apache-2.0 | Apache-2.0 | Bundled in mobile app | No | Include licence and NOTICE in app "About" screen | Met |
| OSS-002 (Example) | PDF rendering library 3.1 | AGPL-3.0-only OR LicenseRef-Commercial | LicenseRef-Commercial | Server-side rendering service | No | Commercial licence purchased to avoid AGPL source obligation | Met: ENT-005 |
| OSS-003 (Example) | Image codec 2.0 | LGPL-2.1-only | LGPL-2.1-only | Dynamically linked in desktop client | No | Provide source offer and allow relinking | Open: source offer missing |
| OSS-004 (Example) | Search engine 8.x | SSPL-1.0 OR LicenseRef-Vendor-Source-Available | Not concluded | Self-hosted search cluster | No | Usage restriction review | Open: legal review |
| [OSS-NNN] | [Component] | [Expression] | [Expression] | [Use] | [Yes / No] | [Obligation] | [Met / Open] |
Record the declared licence (what the package states) and the concluded licence (what your review found) separately, as SPDX does. Generate this register from the SBOM rather than by hand; see Software Supply Chain Security (security/supply-chain-security).
7. Audit and verification clauses
7.1 Audit terms
| Term | Contract position (own words) | Clause | Risk | Negotiation target |
|---|
| Right to audit | Example: Vendor or its appointed auditor may verify use | MLA [n] | Medium | Independent auditor bound by confidentiality |
| Frequency | Example: Once per 12 months | MLA [n] | Low | Not more than once per 24 months |
| Notice period | Example: 45 days written notice | MLA [n] | Low | 60 days |
| Method | Example: Self-declaration or vendor scripts | MLA [n] | Medium | Customer runs scripts; reviews output before sharing |
| Cost | Example: Customer pays audit costs if shortfall exceeds 5% | MLA [n] | High | Vendor pays unless material shortfall; define "material" |
| Remedy for shortfall | Example: Purchase at current list price plus back support | MLA [n] | High | Purchase at contract discount; no back support beyond 12 months |
| Data collected | Example: Not limited | MLA [n] | Medium | Limit to licence-relevant data; no personal data beyond user counts |
7.2 Audit response process
- Acknowledge the letter within the contract period; do not agree to scope or method in the first reply.
- Route the letter to the ITAM manager, legal counsel and procurement; appoint one point of contact.
- Freeze changes that would alter the licensable estate, unless they reduce risk.
- Compute the internal ELP (section 4) before sharing any data with the auditor.
- Review every script and data request; share only what the contract requires.
- Reconcile the auditor's draft findings line by line against the evidence register.
- Negotiate settlement as a commercial matter, linked to future needs where possible.
- Record lessons learned and update controls (section 13).
7.3 Audit readiness checklist
8. Support, maintenance and SLA terms
| Term | Contract position | Solution requirement | Gap | Action |
|---|
| Support tier and hours | Example: Premier, 24x7 for severity 1 | 24x7 for production incidents | None | None |
| Response time, severity 1 | Example: 1 hour | 30 minutes for P1 per the solution SLA | 30 minutes | Hold first-line capability internally; record in the SLA |
| Resolution or workaround target | Example: Not committed, "reasonable efforts" | Workaround within 4 hours | Not covered | Request a committed workaround target or accept risk |
| Security patches | Example: Included for supported versions | Critical fixes within 14 days | None if on supported versions | Track version lifecycle |
| Version lifecycle | Example: Premier support 5 years from release, extended support at extra cost | Run version [n] until YYYY | Extended support needed from YYYY | Plan upgrade or budget extended support |
| Support price increase | Example: Up to 8% per year | Budget assumes 3% | 5 points | Negotiate a cap |
| Service credits (SaaS) | Example: 10% monthly fee below 99.5% availability | 99.9% end to end | Credits do not cover business loss | Design for resilience; credits are not a remedy |
| Reinstatement after lapse | Example: Back fees plus penalty | Continuous support | None if renewed on time | Diary the notice date |
8.1 Support SLA dependency check
The availability that a vendor commits for a SaaS dependency caps the availability you can promise for the solution. For two serial dependencies at 99.9% and 99.5%, the combined availability is about 0.999 x 0.995 = 0.994, so 99.4% before your own components. Record the result in Service Level Agreement (ops/service-level-agreement).
9. Data, security and exit terms
9.1 Data and security terms
| Topic | Contract position | Requirement | Gap and action |
|---|
| Data location and transfers | Example: EU and US regions, subprocessors listed online | EU only for personal data | Confirm region pinning; see Data Residency and Sovereignty Assessment (compliance/data-residency-sovereignty-assessment) |
| Data processing agreement | Example: Vendor standard DPA | Required for personal data | Counsel to review |
| Security certifications | Example: ISO/IEC 27001 certificate, SOC 2 Type II report | Annual evidence | Request in the supplier security assessment |
| Breach notification | Example: "Without undue delay" | 24 hours to support regulatory reporting | Negotiate a fixed period |
| Vendor telemetry from installed software | Example: Usage statistics sent by default | No outbound data from production without approval | Confirm opt-out and document the setting |
| Escrow for critical on-premises software | Example: Not offered | Required for tier 1 systems | Request escrow or accept risk |
9.2 Exit terms
| Topic | Contract position | Requirement | Gap and action |
|---|
| Termination for convenience | Example: Not allowed during the initial term | Ability to exit at 12 months notice | Negotiate or accept lock-in with a documented reason |
| Data export | Example: CSV export via admin console | Full export including attachments and audit logs in an open format | Test export in the proof of concept |
| Post-termination access | Example: 30 days read-only | 90 days | Negotiate |
| Data deletion certificate | Example: On request | Required | Add to the exit plan |
| Transition assistance | Example: Professional services at standard rates | Rates fixed in the contract | Negotiate a rate card |
| Perpetual licence after support ends | Example: Use continues; no updates | Acceptable for a [n]-month transition | Record the security patch gap risk |
10. Commercial and renewal terms
| Term | Contract position | Architectural relevance | Action |
|---|
| True-up | Example: Annual true-up of growth at contract price | Growth in users or cores is billed each year | Feed the capacity plan into the budget |
| Price protection | Example: Unit prices fixed for 12 months | Later expansion at list | Negotiate 36 months |
| Commitment and drawdown | Example: USD 300,000 per year committed consumption | Under-use is lost; overage billed at list | Size the commitment from the capacity plan at the 50th percentile |
| Licence transfer and reassignment | Example: Reassignment allowed once per 90 days | Affects named-user models and staff turnover | Implement a reharvest process |
| Affiliate and outsourcer use | Example: Affiliates only; outsourcers need consent | Managed service providers may need written consent | Request consent before outsourcing |
| Change of platform | Example: Licence tied to on-premises metric | Cloud migration may require conversion | Negotiate a conversion right |
| Renewal notice | Example: 90 days before term end | Auto-renewal at list price otherwise | Diary YYYY-MM-DD |
11. Findings and risk register
| Finding ID | Section | Finding | Likelihood (1-5) | Impact (1-5) | Score | Exposure estimate | Owner | Due |
|---|
| SLR-F-001 (Example) | 4.1 | Core licence shortfall of 16 on the database cluster | 4 | 5 | 20 | USD 1,094,400 (ELP-001) | [@itam-manager] | YYYY-MM-DD |
| SLR-F-002 (Example) | 4.1 | Partitioning option deployed on all hosts but needed on one | 4 | 4 | 16 | Shortfall 32 licences | [@dba-lead] | YYYY-MM-DD |
| SLR-F-003 (Example) | 5.1 | Database VMs can live-migrate into the shared cluster | 3 | 5 | 15 | Up to 192 licences required | [@infra-lead] | YYYY-MM-DD |
| SLR-F-004 (Example) | 6.3 | LGPL source offer missing for the desktop client | 3 | 3 | 9 | Remediation effort only | [@dev-lead] | YYYY-MM-DD |
| SLR-F-005 (Example) | 9.2 | Data export lacks audit logs | 2 | 4 | 8 | Exit risk | [@solution-architect] | YYYY-MM-DD |
| [SLR-F-NNN] | [Section] | [Finding] | [1-5] | [1-5] | [L x I] | [Amount] | [@owner] | YYYY-MM-DD |
12. Recommendations and negotiation positions
12.1 Technical remediation
| Rec ID | Finding | Remediation | Effect on position | Effort | Owner |
|---|
| REC-001 (Example) | SLR-F-002 | Disable the partitioning option on three hosts that do not use it and remove its binaries | Requirement drops from 64 to 16; surplus of 16 | 2 days | [@dba-lead] |
| REC-002 (Example) | SLR-F-003 | Pin database VMs to the dedicated cluster with a technical control and document it | Removes shared-cluster exposure if the vendor accepts the control | 1 day plus vendor confirmation | [@infra-lead] |
| REC-003 (Example) | SLR-F-001 | Consolidate onto three hosts with higher clock speed and fewer cores | Requirement 3 x 2 x 12 x 0.5 = 36; surplus of 12 against 48 | Hardware refresh | [@infra-lead] |
| REC-004 (Example) | SLR-F-004 | Add written source offer and relinking instructions to the installer | Obligation met | 3 days | [@dev-lead] |
| [REC-NNN] | [Finding] | [Remediation] | [Effect] | [Effort] | [@owner] |
12.2 Negotiation positions
| Position ID | Topic | Opening position | Acceptable fallback | Walk-away | Linked findings |
|---|
| NEG-001 (Example) | Cloud conversion right | Convert on-premises core licences to the authorised cloud at the policy ratio, written into the order form | Conversion for 3 years with option to revert | No conversion and no price protection | SLR-F-001, CR-001 |
| NEG-002 (Example) | Audit costs | Vendor pays audit costs in all cases | Customer pays only above a 10% shortfall | Unlimited customer cost | Section 7.1 |
| NEG-003 (Example) | Support uplift cap | 0% for 3 years | 3% cap | Above 5% | Section 8 |
| [NEG-NNN] | [Topic] | [Position] | [Fallback] | [Walk-away] | [IDs] |
12.3 Decision summary
| Decision | Options considered | Choice | Reason | Approver |
|---|
| Example: Target database platform | Dedicated cluster; shared cluster; managed cloud service | Dedicated cluster now, managed service evaluated at renewal | Lowest compliance risk; licence cost known | [@architecture-board] |
| [Decision] | [Options] | [Choice] | [Reason] | [@approver] |
13. Ongoing compliance and governance
13.1 RACI
| Activity | Solution architect | ITAM manager | Procurement | Legal counsel | Platform team | Budget owner |
|---|
| Licence impact of a design change | R | C | I | C | C | A |
| Entitlement record maintenance | I | A, R | C | I | I | I |
| Deployment discovery and reconciliation | C | A | I | I | R | I |
| Open source licence review | R | C | I | A | C | I |
| Contract negotiation | C | C | A, R | R | I | C |
| Audit response | C | R | C | A | R | I |
13.2 Controls
| Control ID | Control | Frequency | Evidence | ISO/IEC 19770-1 clause area |
|---|
| CTL-001 (Example) | Licence impact check in architecture review for any new host, cluster, cloud region or user population | Every design review | Review minutes | 8 (operation) |
| CTL-002 (Example) | Quarterly ELP reconciliation for high-risk products | Quarterly | ELP workbook | 9 (performance evaluation) |
| CTL-003 (Example) | SBOM licence scan in the build pipeline with a policy gate | Every build | Pipeline report | 8 (operation) |
| CTL-004 (Example) | Renewal calendar with 120-day alerts | Monthly review | Calendar export | 8 (operation) |
| CTL-005 (Example) | Annual review of this document and lessons from audits | Annually | Revision history | 10 (improvement) |
13.3 Metrics
| Metric | Definition | Target |
|---|
| Products with a current ELP | Share of high-risk products reconciled in the last 90 days | Example: 100% |
| Unresolved high findings | Count of findings with score 15 or more past due date | Example: 0 |
| Shelfware share | Unused paid units divided by owned units, per subscription | Example: below 10% |
| OSS policy exceptions | Components with open obligations in released builds | Example: 0 for distributed products |
14. Glossary and references
14.1 Glossary
| Term | Meaning in this review |
|---|
| Effective licence position (ELP) | Required licences computed from deployment, compared with owned entitlements, per product and metric |
| Entitlement | A recorded right to use software under stated terms, metric and quantity |
| Metric | The unit by which licence need is counted, such as cores, users or consumption |
| Core factor | Vendor multiplier applied to physical cores for a CPU family |
| Soft partitioning | Allocation of CPU to a VM that the vendor does not accept as limiting the licence count |
| Hard partitioning | Physical or vendor-approved logical segmentation that limits counting to the assigned cores |
| BYOL | Bring your own licence: applying an existing entitlement to an infrastructure provider's platform |
| Licence mobility | Vendor right to move licences between on-premises and permitted cloud or outsourcer platforms |
| Indirect use | Use of software through another system, interface or middleware |
| True-up | Periodic reconciliation and purchase of growth above entitlement |
| Shelfware | Paid licences or subscriptions that are not used |
| Copyleft | Licence condition that requires derivative or combined works to be shared under the same terms |
| SPDX licence expression | Standard string identifying licences and exceptions, for example Apache-2.0 or GPL-2.0-only WITH Classpath-exception-2.0 |
| Declared and concluded licence | The licence a package states, and the licence a reviewer determined applies |
14.2 References
| Reference | Version or date | Use |
|---|
| ISO/IEC 19770-1, Information technology: IT asset management, Part 1: IT asset management systems, requirements | 2017, with Amd 1:2024; check iso.org | Management system structure and clause areas for section 13 |
| ISO/IEC 19770-3, Information technology: IT asset management, Part 3: Entitlement schema | 2016; check iso.org for the current edition | Shape of the entitlement record in section 2.2 |
| ISO/IEC 19770-2, Software identification tags | 2015; check iso.org | Discovery evidence through SWID tags |
| SPDX Specification | 3.0.1, spdx.github.io/spdx-spec/v3.0.1 | SimpleLicensing and ExpandedLicensing profiles; hasDeclaredLicense and hasConcludedLicense relationships |
| ISO/IEC 5962:2021 (SPDX) | 2021, published from SPDX 2.2.1 | International standard status of SPDX |
| SPDX License List and exceptions list | Version 3.29.0, spdx.org/licenses, checked 2026-10-23 | Identifiers in section 6 |
| Open Source Initiative approved licences | opensource.org/licenses | OSI approval status |
| Vendor product terms, partitioning and cloud policies | [Document names and dates] | Sections 3 and 5 |
| [Internal ITAM policy] | [Version] | [Use] |
Standard and licence note
Structure aligned with ISO/IEC 19770-1:2017 (IT asset management systems,
with Amendment 1:2024) and the entitlement concept of ISO/IEC 19770-3:2016,
and based on the SPDX Specification 3.0.1 and the SPDX License List for
licence identifiers and expressions (ISO/IEC 5962:2021 is the ISO edition
of SPDX 2.2.1). ISO/IEC clause numbers are cited for orientation only; no
text, definitions or tables from the standards are reproduced, so obtain
the standards for normative requirements. SPDX identifiers are used as
published by the SPDX project. Vendor names, products and licensing
policies belong to their owners; describe each vendor's rules from its own
current documents and confirm with the vendor. This template is original
text written for this collection. Check the current official versions
before use. This is a documentation format, not legal advice.
Template licence: MIT.