Quick snapshot to begin, so we can be precise

• How often does your team receive a vendor audit notice that requires a 90-day response? Options: Multiple times a year, Once a year, Less than once a year, This is the first time
• Which roles normally lead the audit response and inventory reconciliation in your organization? Options: Director of IT Asset Management, VP of Procurement, CIO/CTO office, IT Operations manager, Shared committee, Other
• List the inventory sources you currently pull from when assembling a license position Options: Endpoint agent inventory, Network discovery scans, SaaS management portal exports, Procurement records/ERP, Spreadsheets/manual counts, Third-party discovery tools
• Approximately how many distinct inventory records or asset lists are in active use across procurement, IT operations, and finance? Options: 1-3, 4-6, 7-10, More than 10
• Who would be the named data steward we should coordinate with for an initial scoped discovery run?

Where your inventory actually hides, beyond the agent footprint

• If 30 percent of your estate sits outside agent-managed endpoints, what in your current setup would make that likely? Options: Widespread contractor/remote laptops, Shadow SaaS purchases, Isolated OT or production networks, High number of cloud-native services, Loose procurement controls
• Which class of unmanaged assets do you expect an agentless scan to find most often? Options: Contractor or bring-your-own devices, Shadow SaaS subscriptions, Unmanaged VMs in cloud projects, Network-attached appliances, Leftover test environments
• Describe the last time a discovery tool missed a major inventory source, what the source was, and the measurable impact
• How frequently are SaaS subscriptions purchased outside procurement visibility in a typical month? Options: Daily, Weekly, Monthly, Rarely
• Select the connectivity methods available for scanning segmented network zones Options: Onsite VPN jump host, Out-of-band appliance, Temporary firewall rule changes, Network tap/span, No network access currently

What breaks first when inventories disagree, and why it matters

• When your inventory sources disagree, which downstream process fails first and why? Options: License reconciliation and audit defense, Procurement renewal accuracy, Security patching prioritization, Service desk asset tracking, Budget planning and forecasting
• What operational or financial consequence from those failures matters most to your leadership? Options: Audit true-up fines, Unexpected procurement spend, Compliance breach exposure, Service outages due to untracked hardware, Loss of vendor discounts
• Provide a recent incident where inventory mismatch caused measurable cost or delay, and the remediation time
• What single reconciliation gap, if left unresolved, would stop you from defending your license position in an audit?
• Choose the primary metric you use to quantify audit readiness Options: Percent of assets reconciled to procurement, Number of unmanaged licenses found, Time to produce license position, Estimated liability exposure ($)

A pilot that proves the problem, and what it would force you to do next

• If a two-week agentless scan across a representative segment revealed 20 percent more assets, which immediate procurement or compliance decision would that force? Options: Pause renewals pending reconciliation, Initiate true-up budget request, Open a remediation project, Escalate to executive leadership
• Identify a representative business unit or network segment that best demonstrates audit risk and is accessible for a pilot Options: Corporate office endpoints, Remote workforce subset, Production cloud project, Sales/marketing SaaS estate, Manufacturing/OT zone
• List the time-of-day or maintenance windows that would constrain when we can run an estate scan Options: Business hours only, Nightly windows, Weekend windows, No maintenance windows available
• Identify the team contacts who will approve temporary credentials and brief them on expected requests
• Pick the success criteria that would make this scoped run a go or no-go for you Options: Discovery finds >10% unmanaged assets, Match rate to procurement >90%, No high-risk compliance gaps found, Run completes without production impact

Alternatives on the table, and what would keep you with them

• What would have to be true about your current approach for you to keep it instead of partnering with an external platform? Options: It must show equivalent coverage, It must meet audit deadlines reliably, Cost to change must exceed benefits, Internal ownership must be accountable
• Select the alternative approaches you are evaluating or have previously evaluated Options: Incumbent ITAM vendor, Internal build using existing tools, Spreadsheet-driven reconciliation, Consulting engagement only, No viable alternative
• If you stayed with an incumbent or built internally, explain the incremental cost and timeline versus running a scoped external pilot
• Has any internal stakeholder proposed an all-internal fix, and if so who would be accountable for delivering it? Options: Yes, IT Operations, Yes, Procurement, Yes, Security, No internal proposal, Other
• What single factor would cause you to abandon an external pilot and commit to the incumbent or internal build?

Operational readiness and gating constraints we must surface now

• Name the technical dependency that, if missing, would stop the engagement before it starts Options: Procurement API access, Network access to segmented zones, SaaS admin console credentials, Legal data access approval
• Do you have API credentials or service accounts available for your major SaaS and cloud vendors, and who manages them? Options: Yes, central IT manages, Yes, individual project owners, Partially available, No, must be provisioned
• Identify the team that owns firewall or ACL changes and the typical approval lead time
• Is there a legal or compliance review that must approve data-access authorizations, and what is the expected review duration? Options: No review required, Standard review, 3-7 business days, Extended review, 8-21 business days, Requires senior legal sign-off
• Given a two-week delay on procurement API access, can the scoped discovery still meet your 90-day audit deadline? Options: Yes, with adjusted scope, Yes, if expedited elsewhere, No, this blocks us, Unsure

Decision criteria, sign-off paths, and the numbers that move you

• When a pilot proves a meaningful license delta, what procurement or legal action would you expect to see within 30 days? Options: Budget reallocation, Contract negotiation, Purchase approval for true-up, Formal remediation program
• Choose the minimum savings or risk-reduction threshold that would justify a platform rollout Options: >$50k, >$250k, >$1M, Any material reduction in exposure
• Name the individuals or committees who hold final sign-off for procurement and for compliance changes required by a rollout
• What timeline constraint, if any, would prevent you from moving to a full estate deployment within 90 days of pilot success? Options: Procurement cycles, Budget approvals, Legal review, Resource availability, None
• Assuming the pilot meets all acceptance criteria, what remains the single biggest obstacle to signing a commercial agreement?

Next steps, mutual commitments, and an executable pilot plan

• What would accelerate approval to a formal pilot to under 14 days from today? Options: Pre-approved data access, Named budget authority, Commitment from security to fast-track review, Executive sponsor alignment
• Please enumerate the documents and authorizations we must capture before starting the scoped run
• Estimate the earliest date your named data steward can provide credentials and procurement extracts after we request them Options: Within 48 hours, 3-7 business days, 8-14 business days, Longer than 14 days
• Pick the engagement cadence you prefer for status and issue escalation during the pilot Options: Daily standup, Twice weekly review, Weekly status, As-needed only
• Provide the name or title of the sign-off authority for scoped run acceptance, and the expected time window after pilot completion for their approval

• Scoped Discovery Run, Live Session

• Confirm the current state and what it is costing you
• You confirm the scan identifies unmanaged devices and subscriptions that were missing from your inventories and agree on their materiality.
• Run the scoped agentless scan and SaaS/API connectors against the agreed segment and deliver a detailed discrepancy report within 3 business days.
• Agree representative segment and access plan
• You agree that the delivered discrepancy report meets the minimum evidence needed to start a defensible audit response or specify any gaps.
• Provide the network segment list, access windows, and any required API credential scope for the agreed sample segment.
• Execute the agentless scan and SaaS/API connectors
• Export and provide current inventory records for the sample segment for reconciliation purposes.
• You commit to provide the access windows and segment details required to run the estate-wide discovery once the sample is validated.
• Confirm acceptance criteria for the run, including required evidence elements and acceptable discrepancy thresholds.
• Walk through reconciliation of findings to your existing inventory
• Validate evidence sufficiency and extrapolation approach
• Forced validation, confirm this matches your need

• Scoped Discovery Run, Live Session
• Scoped Discovery Run Deck
• Scoped Discovery Run Brief

• meeting
• slides
• document

• Deploy Agentless Network Discovery
• Activate SaaS API Connectors
• Consolidate Inventory from Multiple Sources
• Normalize and Deduplicate Asset Records
• Ingest and Link Procurement Records
• Reconcile Licenses to Deployments
• Configure Entitlement and Contract Library
• Generate Audit-Ready License Position Report
• Integrate with Procurement and ITSM Workflows
• Implement License Reclamation and Reharvest Workflows
• Tag Assets for Retirement and Disposal
• Enable Continuous Discovery and Sync
• Train ITAM and Procurement Teams on Platform

Deploy Agentless Network Discovery

• Which IP ranges, VLAN IDs, or subnets should we include in the initial agentless scan of your corporate network?
• Do you require discovery behind network address translation (NAT) or on isolated segments via a jump probe appliance? Options: Yes, jump probe required, No, all segments routable, Unsure — need assessment
• How many on-premises sites or remote office locations need scheduled scans during the rollout? Options: 1-5, 6-25, 26-100, 100+
• What inventory artifacts are critical to capture from the scan (for example: host MAC address, OS build, installed package list, virtual machine tag)?

Activate SaaS API Connectors

• Which SaaS tenants or admin console accounts do you want connected first (list by vendor tenant ID or administrative domain)?
• What credential model will you provide for connectors: service account with OAuth client, API token, or read-only admin API key? Options: OAuth client (recommended), API token, Read-only admin key, Need guidance
• Are there delegated admin or consent processes (for example, Azure AD consent or Google Workspace super-admin approval) that will affect connector activation windows? Options: Yes — approvals required, No — connectors can be provisioned immediately, Unsure — need to confirm
• Do you want us to prioritize connectors that map to high-risk license families named in your audit notice (for example, database cores or enterprise CALs)? Options: Yes, prioritize audit-related families, No, prioritize broad coverage first, Other

Consolidate Inventory from Multiple Sources

• List the inventory sources to consolidate (for example: endpoint management export, virtual machine inventory, cloud provider asset report, procurement CSV, spreadsheet) and indicate file formats.
• How many distinct inventory feeds will you provide initially? Options: 1-3, 4-6, 7-10, 10+
• Which source should be treated as the authoritative procurement record for mapping purchases to assets (for example: your ERP purchase order export or procurement CSV)?
• Are there source feeds behind SFTP or internal APIs that require a connector we must configure, and do you have endpoint access windows for those transfers? Options: SFTP feeds, Internal REST APIs, Scheduled CSV exports, No secured feeds

Normalize and Deduplicate Asset Records

• Which unique identifiers do your sources commonly include that we should use for deduplication (for example: serial number, MAC, asset tag, VM UUID, cloud instance ID)?
• Do you have a canonical naming convention for hosts, VMs, or SaaS accounts we should apply during normalization? Options: Yes — provide pattern, No — request we apply standardization, Partial — some environments only
• What tolerance for conflicting fields do you accept (for example: prefer procurement record over discovery for device owner when mismatch occurs)? Options: Procurement wins, Discovery telemetry wins, Newest timestamp wins, Manual review required
• Provide any existing asset-tag mapping tables or CMDB reconciliation rules that we must import or preserve during deduplication.

Ingest and Link Procurement Records

• Which procurement systems or file exports will we ingest (for example: ERP PO CSV, vendor license entitlement report, reseller invoice spreadsheet)?
• How do you track contract-to-purchase relationships today (PO number, contract number, purchase requisition), and which field should be the primary link? Options: PO number, Contract number, Invoice number, Other
• Estimate the volume of procurement line items to ingest for the initial rollout (line item count). Options: Under 1,000, 1,000-10,000, 10,000-50,000, 50,000+
• Are there historical procurement periods that must be included for audit (for example: last 7 years, last 3 fiscal years)? Options: Last 1 year, Last 3 years, Last 7 years, All available history

Reconcile Licenses to Deployments

• Which license metric types and families must be reconciled in scope (for example: user CALs, core-based, processor licenses, SaaS seat counts)?
• Define the reconciliation completeness threshold that will constitute acceptance for the initial segment (for example: 95% of purchased entitlements mapped to deployments). Options: 90%, 95%, 98%, 100%
• Which license entitlement sources will we use as the authority for counts (for example: vendor entitlement report, reseller ledger, your ERP contract table)?
• Who in your organization will own final disposition decisions for mismatches (for example: procurement, ITAM, legal), and provide contact name or group?

Configure Entitlement and Contract Library

• How many active contracts and entitlements should we catalog in the library for the rollout (provide approximate count)? Options: Under 50, 50-250, 250-1,000, 1,000+
• What contract fields are mandatory for you (for example: contract number, effective date, renewal date, license metric, authorized users)?
• Do you require templated reconciliation rules tied to contract clauses (for example: core-to-socket mapping, user-to-device mappings)? Options: Yes — define rule templates, No — ad hoc rules sufficient, Need guidance
• Are there NDAs or redacted contract copies that will affect what metadata we can store in the library? Options: Yes — redacted copies, No — full contracts available, Some contracts redacted

Generate Audit-Ready License Position Report

• What accuracy threshold and evidence types will you accept for the audit-ready report (for example: 95% accuracy and exported discovery logs plus linked PO lines)? Options: 90% + discovery logs, 95% + discovery logs and procurement links, 99% + vendor entitlement match
• Which audit format do you need for submission (for example: CSV export, PDF report with appendix, or a structured reconciliation workbook)? Options: CSV export, PDF report with appendix, Structured workbook (XLSX)
• Identify any legal acceptance criteria from the audit notice that must be surfaced in the report (for example: defined baseline date, license metric used by the auditor).
• Provide a list of stakeholders who must review and sign off the audit-ready license position and their maximum review window in days.

Integrate with Procurement and ITSM Workflows

• Which procurement or IT service management (ITSM) systems must we integrate with for PO sync and change ticket creation (provide system type or export method)?
• What automated actions do you expect when a license mismatch is detected (for example: create ITSM ticket, trigger procurement approval, or notify asset owner)? Options: Create ITSM ticket, Trigger procurement approval, Email asset owner, Manual review
• Do you have existing webhooks, middleware, or integration credentials to enable real-time sync with procurement or ITSM? Options: Yes — provide details, No — will use scheduled exports, Unsure — need assessment
• Which approval SLAs must the integrated workflows respect (for example: PO approvals within 5 business days, change windows within maintenance window)?

Implement License Reclamation and Reharvest Workflows

• Which license families are eligible for automated reclamation (for example: named-user SaaS seats, floating database cores)?
• What grace period do you require before reclaiming a seat or license from an inactive account (for example: 7 days, 30 days)? Options: 7 days, 14 days, 30 days, Custom
• Do you require human approval for each reclamation action or an aggregated batched approval by procurement/ITAM? Options: Individual approval required, Batched approval, Fully automated
• List any systems or endpoints that must be excluded from reclamation due to business criticality (for example: service accounts, SOC tooling).

Tag Assets for Retirement and Disposal

• Which retirement criteria should trigger an asset tag for disposal (for example: last check-in > 180 days, decommissioned VM tag, contract expired)?
• Who will own the final disposition approvals for tagged assets and what disposal certificate or evidence is required?
• Do you require integration with asset disposal vendors or generation of a disposal certificate (for example: serial number list, date shredded)? Options: Yes — integrate vendor, No — provide export only, Optional
• Are there compliance constraints for disposal (for example: data erasure standards, e-waste recycling requirements) we must enforce? Options: Yes — provide standard, No

Enable Continuous Discovery and Sync

• What sync cadence do you require between discovery sources and the platform for production (for example: near-real-time, hourly, daily)? Options: Near-real-time, Hourly, Daily, Weekly
• Define the operational acceptance for continuous discovery in terms of data freshness and missed-sync tolerance (for example: data no older than 24 hours; no more than 5% missed syncs per month). Options: 24 hours freshness, 12 hours freshness, Near-real-time, Custom
• Which monitoring or alerting channels should notify your team when discovery fails or connector auth expires (for example: email, webhook to ITSM, Slack)? Options: Email, Webhook to ITSM, Slack/Messaging, Other
• Provide the list of service accounts or API credentials that require automatic rotation versus those you will rotate manually.

Train ITAM and Procurement Teams on Platform

• How many users across ITAM, procurement, and operations require role-based training during the rollout? Options: 1-5, 6-15, 16-50, 50+
• Which training format do you prefer: live workshop with Q&A, recorded modules with quizzes, or train-the-trainer sessions? Options: Live workshop, Recorded modules, Train-the-trainer
• Do you require hands-on exercises using your own inventory and contracts during training sessions? Options: Yes — use live data, No — use sandbox data, Partial — anonymized extracts
• What success criteria will you use to accept the training deliverable (for example: percentage of users passing a knowledge check, completion of specified playbooks)? Options: 50% pass rate, 75% pass rate, 90% pass rate, Completion of playbooks

• Non-Disclosure Agreement (NDA)
• Master Services Agreement (MSA)
• Statement of Work (SOW)
• Subscription Order Form (Subscription Agreement)
• Data Processing Agreement (DPA)
• Data Access Authorization
• Acceptance Criteria & Sign-off
• Project Timeline & Milestone Commitment
• Service Level Agreement (SLA)
• Change Order Agreement
• Payment Schedule & Order Confirmation
• Compliance Addendum (conditional)

• Go-live Health Check (weeks 1-4)
• First Measurement Review (weeks 4-10)
• Acceptance Gate and Ratification (around day 90)
• Operational Remediation and Adoption Review (monthly, post-acceptance)
• Quarterly Outcomes Review (quarterly)

• Close or reassign remediation tickets older than 30 days with an updated resolution timeline
• Create remediation tickets for each failed criterion with concrete milestones and evidence checklists
• Execute the incumbent wind-down tasks: archive required data, set the incumbent to read-only or schedule contract termination, and communicate change to affected teams
• Reconciliation progress and completion rate
• Reduce the count of remediation tickets older than 30 days and keep entitlement reconciliation completion rate at or above the target recorded in the Solution Scope.
• Triaged enhancement backlog with clear next-step decisions for the top 3 items affecting reconciliation or discovery accuracy.
• Agree any temporary workarounds required to maintain audit-ready reporting while permanent fixes are implemented.
• Re-confirm success criteria and owners
• Publish an updated reconciliation runbook that captures any mapping or rule changes made during the meeting
• Record agreed enhancement requests in the shared channel with priority tags and expected delivery quarters
• Cumulative realized savings and financial reconciliation
• Confirm whether cumulative realized savings and license position accuracy meet the Solution Scope targets and document any variances.
• Agree the top 3 operational adjustments for the coming quarter to protect savings and reduce compliance risk.
• Validate the shared channel remains the single source for issues and enhancement requests and confirm SLAs for triage and delivery.
• Deliver a one-page executive summary showing cumulative savings, accuracy variance, and open high-risk items
• Update the compliance risk register with current status and planned mitigations for open items
• Prioritize enhancement backlog items for the next quarter and publish the planned delivery windows
• Confirm the Solution Scope success criteria are understood and each criterion has an accountable owner.
• Validate that initial scans completed and produced ingestible data or document the exact failure modes.
• Produce a prioritized remediation list for issues blocking accurate discovery with target resolution dates.
• Publish a go-live health summary that records which connectors and segments completed successful scans and which failed
• Log and prioritize open defects or access issues with target resolution dates and required inputs
• Schedule credential rotation or access-window windows needed to complete failed scans
• Present first measurement data vs targets
• Establish whether each named metric (discovered-asset delta, unmanaged devices, unmanaged SaaS subscriptions) is on a trajectory to meet the Solution Scope targets.
• Agree a time-bound corrective action plan for each missed metric with completion dates that feed into the acceptance timeline.
• Validate the evidence package locations and formats required for the Acceptance Gate decision.
• Produce and circulate the reconciliation report showing asset-by-asset mapping versus the baseline used in the Solution Scope
• Schedule targeted re-scans or connector fixes for segments identified as blind spots and record expected completion dates
• Normalize field mappings for assets that failed auto-match and document matching rules changes
• Restate numeric acceptance criteria
• Produce a documented pass or fail for every acceptance criterion recorded in the Solution Scope and record the buyer's ratification decision.
• For any failed criteria, capture a specific remediation plan with milestones and an evidence list for re-validation.
• Confirm the incumbent system wind-down status and next steps to prevent parallel usage or duplicate payments.
• Publish the acceptance record that lists pass/fail per criterion and includes the agreed evidence package locations
• Deployment and connector validation
• Audit-ready license position accuracy and compliance posture
• Present outcome data against each criterion
• Root-cause diagnosis for any gaps
• Remediation ticket burn-down and aged issues
• Shared channel health and enhancement backlog status
• Agree corrective actions and timeline to acceptance gate
• Early adoption signals and data sanity check
• Document pass/fail per criterion and formal acceptance decision
• Shared issue and enhancement request channel triage
• Adjustments to reconciliation rules or scan schedules
• Confirm evidence package for acceptance
• Agree remediation plan for any failed criteria
• Blockers and immediate remediation actions
• Quarter priorities and operational adjustments
• Incumbent system wind-down checkpoint