Answers to your Top 20 Questions about an Oracle License Review or Oracle License Audit

October 17th, 2014

Make software licensing an exciting opportunity to improve your business.

2

INTRODUCTION Many end-users of Oracle’s software programs are on a regular basis confronted with an Oracle License Review or an Oracle License Audit from Oracle’s License Management Services (LMS) department. A lot of questions, concerns, and remarks have been raised by many end-users around this subject. This white paper is meant to provide you answers to the Top 20 Questions you might have when facing an Oracle License Review or Oracle License Audit. The content of this whitepaper is based upon our experience of the last 20 years in which we performed Oracle License Reviews or Oracle License Audits ourselves and supported end-users to effectively go through such a process. Answers on the following questions are included in this white paper:

1. What is an Oracle License Audit and what is the difference with an Oracle License Review? ........................ 4

2. What is Oracle License Management Services (LMS)? ...................................................................................... 5

3. What happens during an Oracle License Audit? .................................................................................................. 5

4. How much advance notice does Oracle give for an audit? ................................................................................. 6

5. How often should we expect to be audited? .......................................................................................................... 7

6. Why did I get selected for an Oracle License Audit? ........................................................................................... 7

7. Do I need to pay special attention to licensing Oracle software, if I have outsourced my IT? ........................ 8

8. Who pays the costs for an audit? ........................................................................................................................... 8

9. We had no idea that we were out of compliance. Won’t Oracle be more lenient with us? ............................. 9

10. Am I required to install/deploy the scripts from Oracle LMS during an audit? ............................................ 10

11. When I run the measurement scripts, can I figure out myself whether I am compliant or not? .................. 10

12. We are using an Oracle verified Tool Vendor during the audit, so I am safe, right? ....................................... 11

13. What software programs are typically included in an Oracle License Audit? ................................................. 12

3

14. Oracle provided me with a list of all or our licenses. It looks OK to me. Are we done? ................................ 12

15. What are some common errors that occur in automated software inventories? ............................................ 13

16. We have reached a settlement; should I be concerned about anything else? ................................................. 13

17. What kind of data elements do I need to inventory for an Oracle License Audit? ......................................... 14

18. Our employees are spread throughout the world and at different locations.

How can I prevent them from installing unlicensed software? ......................................................................... 15

19. We understand all the risks and have decided to do our own self-audit.

What kind of errors should we be aware of while we investigate our own software licensing usage? ........... 15

20. What is the trigger to license Oracle software:

Once the software is installed or once the software is in use? ........................................................................ 17

About b.lay ................................................................................................................................................................... 18

About the author ......................................................................................................................................................... 19

4

ANSWERS TO YOUR TOP 20 QUESTIONS ____________________________________________________________________________________________________________

1. WHAT IS AN ORACLE LICENSE AUDIT, AND WHAT’S THE DIFFERENCE WITH AN ORACLE LICENSE REVIEW? Whenever you install an Oracle program, whether as an individual or as a corporation, you agree to the terms and conditions of a license agreement. In the past, this agreement was called OLSA (Oracle License and Services Agreements) but nowadays this agreement is called OMA (Oracle Master Agreement). These agreements specify under which terms and conditions that you are allowed to make use of the Oracle programs but also provide Oracle the permission to perform an audit. Oracle’s License Management Services (LMS) is the department within Oracle that typically performs the audits on behalf of Oracle Corporation, supported by a number of third parties (LMS partners) that can perform the audit on behalf of Oracle LMS. Oracle LMS is chartered to perform license audits at end-users and partners. However, in some countries, local sales representatives start a license audit or license review themselves, typically by selling this to an end-user as a “license optimization” or “business review” or by conducting the “audit” themselves. During an audit, you are requested to complete an Excel overview (Oracle Server Worksheet) with the details of your IT infrastructure. In addition, you might be requested to run scripts on your servers or to execute various commands on the different software programs. The completed overview and the output log files, are requested to be sent back to Oracle for analysis purposes. At the end, the results of the analysis are formalized in a final report, through which Oracle presents you with your license compliance status. If you agree to pay for the necessary licenses to become compliant, the process usually ends there. If you ignore the request for a license review or license audit, the issue may be turned over to Oracle’s License Management Services department (in case the project was initially started by sales representatives) or otherwise to Oracle’s Legal Department. Not cooperating with an official Oracle audit will be considered as a material breach of the license agreement resulting in legal steps from Oracle’s side.

5

But what’s the difference between an Oracle License Review and an Oracle License Audit? In essence, there is no difference. Oracle’s License Management Services department speaks about an Oracle License Review instead of an Oracle License Audit in order to reflect the fact that they require collaboration from the end-user and to make it sound friendlier. However, a license review still concerns an assessment or analysis of your usage to verify your license compliance; thus, an audit of your usage is still being performed. Due to the terminology use of “License Review”, end-users are often confused or unaware of the fact that this license review is actually a license audit. In addition, it is the reason why the notification letter for a License Review normally also refers to one specific clause in your agreement; the audit clause. 2. WHAT IS ORACLE LICENSE MANAGEMENT SERVICES (LMS)?

Oracle License Management Services (LMS) is the department within Oracle that is chartered to protect Oracle’s contractual and intellectual property rights by executing licensing audits at Oracle’s customers and partners. Oracle LMS is

part of Oracle’s Finance organization and is a global organization with a couple hundred employees with a presence in almost every country. LMS works closely together with the different sales organizations. Although other representatives of Oracle (e.g. Oracle Sales Representatives or Compliance Optimization License Sales representatives) perform a similar type of activities by conducting “business reviews”, the License Management Services department is the only department that is officially chartered to perform License Audits on behalf of Oracle Corporation. Further details around Oracle’s License Management Services department can be found through: http://www.oracle.com/us/corporate/license-management-services/index.html 3. WHAT HAPPENS DURING AN ORACLE LICENSE AUDIT? The audit starts when you receive a notification letter in which you are notified that you have been selected for a license audit or license review. The LMS consultant that performs the audit or the LMS partner that is selected for the audit is listed in the letter as well. Typically, the letter specifies which legal entities and which Oracle software programs are included in the scope of the audit and it is sent to the CIO and/or CFO of your organization. The letter is sent to the CFO and the CIO in order to make sure that the audit gets the highest attention within your organization and to escalate to in case Oracle feels that an organization is not cooperating with the audit. You are requested to assign a single point of contact within your organization, which will act as the coordinator for the audit from your side. This person is required to coordinate with the different IT staff members to provide the requested information. At the start of the audit, an introduction or “kick-off” meeting will be scheduled in which the auditors will explain the process to follow. One of their aims is to discuss and agree the project milestones and dates on

6

which the information requested will be provided. The suggested methodology will include them asking you to complete an Excel template (called Oracle Server Worksheet) that includes a number of details describing your IT infrastructure. In addition, the auditors will typically ask you to install and run different scripts that collect software installation and/or usage data. Your internal (and outsourced) IT infrastructure employees, Database Administrator(s) and Business Application Managers are typically the people who need to provide this information. Once all the data is shared with Oracle, the data will be analyzed. As a result of the analysis, a number of additional validation and/or follow up questions will be asked. You will be requested to answer all these questions until the total deployment and usage of the Oracle programs are clear. The conclusion of this analysis is then aggregated in a formal report, stating your current license compliance position. End-users are not required to sign-off or approve this report; it’s Oracle’s formal notification of any identified breach of your current license agreement (if any). Another meeting is typically scheduled in which you will get an explanation of the findings. The final report is then handed over to your sales representatives and is chartered to commercially resolve the identified non-compliance issues within a period of 30 days, as per your agreement and Oracle’s Compliance Policy. 4. HOW MUCH ADVANCE NOTICE DOES ORACLE GIVE FOR AN AUDIT? The terms of the standard agreement states, “Upon 45 days’ written notice, Oracle may audit your use of the software programs”. If end-users have been keeping good, complete, and accurate records of their software deployments, 45 days should be ample time to respond to the audit request. It’s, however, not uncommon that Oracle’s auditors will typically try to start the audit earlier (within the 45 days written notice). End-users typically don’t have a complete and accurate understanding of the software programs deployed within their organization. As a result of this, the 45 days written notice is typically not enough for end-users to be completely prepared for the audit; it is just impossible for an end-user to have all the knowledge and expertise in-house in order to determine correctly what the outcome of the review or audit will be. A limited number of end-users may not have an audit clause in their license agreements or may have a non-audit period within its agreements; this, however, does not mean that a vendor like Oracle cannot start an audit. Local (or European) laws provide software vendors by law the right to validate - at all times - if an end-user is following the terms and conditions under which it has provided the right end-users to make use of its software. The lack of an audit clause, however, typically means that the procedure to start such an audit (by requesting a court to formalize this) takes longer, due to the lack of a contractual basis.

7

5. HOW OFTEN SHOULD WE EXPECT TO BE AUDITED? The common practice is that every end-user is on average audited by Oracle or one of its LMS partners, once every 3-4 years. Oracle applies this “once every 3-4 years average” since Oracle knows as well that end-users typically will renew their hardware every 3-4 years. Since the number of licenses needed to license the Oracle software to a large extent depends on the hardware on which the software is deployed, (especially for database and middleware programs) this interval of every 3-4 years is applied. Obviously this interval can vary in case Oracle expects a non-compliance situation at an earlier stage or in case a previous audit was limited to a part of the software programs deployed within your organization. In addition, this interval can obviously also be dependent on the amount of auditors available within a country and their local workload. 6. WHY DID I GET SELECTED FOR AN ORACLE LICENSE AUDIT? The typical answer of the auditors will be that you are randomly selected. In essence there are, however, two different channels through which end-users are typically nominated for an Oracle License Audit: Oracle’s Sales organization or Oracle’s License Management Services (LMS) department. In case your Oracle Sales representative gets the feeling or got some indications of potential non-compliance he or she can nominate you as an end-user for an Oracle License Audit. The LMS department will then assess the financial risk of non-compliance after which they will decide to fulfill or deny the request to perform an audit. The LMS department performs the risk analysis themselves as well on a regular basis. This analysis will include criteria on which end-users are assessed in order to determine the risk of non-compliance and the estimated financial risks Oracle Corporation may face. Criteria that are included in such an analysis are, for example, the last purchase date of your Oracle software. Since a change of your hardware typically takes place every 3-4 years and a change in your hardware typically requires a change in your Oracle software licenses, no new purchase of Oracle licenses indicates a potential risk of non-compliance. The date on which the last audit took place is another criterion. Obviously, a recently performed audit results in a lower risk of non-compliance, an audit that was done more than 3 years ago typically results in a higher risk of non-compliance. Older license metrics (e.g. Named User, Concurrent Device, Universal Power Unit) are no longer sold by Oracle for a number of years now, since they typically can’t be used anymore to cover today’s software deployment correctly. End-users with old license metrics are, therefore, having a higher risk of non-compliance and, therefore, earlier selected for a license audit. Recent mergers, acquisitions, and/or divestures of legal entities typically require a change in your software license agreement as well since these organizational changes typically result in a change of your software deployment and, therefore, that requires a change of your software license agreements as well.

8

7. DO I NEED TO PAY SPECIAL ATTENTION TO LICENSING ORACLE SOFTWARE IF I HAVE OUTSOURCED MY IT? Yes you should! First of all, since – as the end-user of the software – you remain responsible for the license compliance position of the Oracle software; including the software that you have outsourced to a third party. Secondly, because licensing Oracle’s software almost always to a large extent depends on the hardware/servers on which the Oracle software is deployed. So in case an end-user decides to outsource its IT to a third party, the outsourcer typically decides on the hardware platform (virtualization technology used, hardware used) to deploy the Oracle software programs. The service level agreement (SLA) between the end-user and the outsourcer covers key performance indicators such as “performance”. In order to meet the performance, outsourcers typically choose for a larger or more flexible hardware infrastructure, to avoid any claims from the end-user due to a lack of performance. But more or larger servers (in terms of capacity) and a more flexible hardware infrastructure (e.g. virtualization through VMware) require the end-user to buy more Oracle licenses. Due to the lack of controls and transparent reporting mechanisms between the outsourcer and the end-user (which are typically not in line with the license agreements) it results very often in (large) non-compliance situations with huge financial risks and the end-user is responsible towards Oracle. 8. WHO PAYS THE COSTS FOR AN AUDIT?

As per the terms of the license agreement, you are responsible for any of your costs that are incurred in cooperating with the audit. Some vendors state that if your organization is using more than 5% or 10% than you have licensed you will be required to pay the costs of the auditor by the vendor; for Oracle this is not the case. Oracle is responsible for their costs. However, the time and money you need to spend on multiple internal resources (procurement, IT staff) and/or the time and money of your outsourcer(s) are for your own account. In case you are found to be non-compliant for the deployment and/or use of any of the Oracle software programs, you are required to pay any fees applicable to your use of these programs. In such a non-compliance situation, Oracle will refer you to its Compliance Policy and your agreement will require you to purchase the appropriate licenses and related support maintenance fees within 30 days. These fees are typically charged without any additional discounts. In case you have a “price hold” with agreed discount levels for the software programs you are found to be non-compliance, the price hold prices are typically applied. In case you are willing to pay for additional licenses for the future deployment of other Oracle programs, a higher discount may be granted. Apart from the license and support fees that you will need to pay to be correctly licensed, Oracle will charge you so called “Back Support” fees. “Back Support” fees are the support fees that Oracle “missed” for the period in which an end-user has made unlicensed use of the software programs. These are calculated as 22% of the net license price prorated back to the date it was determined that the end-user was using the un-owned licenses.

9

As an example: If an end-user has 2 Processor licenses Oracle Database Enterprise Edition and is found to make use of 3 Processor licenses, Oracle Database Enterprise Edition for a period of 6 years, an end-user would have to pay the following fees: List License: USD 47,500 List Support: USD 10,450 Standard Discount: 10% Net License: USD 42,750 Net Support: USD 9,405

Back support (6 years): 6 years x 9,405 = USD 56,430 Total fees: 42,750 + 9,405 + 56,430 = USD 108,585 9. WE HAD NO IDEA THAT WE WERE OUT OF COMPLIANCE. WON’T ORACLE BE MORE LENIENT WITH US? No. As per your agreement and Oracle’s Compliance Policy; if an end-user licenses the software, it is the end-user’s responsibility to ensure that they are utilizing their licenses in accordance with the terms and conditions of the license agreements. Therefore, it is the customer’s responsibility to ensure that they understand their license rights (including the licensing policies, support policies, program documentation etc.) and that they are complying with those obtained rights. In case of a non-compliance situation it is important to settle properly with Oracle, as a similar scenario as yours has probably been played out a million times between Oracle and other end-users. Oracle obviously would not want to lose a customer, but they also don’t want their customers using their software illegally either. Either pay up or, if you feel Oracle grossly miscalculated your license violation, consult with a law firm or consultant with expertise in this area.

10

10. AM I REQUIRED TO INSTALL/DEPLOY THE SCRIPTS FROM ORACLE LMS DURING AN AUDIT? No. As per the audit clause of your agreement “you agree to cooperate with Oracle’s audit and provide reasonable assistance and access to information. Any such audit shall not unreasonably interfere with your normal business operations.” So the clause does not specify that you are required to install/deploy the scripts from Oracle or from any of their verified tool vendors. You are, however, required to provide access to all the relevant information. If you are able to provide the required information in a different complete and accurate way, providing this information in such a way should be sufficient. End-users are, however, typically not able to provide the information that the scripts from Oracle gather, in a complete and accurate way, and, therefore, end up using the scripts of LMS. In case an end-user raises concerns with regards to the performance that the scripts may need, Oracle will assure you that this is minimal, which is the reality. Oracle will, however, not agree in writing that any performance issues and the costs related to this, (potentially) caused by installing/deploying the scripts will be covered by Oracle; you are installing/deploying the scripts at your own risks and/or costs and Oracle will not take any responsibility for making use of these scripts. In case an end-user raises concerns with regards to the confidentiality of the data that these scripts gather, Oracle may propose to mask this data. Oracle will, however, at all times (try to) convince you of making use of their standard (unmodified) scripts so that their technical analysis team can automatically load and analyze the data on their database systems to determine your current usage of the Oracle software programs. 11. WHEN I RUN THE MEASUREMENT SCRIPTS, CAN I FIGURE OUT MYSELF WHETHER I AM COMPLIANT OR NOT? No. The scripts only gather deployment and usage information about Oracle products that are installed and /or used in your IT environments and provisional usage data. The output of these scripts requires expert knowledge from Oracle or a specialized firm to analyze the data and compare them with the existing contracts in order to determine the license compliance position. In addition, it is not just one but rather multiple scripts needed to gather the specific deployment and/or usage data for the different Oracle programs. The Oracle Database itself requires for example the execution of queries on the Oracle Database itself and the execution of queries on the hardware on which the software is deployed. The Oracle Weblogic programs require other scripts to be executed on the servers on which the Oracle program is expected to be installed, Oracle Siebel requires yet another set of scripts, Oracle E-Business Suite requires another set of scripts, etc.

11

12. WE ARE USING AN ORACLE VERIFIED TOOL VENDOR DURING THE AUDIT, SO I AM SAFE, RIGHT? Oracle’s License Management Services department has verified a number of tool vendors, including BDNA, Easyteam, Flexera Software, Hewlett-Packard, iQuate, Lime Software, and Nova Ratio. The decision from Oracle LMS to “verify” these vendors has been rather smart; in case an end-user is subject to an Oracle audit and implemented any of these tools, the end-user can’t hide during the audit process that the data gathering process will require so much time and energy since you already have implemented the tool in your infrastructure!

End-user often believe (or have the perception) that since they have implemented such a tool, they are in full control of Oracle software. They forget, however, where they were not told or did not validate themselves and what the tools do; the tools only collect raw data for the Oracle Database and its associated options as the scripts from LMS do as well. The collection of raw software data for any of the (thousands of) other Oracle programs is not covered by the tool itself. In

addition, the hardware details on which the software is deployed as provided by the third party tools, is not verified by LMS. Therefore, during an audit, LMS would still require you to run their CPU queries to collect the required hardware details. “Raw” measurement data as collected by the scripts from Oracle LMS (or any of the third party tool vendors) does not tell you what you would need to license. An analysis – and more important the correct interpretation of the raw measurement data - is still required to obtain a complete and accurate understanding of the software deployment. This requires expertise knowledge that needs to be maintained. This is also the reason why Oracle LMS requires the usage data gathered from third party tool vendors (or their own tools) to be shared with themselves to assess the license needs. Only after an assessment done by the right-licensing experts, you will have a clear understanding of the real license needs. You should think about the software inventory tools as your ERP system. Every ERP has a Tax Report functionality. It’s great that you can have such an automated report since it saves you a lot of time and energy to get the numbers. However, before sending it to the Tax authorities would you let your accountant and/or Tax expert review and analyze the data coming out of your ERP system?

12

13. WHAT SOFTWARE PROGRAMS ARE TYPICALLY INCLUDED IN AN ORACLE LICENSE AUDIT? Oracle’s Product portfolio includes a large number of different software programs, also due to the large amount of acquisitions done over the years (e.g. BEA Systems, Siebel Systems, PeopleSoft, JD Edwards etc.). Any of these software programs which are owned by Oracle Corporation can be subject to an Oracle License Audit especially if there is a high (financial) risk of non-compliance. However, Oracle’s audit team typically focuses on a certain number of Oracle programs due to the large number of end-users making use of these programs and the high financial risks of non-compliance that these Oracle programs represent. The Oracle programs on which the audit team typically focuses are Oracle Database (including Database Options and Database Enterprise Managers), Oracle Application Server, Weblogic and Tuxedo (either purchased in the past through BEA or after the acquisition through Oracle), SOA, E-Business Suite, Siebel and JD Edwards. In certain countries/divisions, like the US, some focus is also placed on Agile / Autovue programs as in the EMEA some additional focus is placed on Primavera programs. 14. ORACLE PROVIDED ME WITH A LIST OF ALL OR OUR LICENSES. IT LOOKS OK TO ME. ARE WE DONE? You could be tempted to end the validation of your current licenses at this point due to the time constraints and efforts it will take you to validate the list provided by Oracle. You may assume that an organization like Oracle should be able to provide you with a complete and accurate overview of your licenses. You could, however, end-up overpaying if you don’t complete this validation. Why? In many cases where we have performed an analysis of the list of licenses as provided by Oracle vs. the actual agreements, many discrepancies were identified. Discrepancies such as the fact that license metrics may not be correctly registered within the internal systems of Oracle (e.g. after one of the many acquisitions), the current (and not the contractual) license metric definitions are applied, the products/components which are part of a certain license are not taking into account by the auditors, etc. All these differences that can potentially be identified during the validation process should be documented and dealt with in the audit process. It is, therefore, important to gather all Ordering Documents, License Agreements (either Software License & Services Agreements (SLSA’s), Oracle License & Service Agreement (OLSA) or Oracle Master Agreements (OMA’s)), Support Maintenance Renewals, Partner Ordering Forms, Partner Agreements and the corresponding program documentation (which is part of the license agreement) and any other paperwork (e.g. invoices, POs, commercial proposals/emails from the past) that provides insight into the obtained license and support rights.

13

15. WHAT ARE SOME COMMON ERRORS THAT OCCUR IN AUTOMATED SOFTWARE INVENTORIES? A Software Asset Management (SAM) tool may be a good place to start, but there will always be additional wok required to obtain accurate and comprehensive usage assessments. Most inventory tools are not able to count the number of “individuals” who are authorized to make use of the software in a “multiplexing environment”, and they are not able to de-duplicate “users” or provide (without specific expert knowledge) clarity if certain installed software programs are indeed in use and require separate licensing. Performing a proper reconciliation of the products/components for which Oracle licenses have been obtained vs the discovery installed and/or used products/components is also nearly impossible to do with any of the current available SM inventory tools. As one of the many examples, let’s have a look at an end-user that deploys Oracle’s Application Server Enterprise Edition. A software inventory/scanning tool at such an end-user, would find an Oracle Application Server installation but also an Oracle Database installation. Since the tool found both programs, it indicates that you would need to license both programs separately. Oracle’s Application Server Enterprise Edition licenses, however, do include the restricted usage right as well to make use of an Oracle Database (to store the infrastructure/configuration data). Due to the lack of this knowledge within the software inventory/scanning tools many enterprises are licensing software products twice, without being aware of the fact that they already obtained the right to deploy this specific product in one of their existing licenses. 16. WE HAVE REACHED A SETTLEMENT; SHOULD I BE CONCERNED ABOUT ANYTHING ELSE? Once thing you should include in a (commercial) settlement on identified license compliance issues by Oracle, is to receive a written conformation (“Close Letter”) from the Oracle compliance team (License Management Services). This letter should confirm that Oracle releases, discharges, and acquits your organization of and from any and all obligations, debts, liabilities, claims, causes of action, promises, penalties, interest, attorneys' fees, and all damages of all kinds and character whatsoever, (including but not limited to, license fees, maintenance fees, infringement penalties, actual, consequential, and punitive damages, known or unknown, asserted or un-asserted) arising from the identified compliance issues. If the case makes it to court, it will likely become public record and the negative publicity could be more damaging than the offense and fines.

14

17. WHAT KIND OF DATA ELEMENTS DO I NEED TO INVENTORY FOR AN ORACLE AUDIT? That is fully dependent on the terms and conditions of your license agreement(s). A detailed analysis and understanding of your contracts is, therefore, the first thing to take care of. Nevertheless, in general, the software deployment and usage details that need to be gathered can however be divided into five distinct groups of data that would need to be gathered during a license audit:

1) Hardware Inventory a. Hardware specifications (server model, no. of cpu, no. of cores per cpu, cpu type, etc.) b. Virtualization technologies used (VMWare, LPAR, Sun Solaris Containers, etc) c. Virtualization configuration (VMWare cluster, Capped/Uncapped LPARs, etc.) d. Related DR servers (failover clustering, database synchronization, san mirroring, etc.)

2) Software Inventory

a. Installation directories that indicate a certain software program to be installed? b. Key files (executable’s) that indicate a certain software program to be installed? c. Running processes that indicate a certain software program to be installed/running? d. Used ports that can be used by certain installed software programs?

3) Software Configuration

a. Specific software editions are installed (standard edition, enterprise edition etc.)? b. Specific database components installed and/or used (e.g. DB Option, DB Packs)? c. Specific middleware components configured (e.g. Coherence, Weblogic clustering)?

4) Software Usage

a. Which individuals are authorized to make use of the software? b. Which non-human operated devices are authorized to make use of the software? c. What is the “multiplexing front end” of the software? d. What application software is used in conjunction with what middleware software

and what middleware software is used in conjunction with what database software?

5) Non System usage a. Which legal entities do make use of the software programs? b. Which business units do make use of the software? c. What is the geographical location of the installed software? d. Is the software used for the business purposes of other entities (hosting)?

15

18. OUR EMPLOYEES ARE SPREAD THROUGHOUT THE WORLD AND AT DIFFERENT LOCATIONS. HOW CAN I PREVENT THEM FROM INSTALLING UNLICENSED SOFTWARE? Most users rely on IT or tooling to ensure software license compliance, but the users may not know (or adhere to) their rights with devices not controlled by the IT department. Think, for example, of the contractors and/or agents that are working within your organization on your behalf or the individuals within the outsourcing company that is maintaining your IT infrastructure. Do they all know what software programs they may install and/or use? Oracle’s software does not have any technical restrictions (like software keys) and can be easily downloaded and taken in operative use. How do these people know what they can and cannot do? An important and often overlooked aspect of SAM is to educate your employees and software users, so the guidelines are clear. Education should be an ongoing process within your company, to ensure your employees do not create a costly or uncomfortable licensing issue between your company and Oracle. 19. WE UNDERSTAND ALL THE RISKS AND HAVE DECIDED TO DO OUR OWN SELF-AUDIT. WHAT KIND OF ERRORS SHOULD WE BE AWARE OF WHILE WE INVESTIGATE OUR OWN SOFTWARE LICENSING USAGE? From our experience working with scores of clients around the world, we have discovered approximately 50-60 areas that companies frequently reported inaccurately during an audit. A number of these area’s include:

• Failure to recognize historical entitlements (products purchased 3-9 years ago) that can be used to mitigate current licensing gaps.

• Incorrect application of wrong license metrics (often the license metrics under which Oracle

nowadays sells the licenses) instead of the contractual license metric definitions and corresponding agreed terms and conditions.

• Licenses from mergers and acquisitions that can be used to mitigate current licensing gaps.

• Incomplete and/or inaccurate understanding of which products/components are part of certain

Oracle licenses that can be used to mitigate current licensing gaps. (e.g. Oracle’s Database Enterprise Edition restricted - usage rights are part of Oracle’s Internet Application Server Enterprise Edition licenses, Oracle Coherence usage rights are part of Oracle’s Web logic Suite license and many more.).

16

• Incomplete and/or lack of understanding of all data streams to and/or from the Oracle software in order to understand the “multiplexing front end” and not understanding what Oracle means with “measuring the users at the multiplexing front-end”.

• Incorrect calculations of required number of licenses needed for virtualized environments, which are

depending on technologies used and their configuration (e.g. IBM LPar, VMware VSphere, Sun Solaris Capped Containers, Oracle VM, etc.).

• Incorrect licensing of Oracle programs deployed in disaster recovery environments.

• Failure to comply with the minimum required number of licenses per Processor for all servers on

which the Oracle programs are deployed, including test, development, and acceptance environments.

• Incomplete and/or inaccurate understanding of the installed and/or used components and/or

features and/or modules (e.g. Database Options and/or Database Enterprise Managers, Human Resources, Financials etc.)

• Incorrect counting of the number of “users” by lack of de-duplication of user names, including of

system users and/or inactive user names created within the software.

17

20. WHAT IS THE TRIGGER TO LICENSE ORACLE SOFTWARE: ONCE THE SOFTWARE IS INSTALLED OR ONCE THE SOFTWARE IS IN USE? All the license metric definitions of Oracle state that the Oracle software is required to be licensed once the software is installed and/or running. This means that the trigger to license the software is once it is installed independently if the software is actively being used. Apart from the exception rules of Failover environments, Oracle, therefore, also requires you to license the software, which is installed for disaster recovery purposes. Are there no exceptions? Yes, there is one exception rule related to the deployment and use of Database Enterprise Edition Options and/or Database Enterprise Managers. Why? Oracle Database Enterprise Edition is shipped with various Database Options and Database Packs (or if the Database Enterprise Edition is downloaded, the Database Options and Packs are downloaded along with the Database Enterprise Edition program). End-users must install these Database Enterprise Edition Options and Packs and often – as a result of this – start using these separate licensable Database Enterprise Edition Options and Packs. In case these Database Enterprise Edition Options and Packs are – during the course of a license audit – found to be installed only (and not used), end-users normally receive the opportunity to sign a “Certification of Non Use” letter. With such a letter (which should be offered) the end-user certifies and warrants that it has not made operative use of the Database Options and/or Database Packs and the end-user warrants that it shall not make any operative use of the Database Options and/or Database unless and until it purchases the required licenses for such usage.

18

ABOUT B.LAY ____________________________________________________________________________________________________________

b.lay was founded with the simple philosophy that at the core of the software asset management process

there must be a consistent, well structured and reliable record of the facts. Our goal is to be innovative and

to realize long term concepts that provide clarity and tangible benefits to our clients whilst keeping an open

mind by learning from others and staying true to our personal beliefs.

b.lay provides enterprise license advisory, license contract analysis, license usage analysis, license compliance gap analysis, license optimization and license audit support services that provide insight and control, reduce costs and overspending, and align your software asset planning with your long-term business strategy. With over 500 enterprises supported globally and more than 20 years of experience within license management services around all the different Oracle software programs, b.lay is uniquely positioned to guide your company through the licensing, audit, and support renewal process. Our proven, hands-on approach saves our clients millions of dollars each year on enterprise software licenses, and helps you avoid future costs as your business evolves. Contact us today to find out how we can help you during the course of an Oracle License Review or Oracle License Audit through info@b-lay.com

19

ABOUT THE AUTHOR ____________________________________________________________________________________________________________

RICHARD SPITHOVEN Richard joined b.lay – the license management company as a partner since September 1st, 2013. Richard uses his knowledge of the last 8 ½ years in Oracle License Management Services (LMS) to educate, equip and enable software end-users in their challenges with regards to proper software license management.

Richard started in October 2005 as an Oracle Licensing Consultant, after which he fulfilled the role of Regional LMS Director for the Europe South region (including Belgium, Netherlands, Luxembourg, France, Spain, Italy and Portugal) for a period of 4 ½ years. In this role, Richard managed a team of 40 licensing consultants and was responsible for setting the strategic direction of the LMS organization. Richard holds a master degree in IT, from the University of Amsterdam in The Netherlands.

20

DISCLAIMER

The information contained in this document represents the current view of b.lay BV on the issues discussed as of the date of publication. Because b.lay must respond to changing market conditions, it should not be interpreted to be a commitment on the part of b.lay, and b.lay cannot guarantee the accuracy of any information presented after the date of publication. This White Paper is for informational purposes only. B.LAY MAKES NO WARRANTEES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted into any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of b.lay BV. b.lay may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement of b.lay, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. COPYRIGHT NOTICE. Copyright © b.lay BV, Goeman Borgesiuslaan 77, 3515 ET, Utrecht, The Netherlands. All rights reserved. TRADEMARKS. b.lay, the b.lay logo, b.lay BV, Zyncc, Lictionary, Tzin Tzin and/or other b.lay products referenced herein are either trademarks or pending trademarks of b.lay. All other trademarks are property of their respective owners.

21

Address: Goeman Borgesiuslaan 77 3515 ET Utrecht The Netherlands

URL: http://www.b-lay.com Email: info@b-lay.com