The opening true up quote ran 1.6 to 2.4 times the settled figure, and Cisco true ups only ever step up
The true up is the second negotiation nobody schedules. It arrives annually, it only moves in one direction by default, and the opening number assumes you will not check the reconciliation it was built from.
Prepared by Redress Compliance · August 16, 2026 · Cisco advisory. 35 to 45 Cisco ELA engagements benchmarked, 2024 to 2025.
Executive summary
The opening true up quote ran 1.6 to 2.4 times the settled figure. That spread says the first number is a position rather than a calculation, and it is presented as though it were arithmetic.
Cisco true ups historically only step up. Step down rights have to be negotiated into the terms framework, so an estate that shrank still pays as though it grew.
The growth allowance is typically 20 percent, and consumption above it triggers the charge. Knowing where you sit against that line before Cisco tells you is the whole preparation.
Reconciliation runs against the contracted suite, not the individual SKU. Suite substitution rights therefore determine your exposure, which is a contract question rather than a consumption one.
How the true up actually computes
The true up is the publisher's principal commercial moment outside renewal, and its mechanics decide the number long before the quote arrives.
| Element | How it works | Where the buyer position sits |
|---|---|---|
| Cadence | Annual by default | Predictable, so it can be prepared for rather than reacted to |
| Growth allowance | Typically 20 percent before charging begins | Know your position against the line before Cisco states it |
| Reconciliation basis | Against the contracted suite, not the SKU | Suite substitution rights decide exposure |
| Direction | Step up only, historically | Step down must be negotiated into the terms framework |
| Audit posture | Cisco opens the audit conversation in the run up | The audit position drives the commercial outcome |
Suite level reconciliation is the detail that decides exposure. Because the true up measures against the contracted suite rather than individual SKUs, an estate that shifted consumption between products inside the same suite may owe nothing while one that grew a single SKU outside it owes a great deal. That makes suite substitution rights a commercial term rather than a technical convenience, and it is why the exposure question cannot be answered from a consumption report alone.
A number presented as arithmetic, arrived at as a position
Across the Cisco ELA engagements benchmarked, the opening true up quote ran 1.6 to 2.4 times the settled figure. That range is the finding. A true up is framed as a reconciliation, an arithmetic consequence of consumption exceeding an allowance, and a genuine reconciliation does not settle at half its opening value. The spread tells you the first number carries assumptions the buyer is expected not to test, and that testing them is worth 25 to 40 percent against the first quote in the engagements where the right moves were in place.
The asymmetry underneath it is structural. Cisco true ups historically only step up, which means the mechanism captures growth and is silent on contraction. An estate that consolidated, divested, or simply overbought at signature carries that overbuy forward, while any growth above the roughly 20 percent allowance is charged. Step down rights exist but have to be negotiated into the terms framework, and an agreement signed without them has accepted a one way ratchet as the default. That is fine when it is priced and understood, and it is expensive when the buyer assumed the reconciliation ran both ways.
The audit conversation is the part that catches buyers off guard, because it arrives before the commercial one rather than after it. Cisco engages on audit in the run up to the true up, and the audit posture then drives the commercial outcome. A buyer treating those as sequential, first establishing the compliance position and then negotiating the charge, has already conceded the frame: the number being negotiated was built from the audit position, so the time to influence it was during the audit rather than after it.
What follows is that the true up needs the same preparation a renewal gets, on an annual cycle rather than a triennial one. Know your consumption against the growth allowance before Cisco states it. Establish what suite substitution rights you hold, since exposure is measured at suite level. Negotiate step down into the terms framework while the agreement is open, because it cannot be retrofitted. And treat the pre true up audit conversation as the opening of the commercial negotiation, which is what it is. The renewal side of the same agreement sits in the ELA renewal playbook, the data discipline in the Smart Licensing guide, and the wider library in the Cisco practice.
- Your agreements decoded into plain English before the auditor interprets them for you
- Consumption reconciled at suite level, with substitution rights mapped
- Every risky clause flagged with the exact quote, the page, and the replacement language
The moves that cut the charge
- Measure consumption against the growth allowance before Cisco does, so the first number in the conversation is one you can check rather than one you must dispute.
- Establish suite substitution rights, because reconciliation runs at suite level and consumption that moved between products inside a suite may carry no charge at all.
- Negotiate step down into the terms framework while the agreement is open, since the default is step up only and it cannot be added later.
- Treat the pre true up audit conversation as the commercial negotiation, because the charge is built from the position established there.
- Challenge spikes in the peak, since a reconciliation built on short lived consumption peaks inflates a figure that then persists into the renewal base.
- Prepare annually, not triennially. The true up recurs every year and receives a fraction of the preparation the renewal gets, which is why the opening quote can run at twice the settled number.
What the Cisco true ups showed, 2024 to 2025
Across roughly 35 to 45 Cisco ELA engagements benchmarked:
How far the first true up quote exceeded the figure the same reconciliation eventually settled at.
Cut achieved against the publisher first quote where the buyer side moves were in place before the conversation opened.
The growth allowance is typically 20 percent, and consumption above it triggers the charge. Reconciliation runs against the contracted suite rather than individual SKUs, so suite substitution rights determine the exposure more than raw consumption does.
Cisco engages the audit conversation in the run up to the true up, which means the compliance position and the commercial position are the same negotiation arriving in two parts.
Your first five moves
- Measure consumption against the growth allowance annually, ahead of the true up rather than in response to it.
- Document suite substitution rights and test whether consumption growth actually crosses a suite boundary or merely moved inside one.
- Challenge peaks built from short lived spikes, because an inflated reconciliation persists into the renewal base rather than resetting.
- Negotiate step down rights into the terms framework at the next open moment, since the default ratchet only moves one way.
- Treat the pre true up audit as the start of the commercial conversation. The Cisco practice runs the reconciliation with you.
Frequently asked questions
How often does a Cisco ELA true up?
Annually by default. It is the publisher principal commercial moment outside of renewal, which means an ELA carries a negotiation every year rather than only at term end, and it typically receives a fraction of the preparation a renewal gets.
How far off is the opening quote?
It ran 1.6 to 2.4 times the settled figure across the engagements benchmarked. A genuine reconciliation does not settle at half its opening value, so that spread indicates the first number carries assumptions the buyer is expected not to test.
What is the growth allowance?
Typically 20 percent. Consumption above the allowance triggers the true up charge, so knowing where you sit against that line before Cisco states it is the single most useful piece of preparation available.
Do true ups ever step down?
Not by default. Cisco true ups historically only step up, so an estate that consolidated or divested still carries its original commitment. Step down rights must be negotiated into the ELA terms framework and cannot be added afterwards.
What does the reconciliation measure against?
The contracted suite rather than the individual SKU. That means consumption which shifted between products inside a suite may carry no charge, while growth crossing a suite boundary does. Suite substitution rights therefore decide exposure.
Why does Cisco raise audit before a true up?
Because the audit posture drives the commercial outcome. The charge is calculated from the compliance position, so treating audit and true up as sequential concedes the frame. They are one negotiation arriving in two parts.
How much can the charge be reduced?
By 25 to 40 percent against the publisher first quote where the right buyer side moves were in place. That requires preparation before the conversation opens, not argument after the number arrives.
What inflates a true up unnecessarily?
Peaks built from short lived consumption spikes nobody challenged. The problem compounds because an inflated reconciliation does not reset; it persists into the renewal base and prices the next agreement too.
Should the true up be prepared like a renewal?
Yes, and annually. It recurs every year, it moves real money, and it receives far less preparation than the triennial renewal does. That imbalance is the reason opening quotes can run at more than twice the settled figure.
Is the true up negotiable at all?
Substantially. It is presented as arithmetic and arrived at as a position. The reconciliation basis, the suite treatment, the peak calculation, and the audit position underneath it are all contestable, and together they account for the observed spread.
5 Tips for Negotiating with Cisco
Commit to reality not history, cap the true forward first (3 to 4 percent vs the 5 to 8 opener, worth $80k to $160k on a $2M baseline), price Splunk standalone before it enters the bundle, attack the support line, and use the late-July fiscal year.
