Checklist Archives - EasySAM

Running your own software audit? Check out this checklist

Mike Varney — Thu, 12 Dec 2024 10:42:35 +0000

Checklist

Find out more below

Checklist

An onerous task to take on, but one that needs performing regularly - help ensure compliance and efficiency with this step by step guide.

Published on 12th December 2024

A software audit guarantees that the software used by your company is secure, compliant, and functional. A routine audit helps your company maximise its software assets by spotting problems like over-licensing, underutilised software, or security flaws. You can stay compliant, lower risk, and make wise decisions regarding your software portfolio by following this checklist, which will walk you through the crucial steps of a software audit.

1. Inventory and Categorize Software Usage

The first step in an effective software audit is creating a detailed and accurate inventory of all the software your organization uses. An up-to-date inventory is the cornerstone of understanding what software is in use and helps track compliance.

Actions to Take:

Enumerate every software program used by the company, including desktop, mobile, cloud-based, and software-as-a-service (SaaS) programs.
Keep track of each software application’s version number and installation instructions, making sure they are up to date.
Sort software according to its use, such as essential, auxiliary, or unneeded. Making decisions about upcoming acquisitions or removals is aided by this classification.
To guarantee complete compliance across all touchpoints, identify any software deployed on distant systems, BYOD (Bring Your Own Device) assets, or personal devices.

You can make sure that nothing falls between the cracks in terms of asset management or compliance by creating a thorough software inventory.

2. Validate Software Licensing and Usage

Ensuring that your organization is using software according to its licensing agreements is crucial. Mismanagement of software licenses can lead to legal complications, fines, or wasted costs.

Actions to Take:

To confirm that the number of software installations corresponds to the number of licenses acquired, compare your software inventory with licensing agreements.
Verify that the program is being used in accordance with the terms of its licensing, such as per person, per device, or enterprise-wide.
Determine whether any unauthorised or unlicensed software is being used. This can be software that was improperly purchased or downloaded without IT’s knowledge.
Verify that any software contracts are current, in line with current usage, and that any renewals or new purchases are being handled appropriately.

By taking this precaution, over-licensing (buying more licenses than necessary) and under-licensing (using software against its conditions) are avoided.

3. Ensure Software Security and Patch Management

Security should always be top-of-mind during a software audit. Vulnerabilities in outdated software or poor patch management practices can lead to cyberattacks, data breaches, or system failures.

Actions to Take:

Verify that all software applications have the latest security patches installed and that any known vulnerabilities have been addressed.
Identify any software that is nearing its end-of-life (EOL) or is no longer supported by the vendor. Continuing to use such software can expose the organization to unpatched security risks.
Evaluate the security policies in place for software access, such as multi-factor authentication (MFA) or role-based access controls (RBAC).
Run vulnerability scans on software systems to identify potential weaknesses that need to be addressed immediately.

By ensuring that all software is updated and secure, you protect the integrity of your network and data, reducing the risk of breaches or downtime.

Already overwhelmed?

Why not get the experts in to help? Get in touch via the link below.

4. Assess Software Usage and Performance

A software audit isn’t just about licensing and security — it’s also about ensuring that the software being used is performing effectively and providing value to the organization.

Actions to Take:

Examine software usage reports to determine whether any particular apps are being used insufficiently or not at all. Deactivating or uninstalling unused applications can frequently save up resources.
To make sure the program is fulfilling business requirements without creating needless lags, assess software performance measures like load times, user feedback, and system compatibility.
Examine any software redundancies — where several programs do the same function — and determine whether combining them could increase productivity.

By knowing how well your software is doing its intended function, you can cut down on inefficiencies and possible overspending on unnecessary products.

5. Review User Access and Permissions

Managing who has access to your software is critical for both security and compliance. Inadequate access controls can lead to unauthorized use or data breaches.

Actions to Take:

Make sure that any essential software has user access controls in place. Make sure users can only access the data and applications required for their job duties.
Verify that permission settings adhere to the least privilege concept by auditing them. Excessive permissions for users could put their security at danger.
Look for user accounts that are dormant or orphaned, particularly those belonging to former employees. Deactivating these accounts is necessary to stop unwanted access.
Examine the company’s multi-factor authentication (MFA) and single sign-on (SSO) configurations for cloud-based or SaaS apps to make sure they are set up properly.

You can safeguard the data of your company and stop abuse by making sure that only authorized individuals have access to sensitive software.

6. Analyze Cost Efficiency and ROI

Evaluating the financial aspects of your software assets is a necessary component of a successful software audit. Your business may be spending needless money on software that isn’t providing a return on investment (ROI).

Actions to Take:

Examine the costs of the program, taking into account license, maintenance, and any related support or consulting fees.
Examine each software application’s total cost of ownership (TCO) to determine whether it offers value in terms of performance, features, and support.
Find ways to save money on software by getting rid of unnecessary or redundant software, lowering licensing levels where necessary, or haggling with sellers for lower prices.
Examine whether any pay-per-use or subscription software models might better suit the requirements and expansion trends of your company.

This process helps ensure that you’re only spending on software that provides value, reduces unnecessary overhead, and maximizes ROI.

7. Document Findings and Plan for Improvements

Once the audit is complete, document your findings and make recommendations for improvement. A clear action plan can ensure that software compliance and efficiency issues are addressed effectively.

Actions to Take:

Document any discrepancies found during the audit, such as unauthorized software installations or license mismatches.
Provide recommendations for addressing identified risks, such as updating software, removing unused programs, or renegotiating licenses with vendors.
Develop a timeline for implementing corrective actions and improving software management practices, including setting up future audits to maintain compliance.
Share findings with relevant stakeholders to ensure awareness of software compliance issues and the importance of adhering to policies moving forward.

Transparency and the resolution and follow-up of any issues discovered during the audit are guaranteed by a well-documented audit process.

Summary

A software audit aims to optimize your software portfolio for cost-effectiveness, performance, and security in addition to guaranteeing compliance. Frequent audits help your company save time, money, and resources by seeing and fixing possible problems before they become bigger ones. You may reduce legal and security risks, keep control over your software assets, and make sure your program is operating at its best by using this checklist.

The alternative to doing it yourself?

Get the experts in to help! We're just a message or phone call away.

Source

https://medium.com/@shweta_65729/software-audit-checklist-for-compliance-and-efficiency-b098f348b77d

Image Credit

Thanakorn Lappattaranan via Vecteezy

Search

AI drives surge in complex software pricing models

Usage-based charges have risen sevenfold since 2025 – putting pressure on finance teams and increasing the risk of invoicing errors.

Veterans Affairs loses track of software licenses amid $985M bill

The US governmental department have said that they’re putting systems in place to manage the ‘restrictive licensing practices’ identified.

Linking IT asset visibility to value

Gaining full visibility into siloed, hidden or hoarded IT assets allows you to see more, control more and spend less.

Oracle’s AI obsession could mean higher prices and worse support

That’s the take from advisors in Oracle negotiations, who say fewer staff at Big Red could mean slower answers and tougher renewals.

Follow and Subscribe

The post Running your own software audit? Check out this checklist appeared first on EasySAM.

GDPR – The Checklist

Mike Varney — Thu, 07 Jun 2018 14:32:00 +0000

Checklist

Find out more below

Checklist

Now that the new regulation has come into effect, it is time to double check your organisation’s policies and practices.

Published on 7th June 2018

Although the GDPR deadline has now passed, it’s important for organisations to show that in the event of a regulatory investigation, they have taken reasonable steps to demonstrate they take privacy seriously – and ultimately comply. The good news is that fines for organisations that suffer a breach of personal data won’t be applied if they can prove they’ve taken the correct steps to comply.

The reality is that GDPR will be a continuous journey for organisations involving constantly reviewing data, removing low value data, looking at new data, following procedures, and maintaining trust with customers – by prioritising their privacy. Although many organisations are becoming better prepared for GDPR, here are some key, practical actions that must be taken now.

Double check the GDPR specialist

For those organisations with over 250 employees, a staff member will hopefully have already been made GDPR accountable as the data protection officer. Although they will possess a significant understanding of both the business and complexities of the data regulations – they must also operate independently within the business. Therefore, it’s critical that they don’t have any other responsibilities that may result in a conflict of interest.

Remember that employees count too under GDPR

All staff must receive a ‘Data Privacy Notice’ advising them that their personal data will be processed by the company under ‘legitimate interest’. Explain in simple language which personal data will be processed, the reasons and timeframe for doing so, what rights they have and who they should contact if they have concerns. Also, outline what happens if they leave the organisation and who else this personal data will be shared with.

Gain enterprise-wide GDPR awareness

Everyone within an organisation needs to know what the regulation means for them. This means establishing which areas of the business fall within the scope of GDPR, by identifying, assessing and mitigating privacy risks with data processing activities. For larger organisations, territories and jurisdictions must be looked at too – as well as standards and management systems that may be affected or could positively contribute to GDPR compliance.

Another task is to establish from the IT team if there are any imminent projects that involve personal data – as these will be candidates for privacy by design. This is critical as, privacy by design in a service or product, is taken into account, not only at the point of delivery, but also from a product’s inception.

Identify enterprise-wide data

Organisations hold huge volumes of data in all sorts of weird and wonderful places, so they must ensure that they’ve identified which types are held, where it comes from and the lawful basis for processing it. There are special categories of data that may invite stricter processing rules, such as getting explicit consent. Once all data has been sought out – it must be clearly documented with when, how, and why it was obtained; what is going to be done with it and how long its will be kept.

Audit data flow

Organisations will hopefully now have an understanding of how personal data follows within their business too – as well as where it comes from and where it is sent. This will help highlight risks in data processing activities and where controls are required. From this, it can be established if further effort is required to help identify, assess and mitigate or minimise privacy risks with data processing activities. The three primary conditions for an assessment identified in the GDPR are:

Systematic and extensive evaluation of personal aspects relating to natural persons, which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person
Processing on a large scale of special categories of data or of personal data relating to criminal convictions and offences
Systematic monitoring of a publicly accessible area on a large scale

Create or improve key policies and processes

According to Article 30 of the GDPR, companies will be required to record personal data processing activities including, but not limited to, the categories of data being processed, the categories of recipients of the data and time limits for keeping the data. Each business will also need a privacy notice, a data protection policy and have to update or review contracts with employees and suppliers – to ensure they are compliant.

These policies should explain what personal data is and why it’s important to keep it secure and protected. Everyone should be clear on what they can and cannot do with that data and must understand the consequences of non-compliance.

The rules around consent are clear: it must be freely given by the individuals; the information must be unambiguous, specific and with no jargon, and consent must be given affirmatively. Transparency is paramount: organisations must be open and honest with the people who provide their data about what is being collected, why it’s wanted, how it will be used and how it will be cared for – and that withdrawal of their consent is possible at any time.

To addresses citizen’s rights, requires more comprehensive outlines on how their data should be handled. Key changes include the ‘right of access’, which have expanded considerably and are required to be free of charge. Additionally, the ‘right to be forgotten’ has also been extended, with individuals now able to be ‘forgotten’ when they no longer want to have a relationship with that brand. This means that organisations should think about what processes are needed to accomplish this.

Check breach response

This response process to a data breach must become flawless. Organisations must therefore conduct practice sessions to ensure that everyone knows what is expected of them – so they’re able to alert the relevant authorities within 72 hours.

Seek additional expertise

If outside help is required, organisations should only consider GDPR partners that have hands-on experience, great relationships with other experts in the field, access to specialist tools – and possesses a strong track record in regulated sectors. Also, a potential partner should already be GDPR compliant themselves.

Also, ensure any partner complies with ISO 27001 to deliver the appropriate technical controls, policies, procedures and promote a culture of awareness of information security. Any potential partner should also follow ITIL best practices and help use it to implement and adapt processes for GDPR compliance.

Source

https://www.itproportal.com/features/gdpr-the-checklist/

Image Credit

Anete Lusina via Pexels

Search

AI drives surge in complex software pricing models

Usage-based charges have risen sevenfold since 2025 – putting pressure on finance teams and increasing the risk of invoicing errors.

Veterans Affairs loses track of software licenses amid $985M bill

The US governmental department have said that they’re putting systems in place to manage the ‘restrictive licensing practices’ identified.

Linking IT asset visibility to value

Gaining full visibility into siloed, hidden or hoarded IT assets allows you to see more, control more and spend less.

Oracle’s AI obsession could mean higher prices and worse support

That’s the take from advisors in Oracle negotiations, who say fewer staff at Big Red could mean slower answers and tougher renewals.

Follow and Subscribe

The post GDPR – The Checklist appeared first on EasySAM.

Basic checklists for Enterprise Agreements

Mike Varney — Wed, 18 Mar 2015 13:56:00 +0000

Checklist

Find out more below

Checklist

It's back to basics for one of the most important renewals your SAM programme can face.

Published on 18th March 2015

Back in 2013 I published a few ‘checklists’ for the benefit of those considering an Enterprise Agreement (EA) as well as those already committed and facing an annual reevaluation. I thought it would be good to revisit.

Let’s start at the very basics again…. A Microsoft Enterprise Agreement offers your organization a cost-effective way to acquire the latest Microsoft technology, help standardize your IT infrastructure, and simplify your license management. It gives you the flexibility to grow your business without stopping to purchase licenses incrementally. Provided you have 250 seats+ of course, and you are prepared for a minimum term of three years.

A huge benefit here being that you are able to license both on-premises software and cloud services under the same agreement. You also have invaluable resources such as your reseller as well as your Microsoft Licensing Executive and Account Manager to fully assess your company’s business needs before making important licensing decisions like these. Here are some checklists you may find helpful during this journey:

Getting Started

Account for any retired and ‘line of business’ devices to avoid overstating your device count – a common error
Get an understanding of your datacenter’s server environment and the implications of DRS (Dynamic Resource Scheduling) on your licensing requirements
Review your usage/deployment of non-platform software (see more detail below)
Review Terminal Services/Citrix usage. Not all inventory tools monitor/manage this access. Without this knowledge you will have to succumb to ‘worst case scenario’.
Account for any online subscriptions including cloud services. An important part of the checklist above is the fact that you need to ‘inventory’. Run an inventory before you enter into any agreements, and certainly repeat this at every true-up/EA renewal.

Make sure you inventory

Physical Desktops
Virtual Desktops
Physical Servers
Virtual Servers
CPUs per Server (and Core Counts on your SQL Servers)
Qualifying underlying OS licenses
Users & Devices accessing Windows, SharePoint, Exchange, Lync Servers (among others)

People to be involved in discussions

I also can’t stress enough how important it is to involve all stakeholders in planning discussions:

Once you have done your due-diligence, you will have peace of mind and confidence moving forward with discussions. Should an EA agreement turn out to be a good fit and you enter into it, the next hurdle to consider is your annual True-up (or in some instances your True-Down).

Your true-up can be every bit as important as your initial planning, and there are so many companies who simply don’t allocate enough time to the process and frankly – it costs them. During your True-up, Microsoft ask you to align your Enterprise Agreement with the total number of licenses you’ve added in the previous 12 months. So the true-up process is essentially an inventory of all the qualified devices, users and processors added to your organization over the course of the year/term.

Tips for planning your true-up

Schedule your true-up process to initiate 120 days (MS recommended) before the anniversary date
Schedule for the declaration to be in well before the 30 day deadline prior to anniversary date
Book relevant meetings with both your Microsoft Licensing Executive as well as your Microsoft Account Manager
Identify all stakeholders (examples given above) and confirm availability for the process
Make sure you have all the tools necessary to take an accurate device & software inventory

If you would like someone to assist you during this process or any other software evaluation for that matter, please feel free to get in contact with EasySAM to discuss some of the services that we can offer you.

Written by

May Turnbull

Director

Image Credit

Suzy Hazelwood via Pexels

Follow and Subscribe

The post Basic checklists for Enterprise Agreements appeared first on EasySAM.