IT asset and licence management

In short

IT asset and licence management is the discipline of knowing every hardware, software, cloud and data asset an organisation owns or subscribes to — what it is, where it is, who uses it, what it costs, what the contract permits, and when it must be renewed, refreshed or disposed of. Hardware asset management (HAM) tracks physical devices through their lifecycle; software asset management (SAM) tracks entitlements against installations so the organisation is neither over-licensed (wasting money) nor under-licensed (facing audit penalties and copyright liability). It is examined in university papers on IT service management, ITIL/ISO frameworks and IT infrastructure courses, and it is a live interview area for roles in Indian IT services (TCS, Infosys, Wipro, HCLTech, Tech Mahindra, LTIMindtree) and in every captive IT/GCC service desk. Indian practice is shaped by the Copyright Act 1957 (software is a literary work), the Information Technology Act 2000, the E-Waste (Management) Rules 2022 and the Digital Personal Data Protection Act 2023 for data on retired devices.

Explained

Definitions and scope

• IT asset: any item of hardware, software, service or information with value to the organisation that needs tracking through a lifecycle. IT Asset Management (ITAM) is the set of practices that maximises value and controls cost and risk across that lifecycle.
• Configuration item (CI): anything under configuration control because a service depends on it. Every CI is usually an asset, but not every asset is a CI (a boxed spare in stores is an asset, not a CI).
• Asset register vs CMDB: the asset register answers *what do we own, what did it cost, who is accountable*; the Configuration Management Database (CMDB) answers *what depends on what*. ITIL 4 keeps "IT asset management" and "service configuration management" as two separate practices for this reason.
• Entitlement: the right to use software, proved by a licence, contract, purchase order and proof of purchase. Installation/consumption is actual use found by discovery. Compliance position = entitlements − consumption, computed per product.
• Classes of asset: hardware (end-user devices, servers, network, peripherals), software (OS, databases, middleware, applications), cloud/SaaS subscriptions, virtual assets (VMs, containers, images), consumables, and increasingly digital assets such as certificates, domains and API keys.
• Standards: ISO/IEC 19770 family — 19770-1 (ITAM management system requirements), 19770-2 (SWID tags — a machine-readable identity file a vendor ships with software), 19770-3 (entitlement schema), 19770-5 (overview and vocabulary). ITAM also sits inside ISO/IEC 20000-1 (service management) and is evidence for ISO/IEC 27001 Annex A controls on asset inventory and ownership (A.5.9 asset inventory, A.5.10 acceptable use, A.7.9/A.7.14 off-premises assets and secure disposal in the 2022 edition).

Hardware asset lifecycle

1. Plan/request: demand forecast, standard build catalogue, budget approval. Standardising on 2–3 models per device class cuts spares, images and support cost.
2. Acquire: purchase order, GeM/e-tender in government and PSU buying, invoice, warranty/AMC terms, asset tag applied before issue.
3. Receive and record: tag number, serial number, MAC address, model, cost, GST invoice reference, warranty expiry, cost centre, location — entered in the register at goods-receipt, not later.
4. Deploy/assign: issued to a user or rack position against a signed acknowledgement; CI created and linked to the service it supports.
5. Operate and maintain: moves/adds/changes tracked, AMC and warranty claims, patching, periodic physical verification (annual stock-take; often quarterly for high-value or mobile assets).
6. Refresh decision: when maintenance cost + downtime cost exceeds replacement benefit — typically 3–5 years for laptops and desktops, 5–7 for servers and network gear (organisation policy, not a rule).
7. Retire and dispose: data sanitisation, licence harvesting (reclaim and reassign the software), de-tagging, disposal through an authorised recycler with a certificate of destruction, write-off entry in the books.
8. Reconciliation: the register must tie to the finance fixed-asset register (capitalisation, depreciation) and to discovery data. Three sources — finance, procurement, discovery — rarely agree; closing that gap is the core ITAM job.

Software licence models and metrics

• Perpetual: one-time right to use a version indefinitely; annual support/maintenance (typically ~18–22% of licence cost in enterprise contracts — varies by vendor) buys upgrades and support.
• Subscription/term: right to use for a period (monthly/annual); stops on non-renewal. Now the default for Microsoft 365, Adobe, Salesforce, Zoho, Freshworks.
• Per-user (named user): licence tied to an identified person, usually non-shareable; may permit a fixed number of devices per user.
• Concurrent/floating: a licence server (e.g. FlexNet/FlexLM) issues a token per active session; *N* licences serve many more users. Common for CAD/EDA (AutoCAD, MATLAB, Cadence).
• Per-device: tied to a machine regardless of user count — suits shift working and shared terminals.
• Per-core / per-processor: server metric; count physical cores (sometimes multiplied by a core factor) with vendor-specified minimums per socket or per server.
• Client Access Licence (CAL): needed *in addition* to the server licence to allow a user or device to access that server (Windows Server, SQL Server in Server+CAL mode). Choose User CALs when users have many devices, Device CALs for shared devices.
• Capacity/consumption metrics: per GB stored, per transaction, per API call, per vCPU-hour, per endpoint, per MIPS (mainframe), per PVU (IBM Processor Value Unit).
• Free/shared-source models: freeware, shareware, trial/evaluation, academic/educational, OEM (tied to the machine it shipped with and not transferable), volume licensing (e.g. Microsoft Enterprise Agreement, Open Value), and open source.
• Open source families: permissive (MIT, BSD, Apache 2.0 — attribution, patent grant in Apache) versus copyleft (GPL-2.0/3.0 — derivative works distributed must be offered under the same licence; LGPL for linking; AGPL extends the obligation to software offered over a network). Compliance matters in product engineering: a GPL component shipped in a closed product is a licence breach, and Indian IT services firms run OSS scanning (Black Duck, FOSSA, Snyk) in the SDLC for exactly this.
• Contract documents to read: EULA, master services agreement, product terms/use rights, order form, support policy, and the audit clause (almost every enterprise contract gives the vendor a right to audit with notice).

Virtualisation, cloud and the hard licensing problems

• Sub-capacity vs full-capacity: some vendors licence by the physical host's cores even when the software runs in one small VM, unless an approved metering tool reports sub-capacity usage. This is where unbudgeted liability arises.
• vMotion/live migration: a VM free to move across a cluster can require licensing of *every* host it could run on; pinning VMs to a licensed host group (affinity rules, dedicated cluster) is the standard control.
• Containers: short-lived instances defeat periodic scans; licence at the node/cluster or use vendor container-aware metering.
• SaaS: the risk inverts — not under-licensing but shelfware: paid seats nobody uses, duplicate tools, and Shadow IT bought on departmental cards. Controls: SSO/IdP logs as the usage source of truth, last-login reports, deprovisioning tied to the HR exit workflow.
• BYOL to cloud: check whether the vendor permits bringing your own licence to a public cloud, and whether "dedicated host" is required; terms differ by vendor and change, so verify the current product terms rather than relying on memory.
• True-up / true-down: annual reconciliation under volume agreements — you pay for growth in installs/users. Most agreements allow true-up but not true-down mid-term.

Compliance, audits and risk

• Legal basis in India: software is protected as a literary work under the Copyright Act 1957; unlicensed copying or use beyond the licence is infringement, with civil remedies (injunction, damages, Anton Piller–style search orders) and criminal provisions, and Section 63B specifically addresses knowing use of an infringing computer programme. The IT Act 2000 adds offences for unauthorised access/copying. Enforcement actions in India are often driven by industry bodies such as BSA and by vendor audit teams.
• Audit trigger events: merger/acquisition, large hiring, end of an agreement term, long gap since last audit, whistle-blower reports, vendor-side revenue pressure.
• Audit response discipline: acknowledge in writing, check the contractual audit clause (scope, notice, frequency, auditor), appoint a single point of contact, run your own internal measurement first, hand over only the agreed data, challenge the vendor's scripts and assumptions, negotiate settlement as future purchase rather than pure penalty.
• Effective Licence Position (ELP): the deliverable of a SAM exercise — per product: entitlements, deployments, metric applied, gap, and rupee exposure.
• Other risks: unsupported/EoL software (no patches — a security and audit finding), licence hoarding, assets missing at stock-take, data left on disposed disks (DPDP Act 2023 obligations on the data fiduciary), and untracked assets outside the perimeter after work-from-home.

Processes, tools and governance

• Discovery and inventory: agent-based (full detail, needs deployment), agentless network scans (credentials, broad reach), and passive methods (DHCP, switch port, SSO logs). Best practice is two independent sources reconciled.
• Normalisation: raw scan strings ("MS Offce Pro Plus 2019 x64") must be mapped to a clean product–edition–version–publisher catalogue before entitlements can be matched; vendors' catalogues (e.g. Technopedia-style libraries) do this.
• Tooling: ServiceNow ITAM/SAM Pro, Flexera, Snow/Flexera One, Microsoft Intune + Endpoint Configuration Manager, Lansweeper, ManageEngine AssetExplorer/Endpoint Central (Zoho, Chennai), SysAid, GLPI and Snipe-IT (open source).
• Key roles: IT asset manager, SAM analyst, CMDB/configuration manager, procurement/vendor manager, service desk (first recorder of moves), finance (capitalisation and depreciation), information security (inventory is control #1 in CIS Controls).
• Policies that make it work: software request and approval workflow, standard software catalogue, prohibition on local admin installs, joiner-mover-leaver (JML) integration with HR, asset issue/return acknowledgement, and a disposal policy.
• Indian practice specifics: asset tagging with barcodes or RFID for stock-take; GST invoice and HSN/SAC records kept for input tax credit; capital goods and software purchases treated per the Income-tax Act, 2025 (in force from 1 April 2026, which replaced the 1961 Act and renumbered every section — depreciation on computers and software is claimed on the written-down-value block of assets, and the exact section number should be read from the current Act); E-Waste (Management) Rules 2022 (as amended) require disposal through registered recyclers on the CPCB EPR portal with extended producer responsibility; government and PSU procurement runs through GeM, with preference to Make in India and, for networking/security gear, testing under TEC/MTCTE requirements. GST on IT hardware and most software supplies is at the standard rate under the 5%/18%/40% slab structure effective 22 September 2025 — confirm the current rate for the specific HSN before quoting.

Key points

• ITAM - end-to-end control of IT assets to maximise value and minimise cost and compliance risk.
• HAM vs SAM - hardware management is about physical custody and refresh; software management is about entitlements versus installations.
• Asset register vs CMDB - ownership and cost versus relationships and dependencies; both needed, kept distinct in ITIL 4.
• Entitlement - the contractual right to use; without proof of purchase a licence does not exist in an audit.
• Effective Licence Position - entitlements minus consumption per product; positive is shelfware, negative is liability.
• Licence metrics - per user, per device, per core/processor, concurrent, capacity-based, CAL-based; the metric decides the maths.
• CAL - an extra licence to *access* a licensed server; User CALs for multi-device users, Device CALs for shared machines.
• Concurrent licensing - a licence server issues tokens; cheaper for intermittent, high-cost tools like CAD and MATLAB.
• OEM licence - locked to the machine supplied with it; not transferable to a replacement PC.
• Copyleft - GPL/AGPL obligations propagate to derivative works; permissive licences (MIT/Apache) only require notices.
• Sub-capacity licensing - must be proved with an approved metering tool, else the full physical host counts.
• vMotion exposure - an unpinned VM can oblige licensing of every host in the cluster.
• Shelfware and Shadow IT - the dominant SaaS waste; found through SSO last-login data and expense analysis.
• True-up - periodic reconciliation and payment for growth under a volume agreement; true-down is usually not allowed.
• Licence harvesting - reclaiming licences from leavers and retired machines before buying new ones.
• Secure disposal - sanitise data, use an authorised e-waste recycler, keep the destruction certificate (E-Waste Rules 2022; DPDP Act 2023 for personal data).
• ISO/IEC 19770 - the ITAM standard family; 19770-2 SWID tags give machine-readable software identity.
• Standard metrics - compliance %, licence utilisation %, TCO, refresh rate, discovery coverage %, reconciliation accuracy.

Formulas and examples

Example 1 — Effective Licence Position and exposure. A firm owns 1,200 entitlements of an application. Discovery finds 1,460 installs, of which 85 are on machines retired but not wiped and 25 are duplicate records for the same device.

• True deployments = 1,460 − 85 − 25 = 1,350.
• Compliance position = 1,200 − 1,350 = −150 (shortfall).
• Compliance % = 1,200 ÷ 1,350 × 100 = 88.9%.
• At ₹18,000 list per licence plus 20% back-maintenance: 150 × 18,000 = ₹27,00,000 licence + ₹5,40,000 maintenance = ₹32,40,000 exposure.
• After harvesting the 85 retired installs properly (removing them before the audit), shortfall would be 150 regardless — because those 85 were already excluded. The real lever is reclaiming from inactive users: if 160 users have not launched the app in 90 days, removing them gives 1,190 deployments, i.e. a surplus of 10 and zero exposure.

Example 2 — Per-core server licensing with a minimum. A database is licensed per core, sold in 2-core packs, with a minimum of 4 cores per processor and 16 cores per server. Core factor = 1.0.

• Total cores to licence = 16 + 16 + 40 + 16 = 88 cores = 44 two-core packs.
• At ₹1,10,000 per 2-core pack: 44 × 1,10,000 = ₹48,40,000, plus 20% annual support = ₹9,68,000/year.
• Note how Server B pays for 16 cores although it has 8 — minimums, not physical counts, drive the bill. (Metrics, factors and minimums differ by vendor and change over time; always compute from the current product terms.)

Example 3 — Server + CAL versus per-core for SQL-type workloads. 220 employees, average 2.3 devices each, access one server with 16 cores to licence.

• Cheapest here is Server + User CALs (₹5,28,000). User CALs beat Device CALs because each user has 2.3 devices. Per-core becomes the right answer when users are external/unidentifiable (a public web application) — then CALs cannot be counted at all.

Example 4 — Concurrent licences for a CAD tool. 90 design engineers; study shows at any instant about 40% are actually in the tool, with a measured peak of 44 sessions.

• Named-user cost: 90 × ₹85,000 = ₹76,50,000.
• Concurrent requirement = peak 44 + 10% headroom ≈ 48 licences; at ₹1,30,000 each = ₹62,40,000.
• Saving = ₹14,10,000 (18.4%), at the cost of occasional denied check-outs at peak. Add licence-server redundancy to the design.

Example 5 — Laptop refresh TCO, annualised. Option A: ₹55,000 laptop, 3-year warranty, 3-year life, out-of-warranty repairs nil, residual ₹4,000, software and support ₹6,000/yr. Option B: ₹70,000 laptop, 3-year warranty + 2 extra years AMC at ₹3,500/yr, 5-year life, residual ₹3,000, software and support ₹6,000/yr.

• A: TCO = 55,000 + (6,000 × 3) − 4,000 = ₹69,000 over 3 years → ₹23,000 per asset-year.
• B: TCO = 70,000 + (3,500 × 2) + (6,000 × 5) − 3,000 = 70,000 + 7,000 + 30,000 − 3,000 = ₹1,04,000 over 5 years → ₹20,800 per asset-year.
• Option B is cheaper per year (₹2,200 less), provided the machine stays fit for purpose for five years; add the cost of lost productivity on slower hardware before deciding.

Example 6 — SaaS shelfware. A 1,500-seat subscription at ₹1,250 per seat per month. SSO logs show 1,160 seats logged in during the last 60 days; 95 of the inactive accounts belong to leavers.

• Annual spend = 1,500 × 1,250 × 12 = ₹2,25,00,000.
• Utilisation = 1,160 ÷ 1,500 × 100 = 77.3%.
• Removing 95 leaver accounts at renewal saves 95 × 1,250 × 12 = ₹14,25,000/year; reclaiming the remaining 245 inactive seats (after business confirmation) saves a further 245 × 1,250 × 12 = ₹36,75,000/year.

Where it is used

• IT services and GCCs (TCS, Infosys, Wipro, HCLTech, Accenture India, Capgemini India): large ITAM/SAM practices run audits, ELP engagements and tool implementations for global clients — a standard entry-level analyst role.
• Banking, insurance and NBFCs: RBI-supervised entities must maintain asset inventories and EoL/patch control under IT governance and cyber-security framework expectations; ITAM data feeds those audits.
• Government and PSUs: procurement through GeM, annual physical verification of assets, NIC-managed inventories, and e-waste disposal through CPCB-registered recyclers.
• Product and engineering firms: open-source licence compliance scanning in CI/CD pipelines before a release ships; SBOM generation (SPDX/CycloneDX) is becoming a customer requirement.
• Educational institutions: campus-wide academic licences (MATLAB, AutoCAD, Microsoft Education), concurrent licence servers in labs — exactly the licence servers students meet in an engineering college.
• Job roles: IT asset manager, SAM/licence analyst, CMDB analyst, vendor/contract manager, service desk and desktop engineering, IT auditor, procurement analyst, FinOps analyst for cloud cost.

Interview questions

• Q: What is the difference between an asset and a configuration item? A: An asset is something owned that has financial value and must be tracked for cost and accountability; a CI is something under configuration control because services depend on it and its relationships matter. Most CIs are assets, but spares in stores are assets without being CIs.
• Q: How would you build a compliance position for a product from scratch? A: Collect entitlements from purchase orders, contracts and vendor portals; collect deployments from two independent discovery sources and de-duplicate; normalise product names; apply the contractual metric and use rights; then report entitlements minus consumption with the rupee exposure.
• Q: What is a CAL and when do you choose User over Device CALs? A: A Client Access Licence permits a user or device to access a licensed server, over and above the server licence. Choose User CALs when each person uses several devices, and Device CALs when many people share a few machines, such as a shift-based shop floor.
• Q: Why can virtualisation create unexpected licence liability? A: Some vendors licence by the physical cores of every host a VM can run on, so live migration across a cluster can multiply the requirement unless VMs are pinned to a licensed host group or approved sub-capacity metering is in place.
• Q: What is the difference between perpetual and subscription licensing commercially? A: Perpetual is capex with an indefinite right to the purchased version plus optional annual maintenance; subscription is opex with rights that end on non-renewal, lower entry cost, and automatic version currency.
• Q: A developer wants to link a GPL-3.0 library into a product you ship to customers. What do you say? A: Distributing the product would create copyleft obligations including offering the corresponding source under GPL-3.0, so either use a permissively licensed alternative, isolate it behind a boundary the licence permits, or get the business to accept releasing the source. The decision belongs to legal, with engineering advising.
• Q: How do you handle a vendor audit notice? A: Acknowledge in writing, read the audit clause for scope and notice, nominate a single contact, run an internal measurement before sharing anything, provide only the data contractually required, verify the vendor's scripts and assumptions, and negotiate any gap as forward-looking purchase.
• Q: What is shelfware and how do you find it? A: Licences or SaaS seats paid for but not used. Find it by comparing owned entitlements with actual usage from SSO last-login data, application telemetry and licence-server check-out logs, then reclaim at renewal.
• Q: What is licence harvesting? A: Reclaiming licences from leavers, role changes and retired machines into a pool for reassignment, so that new demand is met without new purchase.
• Q: Which ISO standard covers ITAM, and what does SWID add? A: ISO/IEC 19770-1 specifies an IT asset management system; 19770-2 defines SWID tags, machine-readable files that identify a software product reliably so discovery tools do not depend on guessing from registry strings.
• Q: What must happen before a laptop leaves the building as scrap? A: Data sanitisation to policy, licence harvesting and de-registration, removal of the asset tag, handover to a CPCB-registered recycler under the E-Waste (Management) Rules 2022 with a certificate of destruction, and a write-off entry in the fixed-asset register.
• Q: Discovery shows 900 installs but finance shows 1,100 purchased licences — is the company compliant? A: Probably, but you cannot conclude it: you must check discovery coverage (unscanned and offline machines), whether the metric is installs at all (it may be users or cores), and whether entitlements include a maintenance lapse or downgrade right. Report compliance with the coverage percentage attached.

Common mistakes

• Treating "number of installations" as the licence metric for every product, when the contract may count users, devices, cores or capacity.
• Confusing the asset register with the CMDB, or claiming one replaces the other.
• Forgetting vendor minimums and core factors in per-core calculations, so the quoted number is lower than the real requirement.
• Assuming an OEM licence can be transferred to a replacement machine, or that an academic/trial licence is valid for commercial use.
• Ignoring discovery coverage: an ELP built on 70% of the estate is a sample, not a position, and must be reported with its denominator.
• Deleting an asset record on disposal instead of marking it retired — destroying the audit trail and the evidence of lawful disposal.
• Treating open-source as "free of obligation", and shipping copyleft code in a closed product.
• Reporting savings from reclaiming seats without checking the contract allows a true-down or seat reduction before renewal.

Related topics

Virtualisation: VMware and Hyper-V · Disaster recovery and business continuity · IT service management and ITIL 4 practices · Information security management and ISO/IEC 27001 · Cloud cost management and FinOps · Software engineering: SBOM and open-source compliance