How to respond to a VMware Audit
Law firm Scott & Scott, LLP look into the best practice to follow.
Published on 11th December 2017
Managing a complex IT environment very challenging, even before becoming involved in an external software audit from a software publisher or a third-party auditing entity. Businesses facing VMWare audits in particular should be prepared to take a number of steps to ensure compliance and avoid exacerbating any potential copyright infringement claims.
Step 1: Identify the source of the audit
The first step in facing a VMware audit is to identify whether the audit is directly from VMWare pursuant to the software license agreement, or from a third-party entity investigating potential copyright infringement claims on behalf of VMWare.
The differences are distinct and can be found in the End User License Agreement, which allows VMWare to conduct an on-site audit of the customer’s records to ensure compliance with reasonable notice. If non-compliance exceeds 5%, the customer must reimburse VMWare for all costs and also pay the necessary fees to license the non-compliant software.
Step 2: Preserve the network to avoid spoliation of evidence claims
One of the most frequently overlooked and critical steps when facing an audit is to preserve a record of the audit data at the time the audit request is received. Dynamic environments utilizing VMWare frequently change, which creates a challenge in determining the installations during the relevant audit time period.
The End User License Agreement allows VMWare to conduct an audit up to two years following the expiration or termination of a license.
5. RECORDS AND AUDIT. During the License Term for Software and for two (2) years after its expiration or termination, You will maintain accurate records of Your use of the Software sufficient to show compliance with the terms of this EULA. During this period, VMware will have the right to audit Your use of the Software to confirm compliance with the terms of this EULA.
Therefore, it is critical for VMWare customers to keep accurate records in order to prove compliance with the licenses during the entire license term, or risk breach of contract or copyright infringement penalties and potential spoliation of evidence claims.
Step 3: Conduct a comprehensive audit of the network
There are a number of tools available online, ranging from a simple scanning tool for a network inventory to complete software asset management software. Regardless of the type of software used to gather the data related to the company’s installations, it is important that a secondary review is conducted to validate that the data collected is accurate.
Device and user data should be reconciled against Active Directory data where possible, and virtual machines should be mapped to physical hosts. The data gathering can become more complex in hosted environments and situations where the software is deployed globally. If a customer does not have a sophisticated IT support system, it may be advantageous to engage a third party with expertise in VMWare licensing and software asset management.
Step 4: Review the terms of the license agreement for each use case
There are a number of restrictions outlined in the VMWare EULA which may directly impact customers. For example, if a customer deploys VMWare globally but only licenses for a specific territory, VMWare will consider this scenario non-compliant.
Additionally, hosted services may be restricted by the license agreement, as well as mixing support levels for VMWare servers.
It is important to understand the terms of the license agreement as it applies to a customer’s specific use case to determine whether the software installations comply with the agreement. The End User License Agreement may be found here.
Step 5: Collect all entitlements and license agreements
Proving ownership of each license is as important as proving that each use case complies with the license agreement. Accurate record-keeping is key to efficiently navigating an audit, so it is important to ensure a process is in place to track each license and agreement, including any renewals or amendments.
Step 6: Negotiating a resolution
It is possible that a customer may disagree with VMWare’s audit findings in the event of non-compliance. The most common scenario is that the parties disagree about a use case and whether it is covered by the license agreement. It is possible that a customer may negotiate with VMWare or provide additional documentation or evidence that the use case in question complies with the license. The metrics for the monetary penalties for non-compliance are outlined in the EULA, Section 5. If a customer is more than 5% out of compliance, it will be assessed the fees of the audit and costs to become compliant.
There are many considerations and strategies for navigating VMWare audits and many companies find it helpful to seek an expert in software licensing and software audits in order to avoid the pitfalls of the process.
