Bill lays out the Readiness Test, five questions to answer honestly before any purchase order: Who owns the data? When two systems disagree, which one wins? Can you produce entitlements as documents? Does a lifecycle event change a record today, without a tool? Can someone write down what the tool is for, in one sentence, with a number in it? Fail any one and a platform makes your problems more expensive instead of more visible.

Then the case for tools, made fairly: what platforms genuinely do well according to Gartner's January 2026 Market Guide, the estate where the tool is a license term rather than a maturity choice (IBM sub-capacity and ILMT), the honest cost picture, and the four signals that it is actually time to buy. Plus, a listener question from Dana in Dayton on what to do when the platform is live and nobody trusts it, the catalog room in the library, and a one-hour homework assignment that will save some organizations two years.

Sources cited: Flexera 2026 State of ITAM Report; Gartner Market Guide for Software Asset Management Tools (January 2026); IBM Passport Advantage sub-capacity licensing terms; Forrester (2013); EU AI Act Article 50.

Case files wanted. One situation, one page, anonymized: what the constraint was, what you did, what happened. Details at https://www.operationalitam.com

Next episode: the AI estate, the first asset class to arrive with a regulator attached.

Chapters:

• (00:03) - Tool Question Answered
• (04:31) - Readiness Test
• (07:42) - Market Tells On Itself
• (09:24) - What To Do Instead
• (11:22) - When Tools Make Sense
• (13:55) - When To Buy
• (16:45) - The Library Catalog Lesson
• (18:10) - Tooling Is Judgment
• (19:23) - Homework And Next Episode

An audit arrives on somebody else's schedule. A settlement is negotiated from behind. Shadow IT happens whether you sanction it or not. Disposal's best possible outcome is that nothing happens to you. The renewal is different. It is the only recurring event in asset management where the date is known years in advance, where the other side needs something from you, and where you decide when the work begins. And we blow it consistently as a profession.

This one is the 18-month clock — four positions, each with exactly one job — and the five traps written into paper you have already signed. The thesis is not subtle: in a renewal, timing beats tactics. The clever negotiator who starts 60 days out loses to the mediocre one who started 18 months out. Every lever in this episode takes months to build and four seconds to deploy.

A listener in Indianapolis writes in six weeks from a renewal whose quote just doubled, and gets an honest answer rather than an encouraging one.

IN THIS EPISODE

- Why 61% of IT leaders cut a project or initiative to pay for unplanned software cost increases — renewals are now cancelling roadmap items, not headcount
- Flat application counts and 8% more money: the growth is not sprawl anymore, it is price
- The 18-month clock — count, decide, build, ask — and the 60-day cliff most programs are actually standing on
- The version of shelfware that survives every audit and fails every business case: deployed, assigned, compliant, and completely idle
- Why leverage is a documented, costed, credible answer to "and what if we don't" — and why it never has to be executed
- Broadcom/VMware and Oracle Java as live worked examples, including opening quotes that overstated the actual footprint by 20 to 40%
- Five traps: the notice window, the uplift clause, the co-term, the discount shell game, and the multi-year commitment
- Why you should never negotiate against list price, and the one discipline that catches more money than every other tactic combined
- The University of California walking away from Elsevier, and the single reason they could

CHAPTERS

• (00:03) - Renewal Power Plays
• (03:15) - The 18-Month Clock
• (05:56) - VMware and Java Leverage
• (09:22) - Renewal Traps
• (13:58) - Six Weeks Left
• (15:46) - The Serials Department

Microsoft 365 pricing and packaging updates — the official notice. Announced 4 December, effective 1 July 2026, covering Enterprise, Business, Frontline, and Government commercial equivalents. Office 365 E3 moves from $23 to $26 per user per month, Microsoft 365 E5 from $57 to $60, with Frontline plans rising as much as 43%.
https://www.microsoft.com/en-us/licensing/news/2026-m365-packaging-pricing-updates

Zylo 2026 SaaS Management Index — 305 applications and roughly $55.7M average annual SaaS spend, up about 8% year over year on a flat application count. Also the source for 54% average license utilization, 79% of IT leaders seeing a renewal price increase, 78% hit with unexpected consumption or AI charges, and 61% cutting a project to absorb unplanned software cost.
https://zylo.com/2026-saas-management-index

VMware distributor Arrow says minimum software subs set to jump from 16 to 72 cores — The Register, 28 March 2025. The primary reporting on the minimum core-count change and the 20% penalty for subscriptions not renewed by the anniversary date.
https://www.theregister.com/2025/03/28/arrow_vmware_licensing_change/

VMware Cloud Foundation — current product and licensing information
https://www.vmware.com/products/cloud-infrastructure/vmware-cloud-foundation

Oracle Java SE Universal Subscription — the per-employee licensing metric introduced in January 2023
https://www.oracle.com/java/java-se-subscription/

Organizations are parting ways with Oracle Java for open-source alternatives — IT Brew, 29 July 2025, reporting on the joint ITAM Forum and Azul survey of 500 IT and software asset management professionals, which found 79% of organizations have migrated away from Oracle Java or plan to.
https://www.itbrew.com/stories/2025/07/29/organizations-are-parting-ways-with-oracle-java-for-open-source-alternatives

OpenJDK distributions referenced in this episode: Eclipse Adoptium, Amazon Corretto, Azul Zulu, Red Hat build of OpenJDK, and the Microsoft Build of OpenJDK

UC terminates subscriptions with the world's largest scientific publisher in push for open access — University of California, 2019. The Elsevier walk-away referenced in the library segment.
https://www.universityofcalifornia.edu/press-room/uc-terminates-subscriptions-worlds-largest-scientific-publisher-push-open-access

A note on evidence: settlement terms and negotiated pricing are almost universally covered by non-disclosure, so no public dataset of renewal outcomes exists. The advisory-firm figures on VMware settlement ranges and quote overstatement are reported observations rather than published research, and the negotiation guidance in this episode reflects thirty years on the customer side of the table. It is offered as practitioner knowledge, not as study findings.

THE COMPANION TOOL

The 90-Day Pre-Renewal Readiness Checklist executes what this episode describes — 57 checks across intake, waste signal analysis, business owner validation, and negotiation preparation, with an owner and an evidence artefact named for every item. Free, no email required.
https://www.operationalitam.com/pages/resources.html

RELATED EPISODES

Episode 003 — Software Asset Management: Proving What You Own
Episode 004 — Surviving a Software Audit, Part One: The Letter Lands
Episode 005 — Surviving a Software Audit, Part Two: The Settlement

LISTENER CASE FILES

Got a renewal you cannot justify, or a notice window closing faster than your data is coming together? Send it over — anonymized, sanitized, no company names. Just the situation, what you did, and what happened.
https://www.operationalitam.com/pages/podcast-ask.html

ABOUT THE SHOW

Operational ITAM is a podcast about the unglamorous machinery of enterprise technology — hardware and software asset management, licensing, audit defense, SaaS governance, and the money quietly leaking out of all of them.

Bill Van Nort has led IT asset management, end-user computing, IT operations, and workplace technology at large organizations across banking, mortgage, and automotive. He has reclaimed millions in software spend and survived audits from the biggest publishers on the planet.

Consulting enquiries and listener case files: operationalitam.com

Part one of two. The letter arrives — or, increasingly, the friendly invitation to a "SAM engagement" that is an audit wearing a nicer coat. What you do in the first seventy-two hours shapes everything that follows.

Bill lays out five opening moves: contain it, read the contract, control the terms, build your own position before you share anything, and control the data. Along the way: which publishers audit most aggressively, why third-party audit firms are paid by the vendor and what that means for you, why unverified script output drives more inflated claims than actual non-compliance does, and the single most expensive instinct in this situation — panic-buying licenses after the notice arrives, which frequently doesn't count toward the findings anyway.

Plus a listener question from Sandra in Grand Rapids on the soft-audit trap.

Part two picks up when the findings document lands.

IN THIS EPISODE

- The five opening moves for the first seventy-two hours
- Soft audits and "SAM engagement" invitations — the audit wearing a nicer coat
- What your contract's audit clause actually permits, and what it doesn't
- Why third-party audit firms are paid by the publisher, and what that changes
- Building your own license position before you share a single data point
- Controlling the data: what you provide, in what format, and what you never send
- Why unverified script output drives more inflated claims than real non-compliance
- The most expensive instinct in the room: panic-buying licenses after the notice
- Which publishers audit most aggressively, and what the current data shows

CHAPTERS

• (00:03) - Audit Defense Begins
• (02:11) - Audit Reality Check
• (05:10) - Five Opening Moves
• (08:00) - Negotiating Audit Terms
• (09:35) - Build Your Position
• (11:08) - Control the Data
• (13:29) - Settlement and Takeaways

Flexera 2026 State of ITAM Report — audit activity by publisher
https://www.flexera.com/blog/it-asset-management/state-of-itam-2026/

ISO/IEC 19770-1 — IT Asset Management Systems
https://www.iso.org/standard/68531.html

Audit incidence and publisher behavior in this episode is drawn from licensing advisory practice and from thirty years of firsthand audit response. Where a figure rests on industry survey data rather than primary research, it is stated as such on air.

ABOUT THE SHOW

Operational ITAM is a podcast about the unglamorous machinery of enterprise technology — hardware and software asset management, licensing, audit defense, SaaS governance, and the money quietly leaking out of all of them.

Bill Van Nort has led IT asset management, end-user computing, IT operations, and workplace technology at large organizations across banking, mortgage, and automotive. He has reclaimed millions in software spend and survived audits from the biggest publishers on the planet.

Consulting enquiries and listener case files: operationalitam.com

The pilot episode. Host Bill Van Nort opens the series with three decades of enterprise IT leadership behind him — banking, mortgage, automotive — and a straightforward thesis: buried inside a boring-sounding phrase are millions of dollars, real career leverage, and some of the best war stories in enterprise technology.

This episode establishes the four fundamentals every program must answer: know what you have, know where it is, know what it costs, know when it leaves. Bill explains why asset management is ultimately a trust discipline rather than an inventory discipline, states his biases up front — evidence over enthusiasm, customer over publisher, simple over clever — and previews the season ahead.

Plus: a listener question from Mike in Columbus on what to do when leadership says an ITAM tool isn't in the budget.

IN THIS EPISODE

- Why nobody notices asset management until it's broken
- The four fundamentals: know what you have, where it is, what it costs, when it leaves
- Why IT asset management is really about trust, not assets
- How the same fifteen questions wear two hundred different outfits
- Starting an ITAM program with no tool and no budget
- What license compliance actually costs when nobody is keeping score
- The show's format, biases, and what's coming this season

CHAPTERS

• (00:23) - Podcast Opening
• (01:15) - Why Asset Counts Matter
• (02:05) - The Four Fundamentals
• (02:46) - Invisible Until Broken
• (03:16) - The Cost of Chaos
• (04:16) - Human Side of ITAM
• (05:01) - Show Format Explained
• (05:29) - Bill’s Background
• (06:17) - ITAM Is About Trust
• (06:59) - What’s Coming Next
• (07:16) - Start Without a Tool
• (08:04) - Why This Podcast Exists
• (08:45) - Show Biases and Principles
• (09:24) - Season Preview
• (10:09) - Listener Case Files
• (10:35) - Who This Show Isn’t For
• (11:01) - New Names, Same Discipline
• (11:46) - Closing Thanks
• (12:21) - Final Takeaway

ISO/IEC 19770-1 — IT Asset Management Systems standard
https://www.iso.org/standard/68531.html

IAITAM — International Association of IT Asset Managers
https://www.iaitam.org

LISTENER CASE FILES

Got a situation you'd like worked on air? Send it over — anonymized, sanitized, no company names. Real constraints, real politics, real budgets. operationalitam.com

ABOUT THE SHOW

Operational ITAM is a podcast about the unglamorous machinery of enterprise technology — hardware and software asset management, licensing, audit defense, SaaS governance, and the money quietly leaking out of all of them.

Bill Van Nort has led IT asset management, end-user computing, IT operations, and workplace technology at large organizations across banking, mortgage, and automotive. He has reclaimed millions in software spend and survived audits from the biggest publishers on the planet.

Consulting enquiries and listener case files: operationalitam.com

At the end of life, a device stops being an asset and becomes a liability with a serial number. Disposal is the only gate in the lifecycle where getting it wrong doesn't cost you efficiency or budget — it costs you a regulator.

This episode covers what actually changed when NIST published SP 800-88 Revision 2 in September 2025 and withdrew Revision 1 the same day: the shift from a device-by-device technical manual to a program-level governance framework, the deferral of technique detail to IEEE 2883, the retirement of degaussing and multi-pass overwriting, and new language on establishing trust in a vendor's implementation. Then the regulatory stack — GLBA, FACTA, HIPAA, PCI DSS, Sarbanes-Oxley, Regulation S-P — and why one device can sit under five frameworks at once.

The centerpiece is a public enforcement case. Morgan Stanley paid $95 million across two regulators after handing roughly 4,900 devices to a moving and storage company with no data destruction experience. Devices reached an internet auction site with unencrypted customer information intact. Every control that failed was an asset management control.

Plus a listener question from Marcus in Fort Wayne on whether wiping drives in-house before they reach the ITAD vendor is duplicated effort.

IN THIS EPISODE

- NIST SP 800-88 Revision 2 — published September 2025, Revision 1 withdrawn the same day
- Why the media-specific tables were removed and what replaced them
- Clear, Purge, Destroy — what survived and what didn't
- Why degaussing and multi-pass overwriting are the wrong answer for modern media
- Cryptographic erase, and why it's the one technique NIST kept
- Should you wipe in-house before the ITAD vendor? A listener question
- The Morgan Stanley case: $95 million, 15 million customers, 42 unaccounted servers
- The regulatory stack, and why one device sits under five frameworks
- R2v3, e-Stewards, and NAID AAA — what each actually verifies
- The downstream gap auditors find over and over
- What makes a certificate of destruction defensible, and what makes it worthless
- Deaccession, the ledger, and why the shredder isn't the point

CHAPTERS

• (00:03) - Disposal’s Hidden Liability
• (01:31) - NIST 800-88 Changes
• (05:47) - The $95 Million Failure
• (10:21) - Rules, Vendors, and Proof
• (15:50) - The Ledger Matters Most

NIST SP 800-88 Rev. 2 — current standard, published 26 September 2025
https://csrc.nist.gov/pubs/sp/800/88/r2/final

NIST announcement and summary of changes from Revision 1
https://www.nist.gov/news-events/news/2025/09/guidelines-media-sanitization-nist-publishes-sp-800-88r2

NIST SP 800-88 Revision 1 — withdrawal notice
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf

IEEE 2883 — Standard for Sanitizing Storage
https://standards.ieee.org/ieee/2883/10277/

SERI — R2v3 standard and certified facility directory
https://sustainableelectronics.org

e-Stewards certified recycler directory
https://e-stewards.org/find-a-recycler/

i-SIGMA — NAID AAA certification
https://isigma.org

Note: NIST SP 800-88 Revision 1 (2014) was withdrawn and superseded in September 2025. A great deal of the ITAD guidance still circulating online cites the withdrawn version.

LISTENER CASE FILES

Got a situation you'd like worked on air? Send it over — anonymized, sanitized, no company names. Real constraints, real politics, real budgets. operationalitam.com

ABOUT THE SHOW

Operational ITAM is a podcast about the unglamorous machinery of enterprise technology — hardware and software asset management, licensing, audit defense, SaaS governance, and the money quietly leaking out of all of them.

Bill Van Nort has led IT asset management, end-user computing, IT operations, and workplace technology at large organizations across banking, mortgage, and automotive. He has reclaimed millions in software spend and survived audits from the biggest publishers on the planet.

Consulting enquiries and listener case files: operationalitam.com

Somebody in your organization decided how long a laptop lives. Ask where that number came from and you'll usually get "it's industry standard," "that's what the lease term was," or a long pause. Meanwhile it quietly determines a seven-figure line item every year.

This episode doesn't hand you a number. It hands you a method. The Three Curves — failure, cost, and value — each measurable in your own environment from data you already have, and where they intersect is your refresh cycle rather than a vendor's.

Along the way: why the widely quoted refresh statistics don't survive being traced to their sources, what actually fails in a modern laptop and why it's cheaper to fix than you think, the residual value you forfeit by stretching a cycle, and how the Windows 11 hardware requirements turned refresh from a hardware question into a platform runway question.

Plus a listener question from Tony in Toledo, whose CFO wants to move from four years to six — and the argument that actually works in that meeting.

IN THIS EPISODE

- Why most refresh cycles have no documented origin
- The provenance problem: tracing the widely quoted statistics back to dated or vendor-funded sources
- Curve one — failure: what actually breaks in a modern laptop, and why it's rarely the drive
- Curve two — cost: building your own support-cost-by-age curve in an afternoon
- Why the cost curve turns upward exactly when the warranty expires
- Curve three — value: the residual recovery you forfeit by stretching the cycle
- Paying twice, in two different budgets, across an accounting seam
- How Windows 11 hardware requirements changed refresh from hardware to platform runway
- Buying for supported life rather than unit price
- The AI PC question, and whether NPU capability justifies acceleration
- Weeding the collection: why librarians never withdraw a book for turning four
- Segmenting the fleet — why one cycle is wrong for most of your users

CHAPTERS

• (00:03) - Refresh Debate Begins
• (02:22) - The Three Curves
• (04:09) - Failure and Cost
• (07:01) - Push Back with Data
• (07:22) - The Value Curve
• (08:46) - Security Changes the Game
• (11:01) - The Library Analogy
• (12:01) - Segment Your Fleet
• (12:39) - Refresh Is Economics
• (14:02) - Disposal Next Time

Microsoft — Windows 10 end of support
https://www.microsoft.com/en-us/windows/end-of-support

Microsoft — Windows 11 system requirements
https://www.microsoft.com/en-us/windows/windows-11-specifications

A note on evidence: the refresh statistics circulating in this field are unusually poorly sourced. Figures on failure rates and support costs for aging hardware typically trace back either to studies more than a decade old or to research funded by hardware manufacturers. This episode deliberately avoids quoting them. The Three Curves framework exists so you can measure your own environment instead of borrowing someone else's number.

LISTENER CASE FILES

Got a situation you'd like worked on air? Send it over — anonymized, sanitized, no company names. Real constraints, real politics, real budgets. operationalitam.com

ABOUT THE SHOW

Operational ITAM is a podcast about the unglamorous machinery of enterprise technology — hardware and software asset management, licensing, audit defense, SaaS governance, and the money quietly leaking out of all of them.

Bill Van Nort has led IT asset management, end-user computing, IT operations, and workplace technology at large organizations across banking, mortgage, and automotive. He has reclaimed millions in software spend and survived audits from the biggest publishers on the planet.

Consulting enquiries and listener case files: operationalitam.com

The instinct is to treat shadow IT as rebellion — something to be found, blocked, and punished. That instinct is why it keeps happening.

This episode reframes unsanctioned technology as a demand signal. Every credit card SaaS subscription is a documented case of someone needing a capability badly enough to solve it themselves. The security exposure and license liability are real, and this episode does not soften them. But the durable fix isn't enforcement; it's service.

Bill covers how to find what's actually running, how to triage it by risk rather than by annoyance, and how to build an intake path fast enough that going around IT stops being the rational choice. The measure of an ITAM program isn't how much it prevents. It's how little anyone needs to go around it.

IN THIS EPISODE

- Why shadow IT is a demand signal, not a discipline problem
- Business units now control the overwhelming majority of SaaS spend — and what that means
- Finding what's actually running: expense reports, SSO logs, network data, and their blind spots
- Triage by risk, not by annoyance — a practical severity model
- The real exposure: data residency, license liability, and orphaned admin accounts
- AI-native tools entering through expense reports faster than governance can respond
- Building an intake path fast enough that going around IT stops making sense
- Why enforcement-first programs generate more shadow IT, not less
- Service as the organizing principle — measuring how little anyone needs to route around you

CHAPTERS

• (00:02) - Hunting Shadow IT
• (03:22) - Shadow IT Costs
• (06:31) - Shadow AI Rises
• (09:20) - Finding Hidden Tools
• (11:30) - What To Do Next
• (14:20) - Refresh Debate Next

Zylo 2026 SaaS Management Index
https://zylo.com/2026-saas-management-index

Findings summary and methodology
https://zylo.com/news/2026-saas-management-index

Flexera 2026 State of ITAM Report
https://www.flexera.com/blog/it-asset-management/state-of-itam-2026/

IBM Cost of a Data Breach Report
https://www.ibm.com/reports/data-breach

ABOUT THE SHOW

Operational ITAM is a podcast about the unglamorous machinery of enterprise technology — hardware and software asset management, licensing, audit defense, SaaS governance, and the money quietly leaking out of all of them.

Bill Van Nort has led IT asset management, end-user computing, IT operations, and workplace technology at large organizations across banking, mortgage, and automotive. He has reclaimed millions in software spend and survived audits from the biggest publishers on the planet.

Consulting enquiries and listener case files: operationalitam.com

Part two of two, picking up exactly where the last episode left off: the findings document has landed and the number on it is worse than you expected.

That number is a negotiating position. This episode covers how publisher claims get inflated in the first place, why opening claims routinely land several times higher than eventual settlements, what the publisher actually wants out of this — which is rarely the cash figure in front of you — and how zero-cash resolutions get traded into renewal and subscription commitments instead.

Audit defense ends in commerce. The practitioners who understand that walk away with a business outcome. The ones who treat it as a compliance verdict write the check.

IN THIS EPISODE

- Why the findings document is an opening position, not an invoice
- How claims get inflated: measurement errors, wrong metrics, and unverified assumptions
- Auditing the audit — challenging methodology before you challenge the number
- What the publisher actually wants, and why it's rarely the cash figure
- Zero-cash resolutions: trading findings into renewal and subscription commitments
- Where the leverage sits, and the timing that determines who has it
- Back maintenance, penalties, and which line items are genuinely negotiable
- Getting it in writing: release language and what a settlement should close
- Building the evidence discipline that prevents the next one

CHAPTERS

• (00:02) - Audit Defense Payoff
• (02:43) - Claim Anatomy Unpacked
• (04:14) - Rebuild the Count
• (06:17) - Trading for Settlement
• (10:39) - Locking the Paper
• (11:44) - Fix the Leaks
• (12:27) - Library Fee Lesson
• (13:12) - Four-Part Audit Game

Flexera 2026 State of ITAM Report
https://www.flexera.com/blog/it-asset-management/state-of-itam-2026/

ISO/IEC 19770-1 — IT Asset Management Systems
https://www.iso.org/standard/68531.html

A note on evidence: software audit settlements are almost universally subject to non-disclosure terms, which means no public dataset of settlement outcomes exists. The negotiation guidance in this episode reflects licensing advisory practice and thirty years of firsthand experience on the customer side of the table. It is presented as practitioner knowledge, not as research.

ABOUT THE SHOW

Operational ITAM is a podcast about the unglamorous machinery of enterprise technology — hardware and software asset management, licensing, audit defense, SaaS governance, and the money quietly leaking out of all of them.

Bill Van Nort has led IT asset management, end-user computing, IT operations, and workplace technology at large organizations across banking, mortgage, and automotive. He has reclaimed millions in software spend and survived audits from the biggest publishers on the planet.

Consulting enquiries and listener case files: operationalitam.com

Hardware asset management is a custody discipline. This episode walks the full lifecycle gate by gate — request, procure, receive, deploy, maintain, recover, dispose — and applies the same three questions at every stage: what is this gate, what data has to be captured here, and how does it typically fail?

Part two moves to the end of life, where the risk concentrates: data sanitization under NIST SP 800-88 Revision 2, what R2v3, e-Stewards, and NAID AAA certifications actually mean when you're selecting an ITAD vendor, the real economics behind refresh cycle decisions, and ghost assets — the machines your records insist you still own.

If your inventory can't survive a simple question about where a specific laptop is today, this is the episode that fixes it.

IN THIS EPISODE

- The seven gates of the hardware lifecycle: request, procure, receive, deploy, maintain, recover, dispose
- What data has to be captured at each gate, and how each one typically fails
- Ghost assets: why your records insist you own machines that left two years ago
- Refresh cycle economics, and what the failure-rate data actually supports
- Data sanitization under NIST SP 800-88 Revision 2, and why Revision 1 is withdrawn
- Choosing an ITAD vendor: what R2v3, e-Stewards, and NAID AAA actually certify
- Why degaussing and multi-pass overwriting are the wrong answer for modern flash media
- Custody as the organizing principle behind every hardware asset decision

CHAPTERS

• (00:03) - HAM Lifecycle Overview
• (01:40) - Request and Approval
• (02:48) - Procurement Records
• (04:00) - Receiving the Asset
• (05:01) - Deployment and Assignment
• (06:22) - Maintenance Insights
• (07:32) - Asset Recovery
• (09:03) - Secure Disposal
• (12:59) - Refresh Strategy
• (14:26) - Ghost and Zombie Assets
• (15:36) - Library Analogy
• (16:19) - Custody Discipline

NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization (current standard, September 2025)
https://csrc.nist.gov/pubs/sp/800/88/r2/final

Full text (PDF)
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r2.pdf

IEEE 2883 — Standard for Sanitizing Storage
https://standards.ieee.org/ieee/2883/10277/

SERI — R2v3 standard and certified facility directory
https://sustainableelectronics.org

e-Stewards certified recycler directory
https://e-stewards.org/find-a-recycler/

i-SIGMA — NAID AAA certification
https://isigma.org

Note: NIST SP 800-88 Revision 1 (2014) was withdrawn and superseded in September 2025. Much of the ITAD guidance circulating online still cites the withdrawn version.

ABOUT THE SHOW

Operational ITAM is a podcast about the unglamorous machinery of enterprise technology — hardware and software asset management, licensing, audit defense, SaaS governance, and the money quietly leaking out of all of them.

Bill Van Nort has led IT asset management, end-user computing, IT operations, and workplace technology at large organizations across banking, mortgage, and automotive. He has reclaimed millions in software spend and survived audits from the biggest publishers on the planet.

Consulting enquiries and listener case files: operationalitam.com

Crossing over to the intangible side of the house. Where hardware asset management is about custody, software asset management is about evidence — and the evidence standard is considerably higher, because the party asking to see it has a financial interest in the answer.

This episode covers the discipline of reconciling what's deployed against what you're entitled to deploy: how publisher licensing metrics actually work, why an installation count is not a license position, and how to construct an Effective License Position that holds up when someone external is checking your arithmetic.

The homework matters more than usual on this one. The entitlement library you build here is the same document that determines how the next two episodes go for you.

IN THIS EPISODE

- Why software asset management is an evidence discipline, not an inventory discipline
- Entitlements versus installations, and why counting deployments proves nothing
- How publisher licensing metrics actually work — per-user, per-device, per-core, per-employee
- Building an Effective License Position that survives external scrutiny
- Oracle's per-employee Java licensing and what it changed
- VMware under Broadcom: subscription-only, per-core, and the sixteen-core minimum
- Where the money hides: unused licenses, wrong editions, and unclaimed downgrade rights
- The entitlement library — your homework, and the foundation for audit defense

CHAPTERS

• (00:02) - Software Asset Basics
• (03:26) - Entitlements and Proof
• (05:30) - Deployment Discovery
• (08:08) - Audit Threats
• (13:13) - SaaS Waste
• (16:04) - Evidence Over Custody

Oracle Java SE Universal Subscription (per-employee licensing)
https://www.oracle.com/java/java-se-subscription/

Broadcom / VMware Cloud Foundation licensing
https://www.broadcom.com/products/software/vmware-cloud-foundation

Zylo 2026 SaaS Management Index
https://zylo.com/2026-saas-management-index

Flexera 2026 State of ITAM Report
https://www.flexera.com/blog/it-asset-management/state-of-itam-2026/

ISO/IEC 19770-1 — IT Asset Management Systems
https://www.iso.org/standard/68531.html

ABOUT THE SHOW

Operational ITAM is a podcast about the unglamorous machinery of enterprise technology — hardware and software asset management, licensing, audit defense, SaaS governance, and the money quietly leaking out of all of them.

Bill Van Nort has led IT asset management, end-user computing, IT operations, and workplace technology at large organizations across banking, mortgage, and automotive. He has reclaimed millions in software spend and survived audits from the biggest publishers on the planet.

Consulting enquiries and listener case files: operationalitam.com