OMB and federal agencies have key roles and responsibilities for overseeing IT investment management. OMB is responsible for working with agencies to ensure investments are appropriately planned and justified pursuant to the Clinger-Cohen Act of 1996. The law places responsibility for managing investments with the heads of agencies and establishes chief information officers (CIO) to advise and assist agency heads in carrying out this responsibility.OMB to establish processes to analyze, track, and evaluate the risks and results of major capital investments in information systems made by federal agencies and report to Congress on the net program performance benefits achieved as a result of these investments. Additionally, this law requires Federal agencies are responsible for managing their IT investment portfolio, including the risks from their major information system initiatives, in order to maximize the value of these investments to the agency. Federal agencies expect to spend at least $82 billion in fiscal year 2014 to meet their increasing demand for IT products and services, such as purchases of software licenses. Additionally, two executive orders contain information for federal agencies relative to the management of software licenses. In particular, executive order 13103 specifies that each agency shall adopt policies and procedures to ensure that the agency uses only computer software not in violation of copyright laws. These procedures may include information on preparing agency software inventories. Additionally, as part of executive on promoting efficient spending, agencies are required to order 13589,assess current device inventories and usage, and establish controls to ensure that they are not paying for unused or underutilized IT equipment, installed software, or services. According to the Information Technology Infrastructure Library’s Guide to Software Asset Management, software licenses are legal rights to use software in accordance with terms and conditions specified by the software copyright owner. Rights to use software are separate from the legal rights to the software itself, which are normally kept by the software manufacturer or other third party. Licenses may be bought and are normally required whenever externally acquired software is used, which will typically be when the software is installed on a computer (or when executed on a computer even if installed elsewhere such as on a server). They may also be defined in enterprise terms, such as number of workstations or employees, in which case a license is required for each qualifying unit or individual regardless of actual usage. Many software products are commercial-off-the-shelf, meaning the software is sold in substantial quantities in the commercial market place. Commercial software typically includes fees for initial and continued use of licenses. These fees may include, as part of the license contract, access to product support and/or other services, including upgrades. Licensing models and definitions may significantly differ depending on the software product and vendor. For example, the guidebasic types of licenses vary by duration and measure of usage: Perpetual licenses: These licenses are when use rights are permanent once purchased. Subscription or rental licenses: These licenses are used for a specific period of time, which can vary from days to years and may or may not include upgrade rights. Temporary licenses: These licenses are pending full payment or receipt of proof of purchase. Per copy, by workstation/seat/device, name used, anonymous user, or concurrent user: Historically most licenses sold have been on a per-copy-used basis, with several different units of measure possible. Sometimes multiple users will be allowed per license Concurrent usage: This type of license allows a specified number of users to connect simultaneously to a software application. Products exist to help monitor and control concurrent usage; however, concurrent licenses are not as commonly available as per copy licenses. Per server speed or per processor: These licenses are linked to the speed or power of the server on which they run, or the number of processors within the server. Enterprise or site: These licenses are sold on an enterprise or site basis that requires a count of qualifying entities. Other complexities: Other, more complex licensing situations related to usage also exist with regard to licensing and the use of techniques such as multiplexing, clustering, virtualization, shared services, thin client, roaming services, and cloud and grid computing. The objective of software license management is to manage, control, and protect an organization’s software assets, including management of the risks arising from the use of those software assets. Proper management of software licenses helps to minimize risks by ensuring that licenses are used in compliance with licensing agreements and cost-effectively deployed, and that software purchasing and maintenance expenses are properly controlled. To help ensure that the legal agreements that come with procured software licenses are adhered to and that organizations avoid purchasing unnecessary licenses, proper management of licenses is essential. OMB and most federal agencies that we reviewed do not have adequate policies for managing software licenses. OMB has a broader IT management initiative, known as PortfolioStat, which is intended to assist agencies in gathering information on their IT investments, including software licenses. However, OMB does not have a directive guiding agencies in developing comprehensive software license management policies. Further, while 2 agencies have adequate policies for managing software licenses, the vast majority of agencies do not. Specifically, of the 24 major federal agencies, 18 have developed them, but they are not comprehensive; and 4 agencies have not developed any. The lack of robust licensing policies is due in part to the absence of direction from OMB. Without guidance from OMB or comprehensive policies, it will be difficult for the agencies to consistently and effectively manage software licenses. OMB has developed policy that addresses software licenses as part of its broader PortfolioStat IT initiative, as well as an executive order containing additional direction to the agencies. Specifically, OMB launched the PortfolioStat initiative in March 2012, and it requires agencies to conduct an annual, agency-wide IT portfolio review to, among other things, reduce commodity IT spending and demonstrate how their IT investments align with the agency’s mission and business functions. Toward this end, OMB established several key requirements for agencies, including designating a lead official with responsibility for implementing the process and consolidating at least two duplicative commodity IT areas; such areas could include software licenses. PortfolioStat is also intended to assist agencies in meeting the targets and requirements under other OMB initiatives aimed at eliminating waste and duplication and promoting shared services across the federal government, such as the Federal Strategic Sourcing Initiative.example, through the PortfolioStat process, OMB works with agencies to improve agency IT procurement processes, as outlined in the Federal Strategic Sourcing Initiative, in order to reduce prices on specific commodities that agency IT managers acquire, including software licenses. However, it is up to the agencies to decide whether software licenses should be a priority for consolidation during the PortfolioStat review. Several agencies identified enterprise software licensing as a target area for cost savings or avoidance in the plans they provided to OMB in September 2012: the Department of Housing and Urban Development (HUD), the Department of State (State), the Department of Homeland Security (DHS), and the Department of Veterans Affairs (VA). Further, while PortfolioStat can assist agencies in identifying cost savings and avoidance related to software licensing, this initiative, combined with the key executive order on more efficient software spending, is not enough to guide the agencies in developing comprehensive licensing management policies. As previously discussed, the executive order requires agencies to establish controls to ensure that they are not paying for unused or underutilized software. However, OMB lacks a directive that guides the agencies to ensure that they have appropriate policies. An official from OMB’s Office of E-Government and Information Technology stated that the PortfolioStat effort is intentionally focused on the organization as opposed to an individual area such as software license management. This official added that they have no plans to develop such guidance at this time. Until the agencies have sufficient direction from OMB, opportunities to systematically identify software license related cost savings across the federal government will likely continue to be missed. Given the absence of an OMB directive providing guidance to agencies on licensing management policy, we identified seven elements that a comprehensive software licensing policy should specify: identify clear roles, responsibilities, and central oversight authority within the department for managing enterprise software license agreements and commercial software licenses; establish a comprehensive inventory (80 percent of software license spending and/or enterprise licenses in the department) by identifying and collecting information about software license agreements using automated discovery and inventory tools; regularly track and maintain software licenses to assist the agency in implementing decisions throughout the software license management life cycle; analyze software usage and other data to make cost-effective provide training relevant to software license management; establish goals and objectives of the software license management consider the software license management life-cycle phases (i.e., requisition, reception, deployment and maintenance, retirement, and disposal phases) to implement effective decision making and incorporate existing standards, processes, and metrics. The following table provides a composite assessment of the 24 agencies’ policies on managing software license against the seven elements. Two of the 24 agencies have developed comprehensive policies for managing software licenses, the Department of Labor (Labor) and DHS. For example, in April 2013, Labor’s Office of the CIO software license management policies documented, among other things, how the agency manages installation requests and licensing of software that is applicable to its office and customers, as well as how licenses become part of its inventory. Similarly, in February 2012, DHS provided guidance that the Office of the CIO will monitor agency component usage of the enterprise license agreement software transfer process, refine the process as needed, and ensure cost avoidances are achieved. Related guidance also directs all DHS components, directorates, and offices not to use other contracting vehicles to procure software licenses once enterprise licenses are in place DHS-wide. Further, 18 agencies have taken steps to include software license management policies in their IT management policies and procedures. However, inclusion of the seven elements we identified varied with each agency. Appendix II provides detailed information describing the extent to which the 18 agencies had comprehensive policies, and the following are illustrative examples. Defense established policies that include the establishment of a comprehensive inventory of software licenses and the analysis of these data to inform investment decisions to identify opportunities to reduce costs, but the department has not developed policies on centralizing management, tracking an inventory using automated tools, providing training to appropriate personnel on managing these licenses, or considering the software license management life-cycle phases. State has policies that identify agency responsibilities regarding the management of Microsoft and Oracle enterprise license agreements and the tracking of software licenses, but has not developed a policy for establishing a comprehensive inventory, analyzing software license data to inform investment decisions, providing training on management of software licenses, establishing goals and objectives of managing software licenses, and considering the software license management life-cycle phases. The Environmental Protection Agency (EPA) has policies at the business-unit level that address centralized management, establishing inventories, and tracking software licenses using tools; however, the agency has not developed a policy for analyzing software license data to inform decision making, providing training on managing software licenses, establishing goals and objectives for managing licenses, or considering the software license management life-cycle phases. Finally, 4 agencies (the Department of Commerce (Commerce), the Department of Health and Human Services (HHS), the Department of the Interior (Interior), and the National Science Foundation (NSF)) had not developed department-wide policies for managing software licenses, according to officials. In one example, Commerce stated that it does not have policies at the department level, but instead the individual components are responsible for managing software licenses at the bureau level and may have issued relevant software license management policies. As an additional example, HHS has not established policies for managing software licenses, but stated that it plans to establish a vendor management office that will develop and manage guidance for centrally managing its software licenses. The general consensus of the agency officials we spoke to on their policy weaknesses was that they were due, in part, to the lack of a priority for establishing or enhancing department- or agency-level software license management. As noted earlier, more specific direction from OMB could assist agencies in giving more adequate attention to this area. Until agencies develop comprehensive policies related to managing software licenses, they cannot ensure that they are consistently and cost- effectively managing software throughout the agency. Federal agencies are generally not following the leading practices we identified for managing their software licenses. These practices include: centralizing management; establishing a comprehensive inventory of licenses; regularly tracking and maintaining comprehensive inventories using automated discovery and inventory tools and metrics; analyzing the software license data to inform investment decisions and identify opportunities to reduce costs; and providing appropriate personnel with sufficient training on software license management. Table 2 describes these leading practices in managing software licenses. Of the 24 major federal agencies, 4 had fully demonstrated at least one of the leading practices, and none of the agencies had implemented all of the leading practices. Table 3 outlines the extent to which each of the 24 major federal agencies have implemented leading practices for managing software licenses. Following the table is a summary of the agencies’ implementation of each key practice. Additional details on the 24 agencies are provided in appendix II. The majority of agencies have a partially centralized approach to managing software licenses. Four of the 24 agencies have a centralized approach to managing the majority (80 percent) of agency software license spending, and/or agency enterprise licenses; 15 agencies have a partially centralized approach; and 5 agencies have a decentralized approach to managing software licenses. For example, NSF manages licenses for enterprise-wide software in a centralized manner, which accounts for the majority of software used at the agency. Management of licenses for special-use software is decentralized, but it accounts for about 10 percent of the agency’s overall software inventory. With regard to the 15 with a partially centralized approach, these agencies may manage enterprise license agreements for selected software centrally, but other software, which accounts for the bulk of software used, may be managed by either agency components or individual program areas. For example, Labor manages all of the agency’s Microsoft enterprise license agreements and other software managed within the Office of the CIO. However, Labor stated it does not track software licenses of other agency components. To better centralize the management of software licenses, Labor stated that it is in the process of combining all IT components and management of their software within the Office of the CIO and this effort is expected to be completed in fiscal year 2016. The 5 agencies that have a decentralized approach for managing software licenses have delegated responsibilities to the components or individual program areas. For example, Commerce manages software licenses in a decentralized manner, where management of software licenses is delegated to the agency’s components, and the management structure within these components may vary. Agency officials stated that in some components the Office of CIO is responsible for managing software licenses, whereas other Commerce components operate in an even more decentralized manner, with individual offices being responsible for managing software licenses. However, of these five agencies, officials from two agencies (HHS and Interior) noted they are planning to move toward centralizing their approach to managing software licenses. The majority of agencies do not have comprehensive inventories of software licenses. Two of the 24 agencies have a comprehensive inventory of software licenses; 20 have some form of an inventory; and 2 do not have any inventory of their software licenses purchased. Specifically, according to HUD and NSF software license documentation, these agencies have a comprehensive inventory of software licenses that consists of the majority of the agency’s spending on software licenses and/or enterprise licenses. Twenty agencies have some form of an inventory, but they do not include the majority of the software license spending or number of licenses. For example, Energy has an inventory of software licenses within the Office of the CIO that it stated represents approximately 6 percent of the total number of users department-wide. Similarly, the Small Business Administration (SBA) has a centrally managed inventory, but the inventory is not comprehensive since it excludes information from several program offices. However, according to SBA officials, the agency has a tool to discover all software licenses on the SBA network that it expects to deploy later in fiscal year 2014. The remaining 2 agencies do not have any inventory representing the majority of software license spending or total licenses. The majority of agencies are partially tracking and managing software license deployment and usage. None of the 24 agencies are fully tracking and maintaining software license inventories. Specifically, 20 are partially tracking and managing licenses using automated discovery and inventory tools and metrics, and 4 do not track or manage software licenses with automated tools. Overall, agencies’ tracking and managing of inventories varies. For example, the Department of Agriculture (USDA) uses two automated discovery and inventory tools to capture configuration information for all end points across the department to include desktops, laptops, and servers. However, officials from the Office of the CIO noted that these reports are not produced on a regular basis and the agency is not able to track software licenses outside of enterprise license agreements. As another example, according to DHS officials, the agency does not track comprehensive inventories using automated tools and metrics, but they stated that agency components track software outside of DHS’s enterprise license agreements. However, DHS officials stated that DHS does not have visibility of the majority of the department’s licenses. Additionally, Interior is using an automated discovery and inventory tool to track 21 different applications and operating systems. According to agency officials, Interior also uses spreadsheets to manually track licenses. However, the agency is not frequently tracking, managing, and reporting on the majority of software licenses. Four agencies are not tracking and maintaining their inventories using automated discovery and inventory tools. Agencies are not adequately analyzing data to identify opportunities for cost savings in software license purchases. None of the 24 agencies are fully analyzing software license data to inform investment decisions: 15 have analyzed some data to inform investment decisions or identify software license contract savings opportunities department-wide, and the remaining 9 have not assessed any software license data to identify opportunities for cost savings. More specifically, while the 15 agencies do not have controls in place for analyzing data on a regular basis, they are finding opportunities in an ad hoc manner to reduce software license spending and duplication. For example: Through OMB’s PortfolioStat process, Commerce reported achieving a total of $1.05 million in cost savings in fiscal year 2012 through consolidation of selected software contracts, taking advantage of lower prices offered through enterprise licensing. DHS conducted department-wide contract business case assessments on re-competing Adobe enterprise license agreements. Based on the analyses, the agency reported cost avoidance over $125 million through the Adobe agreement from March 2010 through December 31, 2012. As another example, DHS negotiated more than 10 enterprise licensing agreementshardware vendors, which led to cost avoidance of $181 million in fiscal year 2012. Furthermore, through the PortfolioStat process, in October 2012, the agency reported a total estimated savings or cost avoidance of approximately $376 million from fiscal year 2013 to fiscal year 2015 with its enterprise license agreement initiative. According to National Aeronautics and Space Administration (NASA) officials, in fiscal year 2013, the agency realized cost savings of approximately $33 million by consolidating major IT contracts, including Cisco and Microsoft licenses, to achieve efficiencies. VA reported through the PortfolioStat process that it renegotiated a fiscal year 2012 enterprise license agreement to reduce costs associated with software products used, saving the agency approximately $13 million in net cost avoidance in fiscal year 2012 and $37 million in net cost avoidance for fiscal year 2013. State reported through the PortfolioStat process a total estimated savings or cost avoidance of $6 million for fiscal years 2014 and 2015 with regard to enterprise licensing software. The remaining agencies did not demonstrate that they had analyzed software license data to inform investment decisions. For example, Department of Justice officials stated that this is primarily performed as subordinate activities within programs or as annual activities for software renewal through contract negotiations. However, documentation of this analysis was not provided. The majority of agencies lack training on management of software licenses. None of the 24 agencies provided sufficient training to appropriate personnel on managing software licenses. Specifically, 5 provided some, but not all, key training on managing software licenses, including contract terms and conditions, and 19 did not provide any software licenses management training. Specifically, in April 2013, NASA provided a webinar presentation on its Enterprise License Management Team that included information on the program’s mission, objectives, dependencies and interfaces, and business cases, among other things. However, this training did not include aspects of sufficient software license management training such as negotiations, laws and regulations, and contract terms and conditions department-wide. Similarly, while NRC has provided software license management training to employees related to configuration management through its broader training on Information Technology Infrastructure Library, it has not done so for contract terms and conditions as well as negotiations of software license agreements. While these agencies have taken positive steps, the vast majority of the federal agencies lack sufficient training. The inadequate implementation of leading practices in software license management can be linked to the weaknesses in agencies’ policies and decentralized approaches to license management. As a result, agencies’ oversight of software license spending has been limited or lacking. Therefore, without improved policies and oversight, agencies will likely miss opportunities for significant savings across the federal government. Given the weaknesses identified in this report regarding agencies’ lack of comprehensive, well-maintained inventories of software licenses, we cannot accurately describe the most widely used software applications across the government, including the extent to which they were over and under purchased. Further, the data provided by agencies regarding their most widely used applications are varying, incomplete, or not available—and thus, cannot be compared across the government. Varying data: The agencies that had data on widely used software applications provided it in various ways, including by license count, usage, and cost. For example: State, General Services Administration (GSA), and Labor provided data by both license count and cost. According to a State official, in fiscal year 2013, the cost for the department’s most widely used software applications was about $17 million. Officials also stated that Microsoft Office Professional 2010 is the costliest application for the department (about $7 million) and Entrust Entelligence Security Provider is the most widely used application by licenses (approximately 124,000 licenses, costing about $436,000). GSA provided a list of 13,809 different applications with total software licenses counts for each specific application. According to the agency, in fiscal year 2013, Oracle was the costliest application (about $5.4 million), and Extend360 Enforcement Agent was the agency’s most widely used application, with about 17,430 licenses. According to GSA officials, in fiscal year 2013, the cost for the most widely used software applications by license count was about $13 million. Furthermore, Labor reported that its most widely used software applications costs about $1.1 million in fiscal year 2012. In addition, Labor reported that Windows 7 bundled with Microsoft Office Professional 2010 was the department’s most costly software (approximately $427,000 with 3,050 users). On the other hand, SCCM Advanced Client was the department’s most common software, with 3,107 users and costing about $41,000. NASA and OPM provided data by cost. Specifically, NASA and OPM reported on their costliest applications and stated that the most widely used applications by license count and cost are the same. In particular, OPM reported that its most widely used applications cost about $9.7 million in fiscal year 2013. Among these, OPM reported its Microsoft and Oracle enterprise licenses agreement are the most costly applications with about $2.1 million for each application, but no data on license count was provided. NASA reported that in fiscal year 2012 the agency spent about $13 million on its most widely used applications. Among these, NASA reported that Oracle is the most widely used application by both license count and cost. In fiscal year 2012, the agency spent approximately $4.6 million on this software for 122,279 licenses. U.S. Agency for International Development (USAID) and Treasury provided data by license count. USAID reported Microsoft Configuration Manager Client as its most widely used application, with 12,341 licenses, but no cost data were provided. Similarly, Treasury reported Microsoft as its most widely used application, with about 1.3 million licenses, but no further data were provided on actual applications, and department officials stated it does not maintain a list of the most costly applications; rather it uses the procurement process as an opportunity to reassess software needs. USDA provided data on license usage. Specifically, these data included the total number of computers and the total number of times the software was used. For example Microsoft Corporation was listed, with 124,310 computers and 83,542,797 total instances in which the software was used; however, further data were not provided on the use of the actual applications (i.e., the number of instances in which the software was used or the total of duration of time it was used). Incomplete data: The data provided by the agencies on the most widely used applications were not always complete. For example, EPA’s reported data included count and cost for a subset of software, and therefore it was unclear which applications were most widely used. In addition, while ten agencies (Commerce, the Department of Transportation (DOT), Education, the Department of Energy (Energy), Interior, Justice, NRC, SBA, and the Social Security Administration (SSA)) provided a list of most widely used applications, no specific usage data on the number of instances in which the software was used, the total of duration of time it was used, or no cost was provided. Unavailable data: Four agencies (Defense, HHS, DHS and VA) did not have available data on the most widely used applications. The agencies cited various reasons for not having these data, or for having incomplete data. These reasons included non-centralized management of software licenses and not having validated, reliable information. For example, HHS indicated that these data are not available because the operating divisions manage their own software applications. Similarly, according to DHS officials, to provide the data on its most widely used and costliest applications would require a larger departmental effort, including a data call to each of the components. In addition, VA indicated that it is in the process of validating this information and could not provide an accurate answer. As for the extent to which most widely used software licenses were over and under purchased, none of the 24 agencies had cost data available for over- or under-purchasing of their most widely used software applications. Three agencies provided partial information on over- or under-purchasing for the most widely used applications: Defense, SBA, and USDA. Specifically, Defense officials stated that information on over- or under- purchasing exists within the Department of the Army for Microsoft products; however, no data were provided. SBA believes this figure is under $75,000 annually but did not have documentation to support this assertion. Also, according to USDA officials, for fiscal year 2014, the agency reduced its Microsoft Desktop licensing by over 4,000 units for the new contract renewal and 11,000 for Adobe Acrobat Standard software. However, the remaining 21 agencies do not have information on over- or under-purchasing for the most widely used applications. For example, Commerce officials stated they are not aware of any over- or under- purchased software and attributed this to a decentralized approach to managing licenses. In addition, USAID officials stated that reporting on over- and under-purchased licenses is problematic because of the manual efforts that are required to gather and compare data against known purchases. GSA officials stated that GSA does not have this information available; however, they indicated that GSA plans to form an office tasked with this responsibility. Until agencies address the weaknesses identified in how they manage their software licenses, including establishing a comprehensive inventory that is regularly tracked and maintained, the most widely used applications across the federal government cannot be accurately determined. Additionally, because agencies were unable to identify the extent to which these applications were over or under purchased, they risk procuring software in a costly and ineffective manner. The federal government procures thousands of software licenses agreements annually, and therefore effectively managing them is critical to ensure that agencies maximize the value of these investments. OMB has issued a policy associated with a broader IT management initiative but does not have a directive that assists agencies in developing licensing policies. This is especially important since the majority of agencies lack comprehensive policies and have significant weaknesses in managing their software licenses. While most agencies have established policies that address leading practices for effectively managing software licenses, they are not comprehensive. This has contributed to the majority of agencies (1) not having a fully centralized approach for managing licenses, (2) not fully establishing a comprehensive inventory for regularly tracking and maintaining software licenses, (3) not regularly tracking and maintaining an inventory using tools and metrics, or (4) not providing sufficient training on software management. The result is an inability to analyze software license data to more cost-effectively buy and maintain software licenses, and ascertain the software applications most widely used across the federal government. Consequently, while agencies were able to identify millions in savings for software, there is the potential for even greater savings and additional opportunities to reduce software license spending and duplication than what agencies have reported. Until OMB and the agencies focus on improving policies and processes, they will not have the data to manage software licenses and will likely miss opportunities to reduce costs. We recommend that the Director of OMB issue a directive to the agencies on developing comprehensive software licensing policies comprised of the seven elements identified in this report. We are also making numerous recommendations to the 24 departments and agencies in our review to improve their policies and practices for managing software licenses. Appendix III contains these recommendations. We provided a draft of this report to OMB and the 24 Chief Financial Officers Act agencies in our review for comment and received responses from all 25. OMB disagreed with our recommendation to issue a directive and of the 24 agencies that we made specific recommendations to, 11 agreed, 5 partially agreed, 2 neither agreed nor disagreed, and 6 had no comments. The agencies’ comments and our responses are summarized below. In written comments, OMB noted that there are several management tools in place with respect to software license management, including the three we identified in our report; however, the agency disagreed with our statements that OMB and federal agencies need to improve policies on managing software licenses, and that until agencies have sufficient direction from OMB, opportunities to systematically identify software license related cost savings across the federal government will likely continue to be missed. In particular, OMB cited two additional management initiatives that it asserted have significant bearing in the area of software licensing that were not included in our report. These two initiatives are known as “Maximizing Use of SmartBuy and Avoiding Duplication” and “Cross Agency Priority Goal: Cybersecurity.” OMB stated that the SmartBuy initiative, along with the initiatives detailed in our report, deliver a policy foundation that allows an agency to leverage GSA and collaborate with agencies and monitor performance. In addition, OMB stated that the Cybersecurity initiative can be used to understand the risk and vulnerabilities of the software an agency is using. The agency also noted that through the collective OMB initiatives, agencies now have the tools to identify when there is underutilization of software and are better able to recapture those underutilized licenses and deploy them to people who need them. While we agree that OMB’s initiatives collectively represent important management tools for agencies, they are not enough to guide agencies in developing comprehensive license management policies. More specifically, the two initiatives along with the other three we previously cited do not provide guidance to agencies on developing software license management policies comprised of the seven elements identified in our report. Our report shows that only 2 of the 24 major agencies have comprehensive policies in place; and only 2 have comprehensive license inventories. Until this gap in guidance is addressed, agencies will likely continue to lack the visibility into what needs to be managed, and be unable to take full advantage of OMB’s SmartBuy and other tools to drive license efficiency and utilization. Therefore, we continue to believe that OMB should develop a directive that guides the agencies to ensure that they have appropriate policies. OMB’s comments are reprinted in appendix XX. In e-mail comments, an official from Agriculture’s Audit Liaison Group stated that the department generally concurs with our findings and recommendations and plans to move forward with our recommendations. In written comments, Commerce stated the department concurred with our findings as they apply to the status of software license management within the department, but partially concurred with four of our six recommendations. Specifically, the department plans to develop an agency-wide comprehensive policy for the management of software licenses, and ensure that software license management training is provided to appropriate agency personnel. Since the department did not provide any information on the reasons why it partially concurred with the remaining recommendations, we are maintaining our recommendations. Commerce’s comments are reprinted in appendix IV. In written comments, Defense concurred with two of the six recommendations and partially concurred with the remaining ones. Specifically, the department partially concurred with our recommendations to develop a comprehensive policy; employ a centralized license management approach; establish a comprehensive license inventory; and regularly track and maintain the inventory using automated tools and metrics. With regard to a need for a comprehensive policy and centralized approach, the department stated that it concurs that a license management policy is necessary to address the weaknesses we identified; and that the majority of license spending and/or enterprise- wide licenses should be managed using an approach that is coordinated and integrated with key personnel. However, Defense stated it does not concur that a centralized management approach is appropriate for the size and complexity of the department. We continue to believe our recommendations are valid because consistent with leading practices, in order to take advantage of economies of scale, a single entity should have access to department- wide software license data. Furthermore, the National Defense Authorization Act for Fiscal Year 2013 requires the Defense CIO, in consultation with Defense component CIOs, to issue a plan to conduct a department-wide inventory of a subset of software licenses that will maximize its return on investment; and to describe in the plan how the department can achieve the greatest economies of scale and savings in the procurement, use, and optimization of these licenses. In addition, the National Defense Authorization Act for Fiscal Year 2014 further clarifies what the plan should entail. Adequately conducting an inventory will necessitate that Defense centrally manage its software license data. Having licensing management policy in place to address the identified weaknesses, as well as employing a centralized approach, would position the department to more effectively carry out these mandated requirements, among other things. With regard to the need for a license inventory and tools to track the inventory, Defense stated that it concurs that inventory data should be collected for agency software licenses purchased and/or enterprise- wide licenses; and that effective license management requires regular tracking and maintaining of inventory data using automated tools and metrics. However, the department stated it does not concur that maintaining an inventory comprising the majority of software regardless of dollar value is required. Further, Defense stated it may be resource exhaustive to incorporate automated tools to establish inventories for the majority of licenses; and may not be practicable to retroactively collect standard data about historical license transactions due to the decentralized nature of purchasing and license management today within the department. We agree that inventory data does not need to include all software regardless of dollar value. As detailed in our report, leading practices note a comprehensive inventory should represent the majority (80 percent) of the agency’s software license spending and/or enterprise licenses to allow the department visibility that reduces redundant applications and identification of other cost saving opportunities. Moreover, in response to the requirements in the National Defense Authorization Act for Fiscal Year 2013, Defense’s own licensing inventory plan is based on the software products with the highest relative spend across the department to target the products that present the greatest potential economies of scale and cost savings. In other words, the department is already planning to take steps to establish an inventory consistent with our recommendation. Regarding the use of automated tools to collect and maintain the licensing inventory, we agree that the department should take the most cost-effective and forward-looking approach. Accordingly, a focus on implementing tools and metrics on current and future software license purchases (rather than historical transactions) is reasonable. Such an approach is consistent with our recommendations; therefore, we are maintaining them. The department’s comments are reprinted in appendix V. In written comments, Education concurred with our recommendations and stated it plans to implement a revised software acquisition policy in 2014, which will allow for better management, tracking, and reporting of software licenses. The department’s comments are reprinted in appendix VI. In written comments, Energy neither agreed nor disagreed with our recommendations, but stated that it has taken a number of steps to aggregate licensing, and at this time has no plans to centralize software licensing. In particular, the department stated it agrees that there may be opportunities to aggregate licensing to achieve volume discounts and integrate disparate but related data sources. Energy further stated its IT Modernization Strategy, targeted for completion in fiscal year 2016, seeks to reduce the number of procurement vehicles and to leverage the department’s collective buying power, among other things. Energy also described activities under way that it believes address our specific recommendations, as well as clarified specific facts (on developing a comprehensive policy and having visibility into 45 percent of the department’s licenses), which we incorporated in the report as appropriate. While we agree that these activities are important steps, we continue to believe that further work is needed to improve software license management at the department. Because of Energy’s decentralized approach, it does not have visibility into the majority of the department’s software licenses. Additionally, while the department stated analysis is done on agency-wide software usage and training is managed on an office-by-office basis, Energy could not provide evidence to substantiate these claims. Until the department takes a more centralized approach, as well as addresses the other identified weaknesses, such as regular analysis of licensing inventory data to inform decisions and relevant management training, the department will likely not be adequately positioned to take advantage of the procurement vehicles and collective buying power currently being planned as part of its modernization strategy. The department’s comments are reprinted in appendix VII. In written comments, HHS neither agreed nor disagreed with our recommendations and noted initiatives it plans to take to promote cost savings and visibility regarding IT spending. The department’s comments are reprinted in appendix VIII. In written comments, DHS concurred with our recommendations and identified steps the department plans to take to address the weaknesses. The department’s comments are reprinted in appendix IX. In written comments, HUD had no comments on our report and stated it would provide more definitive information with timelines once the final report has been issued. The department’s comments are reprinted in appendix X. In written comments, Interior agreed with most of our findings and concurred with five recommendations and partially concurred with one recommendation. The department partially disagreed with our recommendation to provide sufficient software license management training to appropriate personnel, stating that it will continue to provide training on contract terms and conditions, among other things and it does not agree that unique training is needed for software license management. We agree that unique training in software license management is not needed if included as part of other training as we identified in our report. However, the department did not provide any documentation to support that training has been provided to appropriate personnel. We therefore maintain our recommendation. The department’s comments are reprinted in appendix XI. In e-mail comments, an official from Justice’s Audit Liaison Group stated that the department concurs with the recommendations and will address how it plans to implement them once the final report has been issued. In e-mail comments, an official from Labor’s Office of the Assistant Secretary for Policy stated the department had no comments. In written comments, State noted that it concurred with our recommendations and plans to identify actions to address these recommendations. The department’s comments are reprinted in appendix XII. In e-mail comments, the Deputy Director of Audit Relations from Transportation stated it had no comments. In written comments, the Department of the Treasury had no comments on the report. The department’s comments are reprinted in appendix XIII. In written comments, VA generally agreed with our conclusions and concurred with our six recommendations. The department also identified initiatives underway to address the weaknesses identified in the report. The department’s comments are reprinted in appendix XIV. In written comments, EPA partially agreed with our assessment and acknowledges that there is work to be done to better manage software licenses for the agency. Since the agency did not specifically state why it partially concurred, we are maintaining our recommendations. The agency’s comments are reprinted in appendix XV. In written comments, GSA agreed with our findings and recommendations and stated it would take actions as appropriate. The agency’s comments are reprinted in appendix XVI. In written comments, NASA concurred with three recommendations and partially concurred with three others. Specifically, the agency partially concurred with our recommendations to employ a centralized management approach, establish a comprehensive license inventory, and regularly track and maintain this inventory using automated tools and metrics. The agency stated that to fully implement a centralized software license management approach will require several phases, working with NASA stakeholders to ensure both mission and institutional software is integrated. In particular, NASA stated it would be difficult to employ one centralized software license management tool because, while it has a mechanism in place for a few of its large enterprise license purchases, several of its large IT contracts have purchasing of licenses embedded in the contract conditions. Accordingly, the agency cannot easily obtain inventory data for licenses not in its control (i.e., contractor-managed licenses). Additionally, NASA noted that to fully establish and regularly track and maintain a comprehensive inventory will require changes to some of the large IT contracts at the agency to be able to automatically pull the licensing information into a centralized system, with increased costs. While we agree that a phased approach to implementing a centralized software license approach may be the most practicable, we are not advocating the department collect information on licenses it does not control. Instead our recommendations to establish and regularly track and maintain a comprehensive inventory of licenses are for the licenses that NASA purchases directly, as we noted in our report. Thus, we maintain our recommendations. The agency’s comments are reprinted in appendix XVII. In written comments, NSF stated that it had no comments on our report. The agency’s comments are reprinted in appendix XVIII. In written comments, NRC stated it generally agreed with our report and had no further comments. The agency’s comments are reprinted in appendix XIX. In written comments, OPM concurred with our recommendations and noted actions the agency plans to take. The agency’s comments are reprinted in appendix XXI. In e-mail comments, an official from SBA’s Office of Congressional and Legislative Affairs stated it had no comments. In written comments, SSA agreed with our recommendations and identified actions the agency plans to take. The agency’s comments are reprinted in appendix XXII. In written comments, USAID agreed with our recommendations and identified actions it plans to take. The agency’s comments are reprinted in appendix XXIII. We are sending copies of this report to the appropriate congressional committees; the Secretaries of the Departments of Agriculture, Commerce, Defense, Education, Energy, Health and Human Services, Homeland Security, Housing and Urban Development, the Interior, Labor, State, Transportation, the Treasury, and Veterans Affairs; the Attorney General; the Administrator of the Environmental Protection Agency; the Administrator of the General Services Administration; the Administrator of the National Aeronautics and Space Administration; the Director of the National Science Foundation; the Chairman of the Nuclear Regulatory Commission; the Director of the Office of Management and Budget; the Director of the Office of Personnel Management; the Administrator of the Small Business Administration; the Commissioner of the Social Security Administration; the Administrator of the U.S. Agency for International Development; and other interested parties. This report also is available at no charge on the GAO website at http://www.gao.gov. Should you or your staff have any questions on information discussed in this report, please contact me at (202) 512-4456 or ChaC@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix XXIV. Our objectives for this engagement were to (1) assess the extent to which the Office of Management and Budget (OMB) and federal agencies have appropriate policies on software license management, (2) determine the extent to which federal agencies are adequately managing software licenses, and (3) describe the software applications most widely used by the federal agencies and the extent to which they were over or under purchased. The scope of our review included the 24 major agencies covered by the Chief Financial Officers Act of 1990. To address our first objective, we identified seven elements that comprehensive software license policies should contain. To do so, we first identified experts in the field of software license management by reviewing software license management websites and professional literature. We then selected six experts based on type, depth, and relevance of software license management experience, as well as relevance of published work, awards and recognition in the professional community, recommendations, and availability with a range of private and public sector experience. We selected the following six individuals: Patricia Adams—Research Director, Gartner, Inc. Victoria Barber—Research Director, Gartner, Inc. Tim Clark—Partner, The FactPoint Group Steve Cooper—Chief Information Officer (CIO) Executive Advisor, Mason-Harriman Group and former Federal Aviation Administration CIO Mark Day—Deputy Assistant Commissioner, Office of Integrated Technology Services, General Services Administration Amy Konary—Research Vice President, International Data Following our expert selection process, we interviewed each of the recognized experts to solicit information about what software license policies should contain. We then compared the information collected from the experts against OMB guidance, relevant executive orders, other federal guidance, and professional literature. We synthesized the resulting information into a list of seven elements: identify clear roles, responsibilities, and central oversight authority within the department for managing enterprise software license agreements and commercial software licenses; establish a comprehensive inventory (80 percent of software license spending and/or enterprise licenses in the department) by identifying and collecting information about software license agreements using automated discovery and inventory tools; regularly track and maintain software licenses to assist the agency in implementing decisions throughout the software license management life cycle; analyze software usage and other data to make cost-effective provide training relevant to software license management; establish goals and objectives of the software license management consider the software license management life-cycle phases (i.e., requisition, reception, deployment and maintenance, retirement, and disposal phases) to implement effective decision making and incorporate existing standards, processes, and metrics. We then solicited feedback from our experts on the elements developed, and integrated this feedback to finalize our elements. Three of the experts contributed to the validation of our list of elements. For each of the 24 agencies, we then obtained and analyzed policy documents, such as agency and departmental guidance, policies, procedures, regulations, and standard operating procedures, and compared them to the seven elements. We also obtained information through interviews with officials responsible for software license management activities. Further, to assess the extent to which the OMB has appropriate guidance on software license management, we collected and analyzed OMB guidance on the PortfolioStat and Strategic Sourcing initiatives to determine its efforts to oversee federal agencies’ management of software licenses. We then compared these efforts to relevant legislation and executive orders. In addition, we reviewed the results of our prior work on PortfolioStat. We then interviewed OMB officials to identify their views on whether the relevant guidance for software license management to federal agencies is appropriately established. For our second objective, on managing licenses, we identified five leading practices in the field of software license management. We used the same process involving the six experts as described for the first objective. We synthesized the resulting information into a set of leading practices that can help agencies manage their software licenses, including (1) centralizing the management of software licenses; (2) establishing a comprehensive inventory that represents at least 80 percent of the agency’s total software license spending and/or total software licenses agency-wide; (3) regularly tracking and maintaining an inventory using automated discovery and inventory tools and metrics; (4) analyzing the data to inform investment decisions and identifying opportunities to reduce costs; and (5) providing appropriate agency personnel with sufficient software license management training. We then solicited feedback from our experts on the leading practices developed, and integrated this feedback to finalize our leading practices. Three of these experts contributed to the validation of our list of effective practices. To determine the extent to which federal agencies are adequately managing their software licenses, we obtained and analyzed relevant software license information such as budget documentation for fiscal years 2012 and 2013, software contracts, management of software license policies and procedures, software license inventories for fiscal years 2012 and 2013, documentation on internally reported cost saving, training curriculums, software management application documentation and reports. We also obtained information through interviews with officials responsible for software license management activities. For each agency, we then compared agencies’ documentation against the five leading practices to determine the extent to which they are adequately managing licenses. To assess the reliability of the data agencies provided in their software license inventories, we confirmed with agencies whether these inventories were comprehensive (i.e., representing at least 80 percent of the agency’s total software license spending and/or total software licenses agency-wide). In cases where the agency attested to its being comprehensive, we asked agency officials how they ensure the data within their inventories are comprehensive, reliable, valid, and accurate, and requested supporting documentation, such as those related to internal control processes. For those inventories that agencies reported as not comprehensive, we determined additional data reliability steps were not required because agencies have knowledge to determine whether they do not have a comprehensive inventory and would not have concerns with inventories being rated as not comprehensive if the rating was based on their own assessment. We concluded that the data were sufficiently reliable for our purposes for the first two objectives. Finally, for our third objective, we collected and analyzed information on the most widely used software applications, such as agencies’ software inventories and/or lists of applications according to volume and spending. In addition, we obtained information on whether software licenses were over or under purchased for the most widely used applications, as documented by the agencies. For each of the 24 agencies, we analyzed the information to describe the extent to which the most widely used applications were over or under purchased. We also interviewed agency officials. We identified issues with the reliability of the information on the most widely used applications because the data varied or were incomplete. We did not test the adequacy of agencies’ cost data. Our evaluation of these cost data was based on what we were told by agencies and the information the agencies could provide. We conducted this performance audit from March 2013 to May 2014 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We conducted detailed assessments of the 24 Chief Financial Officers Act agencies’ software license management practices against leading practices. The following section summarizes the results of our assessment of each agency’s software license management against leading practices. Table 4 provides a detailed summary of the results of our assessment of the Department of Agriculture’s (USDA) practices for managing software licenses against leading practices. ◌ Not met—the agency did not provide any evidence that it addressed the leading practice. Table 5 provides a detailed summary of the results of our assessment of the Department of Commerce’s (Commerce) practices for managing software licenses against leading practices. ◌ Not met—the agency did not provide any evidence that it addressed the leading practice. Table 6 provides a detailed summary of the results of our assessment of the Department of Defense’s (Defense) practices for managing software licenses against leading practices. ◌ Not met—the agency did not provide any evidence that it addressed the leading practice. Table 7 provides a detailed summary of the results of our assessment of the Department of Education’s (Education) practices for managing software licenses against leading practices. Table 8 provides a detailed summary of the results of our assessment of the Department of Energy’s (Energy) practices for managing software licenses against leading practices. Summary of evidence Energy’s policy, Order 200.1A on IT Management, requires the Office of the CIO to address centralized management through consolidation of software acquisition, volume purchasing arrangements and enterprise-wide agreements and track and maintain its inventory of software licenses. However, Energy does not have policy addressing analysis of license data to better inform investment decision making, education and training, establishing goals and objectives of the program, and managing licenses throughout their entire lifecycle. Energy’s licenses are primarily managed in a decentralized manner. According to Energy officials, licenses within the Office of the Chief Information Officer are tracked centrally, which accounts for approximately 45 percent of the department’s users. Energy does have an inventory of software licenses; however, it is limited to the licenses managed by the Office of the Chief Information Officer, which, according to Energy officials, account for approximately 45 percent of the department’s users. Specifically, this inventory includes information covering the version number, total number of licenses, and total number of licenses in use. Energy uses automated tools to track licenses within the Office of the Chief Information Officer, but this only covers licenses managed by the office, which accounts for approximately 45 percent of department’s users. Energy does not analyze the data to inform investment decisions and identify opportunities to reduce costs. Energy officials stated this is occurring at the program level; however, documentation to support this was not available. Energy has not provided relevant software license management training; however, according to officials, there may be localized training within programs and field sites. ● Fully met—the agency provided evidence that it fully addressed the leading practice. ◐ Partially met—the agency provided evidence that it addressed some, but not all, portions of the leading practice. ◌ Not met—the agency did not provide any evidence that it addressed the leading practice. Table 9 provides a detailed summary of the results of our assessment of the Department of Health and Human Services’ (HHS) practices for managing software licenses against leading practices. Summary of evidence HHS officials stated that the department has not developed department-wide policies for managing software licenses. However, the officials stated that it has hired a Vendor Management Office Director and that the vendor management office will take the lead in centrally managing HHS commercial vendors and applicable software licenses. According to HHS officials, the establishment of the vendor management office is in process. While HHS officials stated it has a limited inventory, the department did not provide supporting documentation of this inventory. In addition, according to HHS officials, outside of a limited amount of information on software such as Windows and Microsoft Office, HHS manages its software licenses in a decentralized manner. HHS officials explained that the department’s operating divisions manage their own needs and HHS does not have insight into the management of the majority of software or inventories. However, the department plans to fully staff a vendor management office to centralize the management of software licenses. HHS has not established a comprehensive inventory representing the majority of software license spending or total licenses. According to officials, it does not have a comprehensive software license inventory because it has multiple operating divisions that internally manage software and software contracts do not clearly consist of just software. HHS does not regularly track and maintain comprehensive inventories of software licenses using automated tools and metrics. HHS has not analyzed fiscal year 2012 and 2013 department-wide software license data, such as costs, benefits, usage, and trending data, to inform investment decisions to identify opportunities to reduce costs. The department officials stated that this information is not available. HHS officials stated that the department does not have documentation that it provided agency personnel with sufficient software license management training. ● Fully met—the agency provided evidence that it fully addressed the leading practice. ◐ Partially met—the agency provided evidence that it addressed some, but not all, portions of the leading practice. ◌ Not met—the agency did not provide any evidence that it addressed the leading practice. Table 10 provides a detailed summary of the results of our assessment of the Department of Homeland Security’s (DHS) practices for managing software licenses against leading practices. Table 11 provides a detailed summary of the results of our assessment of the Department of Housing and Urban Development’s (HUD) practices for managing software licenses against leading practices. Summary of evidence While HUD infrastructure requirements, including license management, are managed mostly through HUD’s Information Technology Services contract, which has policies for management of those licenses, the agency has not established policy for the agency’s licenses including Microsoft and Oracle, which account for about $7.2 million. HUD officials agreed that the agency’s IT license management policies should be updated to reflect current licensing agreements for its software. HUD manages software licenses in a centralized manner through its Office of the Chief Information Officer. HUD officials stated that about 95 percent of the software is managed through its infrastructure managed services contract. HUD oversees these contractor services through a set of service-level agreements that are tracked, monitored, and evaluated continuously by an independent verification and validation contract, according to officials. HUD officials also stated that its discovery tool licenses are managed by the HUD Office of the Chief Information Officer outside of its services contract. HUD oversees a comprehensive inventory of software the department uses. The majority of the software is managed by contractors. According to HUD officials, the Office of the Chief Information Officer oversees an inventory representing 95 percent of its software licenses, which are managed entirely by contractors through service- level agreements. According to HUD officials, about 95 percent of the department’s software, with the exception of discovery tool licenses, is managed by contractors that the Office of the Chief Information Officer oversees. HUD regularly tracks this software information through contractors and use of an automated tool. In addition, the department has acquired independent verification and validation contractor support to validate infrastructure service-level agreement metrics and performance information for all enterprise infrastructure services provided by contractors. However, HUD officials stated that the department’s contracts do not have performance measures or service- level agreements specifically related to managing software licenses. HUD has not analyzed department-wide data, such as costs, benefits, usage, and trending data, to inform investment decisions to identify opportunities to reduce costs. According to HUD officials, the department’s contractors provide enterprise infrastructure managed service requirements for supporting HUD’s business and do not identify specific software licensing requirements. Accordingly, these officials stated that the department could not associate specific costs with software licenses provided by its contractors since contractors are providing a service at a fixed price. In addition, while HUD could provide cost information for software acquired outside of those contracts, it could not provide any related analysis of software data to inform its investment decisions. Summary of evidence According to HUD officials, the department does not provide software license management training to agency personnel since contractors primarily manage software licenses under the oversight of the Office of the Chief Information Officer. However, no documentation was provided on training received by contactors to manage software licenses. ● Fully met—the agency provided evidence that it fully addressed the leading practice. ◐ Partially met—the agency provided evidence that it addressed some, but not all, portions of the leading practice. ◌ Not met—the agency did not provide any evidence that it addressed the leading practice. Table 12 provides a detailed summary of the results of our assessment of the Department of the Interior’s (Interior) practices for managing software licenses against leading practices. Table 13 provides a detailed summary of the results of our assessment of the Department of Justice’s (Justice) practices for managing software licenses against leading practices. Summary of evidence Justice has a policy on governing the planning, acquisition, security, operation, management and use of IT resources that addresses centralized management. In particular, the policy states that for software purchases, Justice components shall use department enterprise license agreements, blanket purchase agreements, and other authorized contract vehicles, if economically advantageous. However, the policy does not specifically span the management of software licenses through establishing and tracking an inventory, analysis, education and training, goals and objectives, and life- cycle management. Justice’s Office of the Chief Information Officer centrally manages enterprise-wide solutions and services, such as Oracle, Adobe, and Microsoft agreements. However, Justice officials stated that components are not required to use or buy software using these agreements, but they almost always do. According to Justice officials, there is no process to manage all software licenses department-wide and management of IT resources occurs primarily at the component level. To better address centralized management, Justice officials stated that the department plans to develop a vendor management program office and define new related processes in the third and fourth quarters of fiscal year 2014. Justice has centralized inventory information for Oracle, Adobe, and Microsoft enterprise license agreements. However, it does not have a comprehensive inventory representing the majority of software licenses used across the department and the majority of its total software license spending. According to officials, management of IT resources is performed primarily at the component level. Justice annually tracks and manages centralized enterprise license agreement information for products such as Microsoft and Oracle within the Office of Chief Information Officer. However, officials stated that these software data may not capture all of its components’ procured software since these enterprise license agreements are not mandatory and the department does not have an automated tool that incorporates software license management-specific metrics. Justice was unable to provide documentation showing that it analyzed software license data department-wide, such as costs, benefits, usage, and trending data, to inform investment decisions and identify opportunities to reduce costs. While Justice officials stated that personnel have participated in relevant training such as acquisition workshops, the agency was unable to provide documentation of training and stated it does not have a software license management training program. ● Fully met—the agency provided evidence that it fully addressed the leading practice. ◐ Partially met—the agency provided evidence that it addressed some, but not all, portions of the leading practice. ◌ Not met—the agency did not provide any evidence that it addressed the leading practice. Table 14 provides a detailed summary of the results of our assessment of the Department of Labor’s (Labor) practices for managing software licenses against leading practices. Table 15 provides a detailed summary of the results of our assessment of the Department of State’s (State) practices for managing software licenses against leading practices. Summary of evidence State has policies which govern the centralized management of software licenses and tracking software licenses. Specifically, the Bureau of Information Resource Management policy identifies responsibilities for the management of Microsoft and Oracle enterprise license agreements and the tracking of software licenses. However, there are no policies addressing establishing a comprehensive inventory, analyses of software license data, training on management of software licenses, goals and objectives, and consideration of the software license life-cycle phases. According to State officials, enterprise agreements are managed centrally, while the remaining licenses are managed on a bureau-by-bureau basis. Specifically, Microsoft and Oracle enterprise license agreements are managed centrally, and VMware and Adobe have blanket purchase agreements that have cross-bureau participation within the department, which are also managed centrally. Officials noted that the department has established an Enterprise Licensing Steering Committee that plans to create more efficiency through centralization. While the department has an inventory of software applications, including Microsoft licenses, it is not comprehensive. According to State officials, the department is working on establishing a department-wide inventory that will include Oracle, Symantec, and Entrust, but a timeline for implementation is not yet determined. While the department is centrally tracking Microsoft licenses using automated tools, other licenses such as Oracle, Symantec, and Entrust are not being tracked. According to officials, as the tool evolves, State plans to automate many of the reconciliation processes and metrics it uses. In addition, it is unclear at what interval reporting is occurring. While State has conducted analysis using its automated tracking tool, including an analysis of license costs and quantity by location, there is limited evidence showing how it is used to inform investment decision making. State officials said the department plans to begin analyzing software license data to inform investment decisions, but did not provide a time frame for implementation. State has not provided software license management training to employees, but stated that its newly established steering committee is focused on software licenses and will take training into consideration. ● Fully met—the agency provided evidence that it fully addressed the leading practice. ◐ Partially met—the agency provided evidence that it addressed some, but not all, portions of the leading practice. ◌ Not met—the agency did not provide any evidence that it addressed the leading practice. Table 16 provides a detailed summary of the results of our assessment of the Department of Transportation’s (DOT) practices for managing software licenses against leading practices. Summary of evidence DOT has a policy addressing components of centralized management and management of software licenses through the entire life cycle. According to officials, DOT is in the process of updating its policy; however, it is unclear if this update will address establishing an inventory of licenses, regularly tracking licenses using automated tools, analyzing license data to inform investment decision making, providing license management training to personnel, and establishing goals and objectives of the program. DOT officials expect to have this policy in place by December 2014. Summary of evidence DOT manages most of its licenses through a common operating environment deployed to each DOT workstation. However, this does not include software within the Federal Aviation Administration or specialized software. Specifically, according to DOT officials, this accounts for approximately 94 percent of the users within the department (11,177 out of 11,799 users). Officials noted that the 11,799 users do not include any of the users from the Federal Aviation Administration, and DOT is uncertain how many users are within this component. DOT provided an inventory for its common operating environment, but not a department-wide inventory. According to officials, this accounts for approximately 94 percent of the users within DOT, not including users from the Federal Aviation Administration. DOT tracks and maintains all licenses within the common operating environment on a monthly basis. Specifically, reports are run using automated tools, specifically Microsoft’s System Center Configuration Manager, Safeboot Management Console, and Stratusphere. However, the department does not track or maintain comprehensive inventories within the Federal Aviation Administration. While DOT conducted analyses for Microsoft products in 2012 and 2013, it is unclear to what extent the department has done so for other licenses. DOT officials stated that it is conducting analysis as contracts expire. Specifically, this process includes a comparison of current needs with the previous year’s count and occurs during contract renewals. Additionally, according to officials, a survey was conducted last year that resulted in a reduction of Acrobat Pro licenses, but documentation to support this analysis was not available. DOT has not provided software license management training to its employees and it does not have plans to do so, according to officials. ● Fully met—the agency provided evidence that it fully addressed the leading practice. ◐ Partially met—the agency provided evidence that it addressed some, but not all, portions of the leading practice. ◌ Not met—the agency did not provide any evidence that it addressed the leading practice. Table 17 provides a detailed summary of the results of our assessment of the Department of the Treasury’s (Treasury) practices for managing software licenses against leading practices. Summary of evidence Treasury has policies in place addressing the establishment of a comprehensive inventory of software licenses and the analysis of data to inform investment decisions and identify opportunities to reduce costs. However, policies and procedures addressing centralized management, tracking licenses regularly using automated tools, providing software license management education and training to personnel, establishing goals and objectives for the program, and managing licenses throughout their entire life cycle do not exist. Treasury manages licenses in a decentralized manner. Specifically, while Treasury does pursue enterprise software license agreements across the department as part of strategic sourcing, the agreements leave the management of these licenses to the bureaus. According to officials, Treasury does not have a consolidated inventory because the process of managing software licenses occurs at the individual bureaus. However, Treasury did provide an inventory of software licenses from April to June 2013, which was established using an automated tool. The inventory includes counts of licenses for specific applications. According to Treasury officials, the tool collects data on all devices connected to the Treasury network at any given time. The department performs monthly scans of software using an automated tool that looks at hardware, software, usage, number of licenses, and number of licenses installed, but according to officials, the tracking of these licenses using automated tools occurs at the bureau-level and tracking is not conducted department-wide. The department does not exclusively track whether specific software license data have been used to inform investment decisions. Treasury’s Office of the Chief Information Officer does not provide software license management training to its employees. ● Fully met—the agency provided evidence that it fully addressed the leading practice. ◐ Partially met—the agency provided evidence that it addressed some, but not all, portions of the leading practice. ◌ Not met—the agency did not provide any evidence that it addressed the leading practice. Table 18 provides a detailed summary of the results of our assessment of the Department of Veterans Affairs’ (VA) practices for managing software licenses against leading practices. VA centrally manages the software licenses that are procured through an enterprise license agreement. In addition, officials stated they are planning to move toward a more centralized approach to managing the majority of its software licenses, but no time frame for completion was provided. Specifically, VA has established a Technology Innovation Program Office to enhance its capabilities to manage software as an asset. While VA provided an inventory of licenses, it is not comprehensive. VA officials stated that a comprehensive inventory will be achieved over time as the policies and procedures for the Technology Innovation Program Office are established and enforced. VA uses automated tools to track software that accounts for some data and manually tracks information on how many licenses VA owns or is entitled to operate. However, according to officials, the Technology Innovation Program Office is investigating the best methods for compiling an inventory of licenses. While VA has analyzed data on its Microsoft enterprise licenses, it has not done so for other software licenses. Specifically, in 2012, VA conducted an analysis of Microsoft license data that resulted in a reported savings of over $30 million. This was attributed to a recompetition which resulted in all software under this agreement being aggregated as one purchase. However, officials stated they are unclear if this type of analysis is performed on all enterprise license agreements. VA officials stated one of the goals of the Technology Innovation Program Office is to ensure this type of analysis is performed for all future license purchases. VA officials indicated that training has been completed through a contract with Gartner. However, the department did not provide documentation to support that this training has occurred. ● Fully met—the agency provided evidence that it fully addressed the leading practice. ◐ Partially met—the agency provided evidence that it addressed some, but not all, portions of the leading practice. ◌ Not met—the agency did not provide any evidence that it addressed the leading practice. Table 19 provides a detailed summary of the results of our assessment of the Environmental Protection Agency’s (EPA) practices for managing software licenses against leading practices. EPA’s management of software licenses is decentralized and there are no plans to move it to a centralized approach. Specifically, while licenses may be managed centrally within a business unit, this is not managed at the departmental level. While EPA provided an inventory for a portion of licenses managed by one business unit, its Office of Technology and Operations, it is incomplete. Specifically, the inventory includes information on cost per unit and number of licenses for some but not all applications. Additionally, officials stated that it does not have a comprehensive inventory of licenses within EPA and they are uncertain if inventories exist for its other business units. EPA does not regularly track and maintain comprehensive inventories of software licenses using automated tools and metrics. Officials said the Office of Technology and Operations uses spreadsheets to manually manage enterprise software licenses, but the inventory was incomplete. EPA is not analyzing data to inform investment decisions and identify opportunities to reduce costs. Officials attributed this to software not being considered an investment in the same terms as a traditional investment that would undergo capital planning and investment control review. EPA has not provided training in software license management. ● Fully met—the agency provided evidence that it fully addressed the leading practice. ◐ Partially met—the agency provided evidence that it addressed some, but not all, portions of the leading practice. ◌ Not met—the agency did not provide any evidence that it addressed the leading practice. Table 20 provides a detailed summary of the results of our assessment of the General Services Administration’s (GSA) practices for managing software licenses against leading practices. Table 21 provides a detailed summary of the results of our assessment of the National Aeronautics and Space Administration’s (NASA) practices for managing software licenses against leading practices. Table 22 provides a detailed summary of the results of our assessment of the National Science Foundation’s (NSF) practices for managing software licenses against leading practices. Table 23 provides a detailed summary of the results of our assessment of the Nuclear Regulatory Commission’s (NRC) practices for managing software licenses against leading practices. Table 24 provides a detailed summary of the results of our assessment of the Office of Personnel Management’s (OPM) practices for managing software licenses against leading practices. Summary of evidence While OPM has developed a policy relevant to managing software licenses, it has not established how to implement the policy. For example, its July 2009 policy on IT procurement and its April 2013 OPM System Development Life Cycle Policy and Standards combined include centralized management, establishing and tracking an inventory, analysis, education and training, goals and objectives, and life cycle management. OPM manages its software licenses in a partially centralized manner. The agency manages its enterprise license agreements through the Office of the Chief Information Officer. However, the agency officials stated that outside of enterprise license agreements, the Office of the Chief Information Officer does not have visibility into program office software license spending. The OPM Office of the Chief Information Officer has established an inventory of the agency’s enterprise license agreements through multiple spreadsheets. However, agency officials stated that these spreadsheets do not represent a comprehensive agency-wide software license inventory. These officials explained that software purchased from program offices outside of Office of the Chief Information Officer enterprise license agreements are not actively captured through an inventory. However, according to officials, the percentage of software license spending the Office of the Chief Information Officer has visibility into was less than 65 percent for fiscal years 2012 and 2013. The agency’s Office of the Chief Information Officer annually tracks and maintains an inventory of enterprise license agreement software using multiple spreadsheets that are primarily tracked manually and include software counts. In addition, one inventory is partially managed through the use of an automated tool, and multiple inventories have established metrics such as processor usage. While OPM has conducted analysis of its Microsoft enterprise license agreements for fiscal year 2013, it has not analyzed agency-wide data for other licenses. Specifically, to determine whether OPM should renew its Microsoft enterprise license agreement for fiscal year 2013, the agency’s investment review board reviewed its historical and anticipated future maintenance cost information and the agency’s analysis of cost savings. Based on this analysis, the agency determined that not renewing the Microsoft enterprise licensing agreement would cost it, at a minimum, an additional 7 percent, or $182,000, increase in maintenance costs. However, OPM could not illustrate that it analyzed agency-wide software license data, such as costs, benefits, usage, and trending data, to inform investment decisions since it does not have a comprehensive software license inventory. While OPM officials stated it has briefed staff on topics such as enterprise license agreements and the executive order on computer software piracy, the officials stated that no software license management education and training documentation exists. ● Fully met—the agency provided evidence that it fully addressed the leading practice. ◐ Partially met—the agency provided evidence that it addressed some, but not all, portions of the leading practice. ◌ Not met—the agency did not provide any evidence that it addressed the leading practice. Table 25 provides a detailed summary of the results of our assessment of the Small Business Administration’s (SBA) practices for managing software licenses against leading practices. Table 26 provides a detailed summary of the results of our assessment of the Social Security Administration’s (SSA) practices for managing software licenses against leading practices. SSA has policies describing the agency’s roles and responsibilities, and objectives relevant to software license management. However, it does not have policies for identifying and collecting information about software license agreements using automated discovery and inventory tools incorporating metrics, regularly tracking and maintaining software licenses, analysis of software usage and other data, providing training relevant to software license management; and consideration of the software license management life-cycle phases. SSA centrally manages a small percentage of the agency’s total licenses and license spending through its Enterprise Software Engineering Tools Board inventory. SSA officials stated that it manages mainframe and Microsoft desktop software centrally. However, the officials stated that the agency has delegated the responsibility of software license management to component local managers and, as a result, does not centrally manage the majority of the agency’s software licenses. The agency has established an inventory through its Enterprise Software Engineering Tools Board. However, according to officials, this inventory is representative of a small percentage of the agency’s total software license spending and total licenses. In addition, while the agency officials stated that it centrally manages Microsoft licenses and maintenance software, it did not have documentation of any inventory. Overall, SSA officials stated that it does not have a comprehensive inventory representing the majority of its software license spending and total licenses. However, agency officials stated the agency plans to implement a software asset management system to better establish a comprehensive inventory. SSA uses a support tool to track a small percentage of the agency’s total software licenses. However, officials stated that it has no established time frames for reporting on the tool. According to agency officials, since SSA is not fully centralized, the agency does not track comprehensive inventories using automated tools and metrics. To better centralize all of its software licenses, agency officials stated it plans to implement a software asset management system. While SSA has analyzed selected software license data, the agency has not analyzed department-wide software license data to inform investment decisions and identify opportunities to reduce costs. According to SSA officials, the agency analyzes software license data on a contract-by-contract basis to inform investment decisions and identify opportunities to reduce costs. The officials stated that it has reduced ongoing costs of large mainframe contracts as a result of the process. SSA has specifically worked with an independent licensing vendor to analyze the agency’s mainframe usage and portfolio to assist the agency in contract negotiations. In January 2012, the vendor conducted a renewal mainframe analysis where it identified mainframe pricing considerations for SSA. However, outside of the mainframe contracts, SSA was not able to demonstrate that it analyzes software license data agency-wide, such as costs, benefits, usage, and trending data, to inform investment decisions and identify opportunities to reduce costs. SSA has not provided appropriate agency personnel with sufficient software license management training. ● Fully met—the agency provided evidence that it fully addressed the leading practice. ◐ Partially met—the agency provided evidence that it addressed some, but not all, portions of the leading practice. ◌ Not met—the agency did not provide any evidence that it addressed the leading practice. Table 27 provides a detailed summary of the results of our assessment of the U.S. Agency for International Development’s (USAID) practices for managing software licenses against leading practices. Summary of evidence USAID’s policy, ADS 547, and its standard operating procedure for a contract with IBM address centralized management, the establishment of a comprehensive inventory, goals and objectives of the software license management program, and the management of licenses throughout the entire life cycle. Officials stated there are plans to conduct analysis to monitor software usage; however, no time frame for implementation was provided. In addition, policies and procedures for tracking software using automated tools and education and training do not exist. USAID has a contract in place with IBM for centrally managing licenses for all of USAID’s operating units. While USAID maintains an inventory of licenses through a contractor, there is no established, documented process for validating and ensuring the accuracy and reliability of the data provided by the contractor. USAID provided an inventory from April 2013 of licenses installed at headquarters and on each mission’s servers. USAID estimates that as of January 2014, this accounted for approximately 95 percent of its software licenses. USAID is using an automated tool, specifically Microsoft’s System Center Configuration Manager, to track and manage software licenses for Microsoft products on an annual basis. However, officials are uncertain how other applications are being tracked and maintained. USAID officials stated that analysis is conducted on an ad-hoc basis. While the agency provided documentation of such analysis capabilities, it did not describe how it was used to inform investment decision making. USAID officials stated that its contractor’s employees receive software license management training, but no documentation was available. ● Fully met—the agency provided evidence that it fully addressed the leading practice. ◐ Partially met—the agency provided evidence that it addressed some, but not all, portions of the ◌ Not met—the agency did not provide any evidence that it addressed the leading practice. leading practice. To ensure the effective management of software licenses, we recommend that the Secretary of Agriculture take the following six actions: Develop an agency-wide comprehensive policy for the management of software licenses that addresses the weaknesses we identified. Employ a centralized software license management approach that is coordinated and integrated with key personnel for the majority of agency software license spending and/or enterprise-wide licenses. Establish a comprehensive inventory of software licenses using automated tools for the majority of agency software license spending and/or enterprise-wide licenses. Regularly track and maintain a comprehensive inventory of software licenses using automated tools and metrics. Analyze agency-wide software license data, such as costs, benefits, usage, and trending data, to identify opportunities to reduce costs and better inform investment decision making. Provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. To ensure the effective management of software licenses, we recommend that the Secretary of Commerce take the following six actions: Develop an agency-wide comprehensive policy for the management of software licenses that addresses the weaknesses we identified. Employ a centralized software license management approach that is coordinated and integrated with key personnel for the majority of agency software license spending and/or enterprise-wide licenses. Establish a comprehensive inventory of software licenses using automated tools for the majority of agency software license spending and/or enterprise-wide licenses. Regularly track and maintain a comprehensive inventory of software licenses using automated tools and metrics. Analyze agency-wide software license data, such as costs, benefits, usage, and trending data, to identify opportunities to reduce costs and better inform investment decision making. Provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. To ensure the effective management of software licenses, we recommend that the Secretary of Defense take the following six actions: Develop an agency-wide comprehensive policy for the management of software licenses that addresses the weaknesses we identified. Employ a centralized software license management approach that is coordinated and integrated with key personnel for the majority of agency software license spending and/or enterprise-wide licenses. Establish a comprehensive inventory of software licenses using automated tools for the majority of agency software license spending and/or enterprise-wide licenses. Regularly track and maintain a comprehensive inventory of software licenses using automated tools and metrics. Analyze agency-wide software license data, such as costs, benefits, usage, and trending data, to identify opportunities to reduce costs and better inform investment decision making. Provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. To ensure the effective management of software licenses, we recommend that the Secretary of Education take the following six actions: Develop an agency-wide comprehensive policy for the management of software licenses that addresses the weaknesses we identified. Employ a centralized software license management approach that is coordinated and integrated with key personnel for the majority of agency software license spending and/or enterprise-wide licenses. Establish a comprehensive inventory of software licenses using automated tools for the majority of agency software license spending and/or enterprise-wide licenses. Regularly track and maintain a comprehensive inventory of software licenses using automated tools and metrics. Analyze agency-wide software license data, such as costs, benefits, usage, and trending data, to identify opportunities to reduce costs and better inform investment decision making. Provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. To ensure the effective management of software licenses, we recommend that the Secretary of Energy take the following six actions: Develop an agency-wide comprehensive policy for the management of software licenses that addresses the weaknesses we identified. Employ a centralized software license management approach that is coordinated and integrated with key personnel for the majority of agency software license spending and/or enterprise-wide licenses. Establish a comprehensive inventory of software licenses using automated tools for the majority of agency software license spending and/or enterprise-wide licenses. Regularly track and maintain a comprehensive inventory of software licenses using automated tools and metrics. Analyze agency-wide software license data, such as costs, benefits, usage, and trending data, to identify opportunities to reduce costs and better inform investment decision making. Provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. To ensure the effective management of software licenses, we recommend that the Secretary of Health and Human Services take the following six actions: Develop an agency-wide comprehensive policy for the management of software licenses that addresses the weaknesses we identified. Employ a centralized software license management approach that is coordinated and integrated with key personnel for the majority of agency software license spending and/or enterprise-wide licenses. Establish a comprehensive inventory of software licenses using automated tools for the majority of agency software license spending and/or enterprise-wide licenses. Regularly track and maintain a comprehensive inventory of software licenses using automated tools and metrics. Analyze agency-wide software license data, such as costs, benefits, usage, and trending data, to identify opportunities to reduce costs and better inform investment decision making. Provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. To ensure the effective management of software licenses, we recommend that the Secretary of Homeland Security take the following five actions: Employ a centralized software license management approach that is coordinated and integrated with key personnel for the majority of agency software license spending and/or enterprise-wide licenses. Establish a comprehensive inventory of software licenses using automated tools for the majority of agency software license spending and/or enterprise-wide licenses. Regularly track and maintain a comprehensive inventory of software licenses using automated tools and metrics. Analyze agency-wide software license data, such as costs, benefits, usage, and trending data, to identify opportunities to reduce costs and better inform investment decision making. Provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. To ensure the effective management of software licenses, we recommend that the Secretary of Housing and Urban Development take the following four actions: Develop an agency-wide comprehensive policy for the management of software licenses that addresses the weaknesses we identified. Regularly track and maintain a comprehensive inventory of software licenses using automated tools and metrics. Analyze agency-wide software license data, such as costs, benefits, usage, and trending data, to identify opportunities to reduce costs and better inform investment decision making. Provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. To ensure the effective management of software licenses, we recommend that the Secretary of the Interior take the following six actions: Develop an agency-wide comprehensive policy for the management of software licenses that addresses the weaknesses we identified. Employ a centralized software license management approach that is coordinated and integrated with key personnel for the majority of agency software license spending and/or enterprise-wide licenses. Establish a comprehensive inventory of software licenses using automated tools for the majority of agency software license spending and/or enterprise-wide licenses. Regularly track and maintain a comprehensive inventory of software licenses using automated tools and metrics. Analyze agency-wide software license data, such as costs, benefits, usage, and trending data, to identify opportunities to reduce costs and better inform investment decision making. Provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. To ensure the effective management of software licenses, we recommend that the Attorney General take the following six actions: Develop an agency-wide comprehensive policy for the management of software licenses that addresses the weaknesses we identified. Employ a centralized software license management approach that is coordinated and integrated with key personnel for the majority of agency software license spending and/or enterprise-wide licenses. Establish a comprehensive inventory of software licenses using automated tools for the majority of agency software license spending and/or enterprise-wide licenses. Regularly track and maintain a comprehensive inventory of software licenses using automated tools and metrics. Analyze agency-wide software license data, such as costs, benefits, usage, and trending data, to identify opportunities to reduce costs and better inform investment decision making. Provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. To ensure the effective management of software licenses, we recommend that the Secretary of Labor take the following four actions: Establish a comprehensive inventory of software licenses using automated tools for the majority of agency software license spending and/or enterprise-wide licenses. Regularly track and maintain a comprehensive inventory of software licenses using automated tools and metrics. Analyze agency-wide software license data, such as costs, benefits, usage, and trending data, to identify opportunities to reduce costs and better inform investment decision making. Provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. To ensure the effective management of software licenses, we recommend that the Secretary of State take the following six actions: Develop an agency-wide comprehensive policy for the management of software licenses that addresses the weaknesses we identified. Employ a centralized software license management approach that is coordinated and integrated with key personnel for the majority of agency software license spending and/or enterprise-wide licenses. Establish a comprehensive inventory of software licenses using automated tools for the majority of agency software license spending and/or enterprise-wide licenses. Regularly track and maintain a comprehensive inventory of software licenses using automated tools and metrics. Analyze agency-wide software license data, such as costs, benefits, usage, and trending data, to identify opportunities to reduce costs and better inform investment decision making. Provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. To ensure the effective management of software licenses, we recommend that the Secretary of Transportation take the following six actions: Develop an agency-wide comprehensive policy for the management of software licenses that addresses the weaknesses we identified. Employ a centralized software license management approach that is coordinated and integrated with key personnel for the majority of agency software license spending and/or enterprise-wide licenses. Establish a comprehensive inventory of software licenses using automated tools for the majority of agency software license spending and/or enterprise-wide licenses. Regularly track and maintain a comprehensive inventory of software licenses using automated tools and metrics. Analyze agency-wide software license data, such as costs, benefits, usage, and trending data, to identify opportunities to reduce costs and better inform investment decision making. Provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. To ensure the effective management of software licenses, we recommend that the Secretary of the Treasury take the following six actions: Develop an agency-wide comprehensive policy for the management of software licenses that addresses the weaknesses we identified. Employ a centralized software license management approach that is coordinated and integrated with key personnel for the majority of agency software license spending and/or enterprise-wide licenses. Establish a comprehensive inventory of software licenses using automated tools for the majority of agency software license spending and/or enterprise-wide licenses. Regularly track and maintain a comprehensive inventory of software licenses using automated tools and metrics. Analyze agency-wide software license data, such as costs, benefits, usage, and trending data, to identify opportunities to reduce costs and better inform investment decision making. Provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. To ensure the effective management of software licenses, we recommend that the Secretary of Veterans Affairs take the following six actions: Develop an agency-wide comprehensive policy for the management of software licenses that addresses the weaknesses we identified. Employ a centralized software license management approach that is coordinated and integrated with key personnel for the majority of agency software license spending and/or enterprise-wide licenses. Establish a comprehensive inventory of software licenses using automated tools for the majority of agency software license spending and/or enterprise-wide licenses. Regularly track and maintain a comprehensive inventory of software licenses using automated tools and metrics. Analyze agency-wide software license data, such as costs, benefits, usage, and trending data, to identify opportunities to reduce costs and better inform investment decision making. Provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. To ensure the effective management of software licenses, we recommend that the Administrator of the Environmental Protection Agency take the following six actions: Develop an agency-wide comprehensive policy for the management of software licenses that addresses the weaknesses we identified. Employ a centralized software license management approach that is coordinated and integrated with key personnel for the majority of agency software license spending and/or enterprise-wide licenses. Establish a comprehensive inventory of software licenses using automated tools for the majority of agency software license spending and/or enterprise-wide licenses. Regularly track and maintain a comprehensive inventory of software licenses using automated tools and metrics. Analyze agency-wide software license data, such as costs, benefits, usage, and trending data, to identify opportunities to reduce costs and better inform investment decision making. Provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. To ensure the effective management of its software licenses, we recommend that the Administrator of General Services take the following five actions: Develop an agency-wide comprehensive policy for the management of software licenses that addresses the weaknesses we identified. Establish a comprehensive inventory of software licenses using automated tools for the majority of agency software license spending and/or enterprise-wide licenses. Regularly track and maintain a comprehensive inventory of software licenses using automated tools and metrics. Analyze agency-wide software license data, such as costs, benefits, usage, and trending data, to identify opportunities to reduce costs and better inform investment decision making. Provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. To ensure the effective management of software licenses, we recommend that the Administrator of the National Aeronautics and Space Administration take the following six actions: Develop an agency-wide comprehensive policy for the management of software licenses that addresses the weaknesses identified. Employ a centralized software license management approach that is coordinated and integrated with key personnel for the majority of agency software license spending and/or enterprise-wide licenses. Establish a comprehensive inventory of software licenses using automated tools for the majority of agency software license spending and/or enterprise-wide licenses. Regularly track and maintain a comprehensive inventory of software licenses using automated tools and metrics. Analyze agency-wide software license data, such as costs, benefits, usage, and trending data, to identify opportunities to reduce costs and better inform investment decision making. Provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. To ensure the effective management of software licenses, we recommend that the Director of the National Science Foundation take the following four actions: Develop an agency-wide comprehensive policy for the management of software licenses that addresses the weaknesses we identified. Regularly track and maintain a comprehensive inventory of software licenses using automated tools and metrics. Analyze agency-wide software license data, such as costs, benefits, usage, and trending data, to identify opportunities to reduce costs and better inform investment decision making. Provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. To ensure the effective management of software licenses, we recommend that the Chairman of the Nuclear Regulatory Commission take the following six actions: Develop an agency-wide comprehensive policy for the management of software licenses that addresses the weaknesses we identified. Employ a centralized software license management approach that is coordinated and integrated with key personnel for the majority of agency software license spending and/or enterprise-wide licenses. Establish a comprehensive inventory of software licenses using automated tools for the majority of agency software license spending and/or enterprise-wide licenses. Regularly track and maintain a comprehensive inventory of software licenses using automated tools and metrics. Analyze agency-wide software license data, such as costs, benefits, usage, and trending data, to identify opportunities to reduce costs and better inform investment decision making. Provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. To ensure the effective management of software licenses, we recommend that the Director of the Office of Personnel Management take the following six actions: Develop an agency-wide comprehensive policy for the management of software licenses that addresses the weaknesses we identified. Employ a centralized software license management approach that is coordinated and integrated with key personnel for the majority of agency software license spending and/or enterprise-wide licenses. Establish a comprehensive inventory of software licenses using automated tools for the majority of agency software license spending and/or enterprise-wide licenses. Regularly track and maintain a comprehensive inventory of software licenses using automated tools and metrics. Analyze agency-wide software license data, such as costs, benefits, usage, and trending data, to identify opportunities to reduce costs and better inform investment decision making. Provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. To ensure the effective management of software licenses, we recommend that the Administrator of the Small Business Administration take the following six actions: Develop an agency-wide comprehensive policy for the management of software licenses that addresses the weaknesses we identified. Employ a centralized software license management approach that is coordinated and integrated with key personnel for the majority of agency software license spending and/or enterprise-wide licenses. Establish a comprehensive inventory of software licenses using automated tools for the majority of agency software license spending and/or enterprise-wide licenses. Regularly track and maintain a comprehensive inventory of software licenses using automated tools and metrics. Analyze agency-wide software license data, such as costs, benefits, usage, and trending data, to identify opportunities to reduce costs and better inform investment decision making. Provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. To ensure the effective management of software licenses, we recommend that the Commissioner of the Social Security Administration take the following six actions: Develop an agency-wide comprehensive policy for the management of software licenses that addresses the weaknesses we identified. Employ a centralized software license management approach that is coordinated and integrated with key personnel for the majority of agency software license spending and/or enterprise-wide licenses. Establish a comprehensive inventory of software licenses using automated tools for the majority of agency software license spending and/or enterprise-wide licenses. Regularly track and maintain a comprehensive inventory of software licenses using automated tools and metrics. Analyze agency-wide departmental software license data, such as costs, benefits, usage, and trending data, to identify opportunities to reduce costs and better inform investment decision making. Provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. To ensure the effective management of software licenses, we recommend that the Administrator of the U.S. Agency for International Development take the following five actions: Develop an agency-wide comprehensive policy for the management of software licenses that addresses the weaknesses we identified. Establish a comprehensive inventory of software licenses using automated tools for the majority of agency software license spending and/or enterprise-wide licenses. Regularly track and maintain a comprehensive inventory of software licenses using automated tools and metrics. Analyze agency-wide software license data, such as costs, benefits, usage, and trending data, to identify opportunities to reduce costs and better inform investment decision making. Provide software license management training to appropriate agency personnel addressing contract terms and conditions, negotiations, laws and regulations, acquisition, security planning, and configuration management. In addition to the contact name above, the following staff also made key contributions to this report: Eric Winter, Assistant Director; Naba Barkakati; Virginia Chanley; Eric Costello; Rebecca Eyler; Dana Pon; and Niti Tandon.

Summary: The federal government plans to spend at least $82 billion on IT products and services in fiscal year 2014, such as software licenses. Federal agencies engage in thousands of licensing agreements annually. Effective management of software licenses can help avoid purchasing too many licenses that result in unused software. GAO was asked to review federal agencies' management of software licenses. GAO (1) assessed the extent to which OMB and federal agencies have appropriate policies on software license management, (2) determined the extent to which agencies adequately manage licenses, and (3) described agencies' most widely used software and extent to which they were over or under purchased. GAO assessed policies from 24 agencies and OMB against sound licensing policy measures. GAO also analyzed and compared agencies' software inventories and management controls to leading practices, and interviewed responsible officials. To identify sound licensing policy measures and leading practices, GAO interviewed recognized private sector and government software license management experts. The Office of Management and Budget (OMB) and the vast majority of agencies that GAO reviewed do not have adequate policies for managing software licenses. While OMB has a policy on a broader information technology (IT) management initiative that is intended to assist agencies in gathering information on their IT investments, including software licenses, it does not guide agencies in developing comprehensive license management policies. Regarding agencies, of the 24 major federal agencies, 2 have comprehensive policies that include the establishment of clear roles and central oversight authority for managing enterprise software license agreements, among other things; 18 have them but they are not comprehensive; and 4 have not developed any. The weaknesses in agencies' policies were due, in part, to the lack of a priority for establishing software license management practices and a lack of direction from OMB. Without an OMB directive and comprehensive policies, it will be difficult for the agencies to consistently and effectively manage software licenses. Federal agencies are not adequately managing their software licenses because they generally do not follow leading practices in this area. The table lists the leading practices and the number of agencies that have fully, partially, or not implemented them. The inadequate implementation of leading practices in software license management was partially due to weaknesses in agencies' policies. As a result, agencies' oversight of software license spending is limited or lacking, and they may miss out on savings. The potential savings could be significant considering that, in fiscal year 2012, one major federal agency reported saving approximately $181 million by consolidating its enterprise license agreements even though its oversight process was ad hoc. Given that agencies lack comprehensive software license inventories that are regularly tracked and maintained, GAO cannot accurately describe the most widely used software applications across the government, including the extent to which they were over and under purchased. Further, the data provided by agencies regarding their most widely used applications had limitations. Specifically, (1) agencies with data provided them in various ways, including by license count, usage, and cost; (2) the data provided by these agencies on the most widely used applications were not always complete; and (3) not all agencies had available data on the most widely used applications. Until weaknesses in how agencies manage licenses are addressed, the most widely used applications cannot be determined and thus opportunities for savings across the federal government may be missed. GAO recommends OMB issue a directive to help guide agencies in managing licenses and that the 24 agencies improve their policies and practices for managing licenses. OMB disagreed with the need for a directive, but GAO believes it is needed, as discussed in the report. Most agencies generally agreed with the recommendations or had no comments.