Software Licensing Compliance & the ISO 19770-2 Standards

Software publishers have many ways to license and price their product – for example they can change the underlying revenue model by throttling between a perpetual license and time-based license, as well as offer different metrics to apply product pricing, such as named user, instance, number of managed devices, number of CPU’s etc. The duration and metric can be combined to offer pay-per-use or usage-based models. Various combinations of duration and metric can enable a software publisher to bring a variety of price points to market.

One issue faced by most every software publisher in offering such a variety of software license models is how to they ensure that their products are being used within the bounds of their license agreement? The goal is to balance the revenue capture for all usage, without being a nuisance to the end-user. For some software publishers, the use of embedded technology such as a license manager to make the products “compliant aware” is one approach that has proven successful, especially in science and engineering vertical markets and high-tech equipment markets (e.g. medical, telecom and industrial control).

For other companies who sell enterprise software to large enterprises, the goal is not to embed any technology but to allow Software Asset Management (SAM) tools to detect the forensics of installed software and to gather this information into a consolidated report. This information can then be used by the customer SAM manager, and, the software publisher for a fact-based discussion on usage and fees. The rub is that virtually no software among software vendors has the same installation (or usage) “fingerprint” to make the process simple. SAM tools have to be configured to a complex set of rules that determine installation characteristics and license agreement rules to provide useful reports.

The emergence of the ISO 19770-2 standard is a leading contender to bring simplicity to this matter. By creating “software tagging” standards, it becomes easier for all stakeholders in the software production and usage chain to create, read and consume information vital to ensuring compliance to license models and agreements. This in turn leads to more standardized processes, technologies, and trained practitioners.

So far, industry adoption has been underwhelming. I often tease my colleague, David Wright, an industry compliance expert from VeriTag, that about 50 people in the world care about the ISO 19770-2 standard. I tell him that the ISO standard seems to be more of a vitamin than a medicine, a reference to an expression I hear VC’s tell people when they want to tell you that you have “an interesting idea”, but it’s not a very compelling business proposition.

But, perhaps ISO 19770-2 is on its way to becoming a compliance medicine? Symantec and Adobe are beginning to adopt it as a standard method to tag software. I see other software publishers looking to use a software tagging methodology, and see it as an intriguing possibility. There are efforts by the Federal ITAM group within the GSA to create a standard for the consumption of software, requiring the government to adhere to this standard. Perhaps this could be the tipping point?

Anyone out there feel the same way?