Contents
Key takeawaysWhat an ITAM maturity model isWhat we see in reviewsHow maturity turns into savingsAssessing your maturityWhat vendors will sayBuilding the roadmapWhat to do nextFAQAn ITAM maturity model rates how reliably you can prove what software you own and use. Each stage up lowers licensing cost and audit exposure, and the weakest of five dimensions sets your real stage.
- Maturity comes in five stages. Initial, reactive, proactive, managed and optimized, each defined by how reliably you track entitlements and reconcile deployments.
- Data quality is the gate. The weakest of the five scored dimensions sets your stage, whatever tools you own.
- Higher maturity cuts cost and risk. Each stage lowers what you pay at renewal and what a vendor can claim in an audit.
- Start with your top vendors by spend. Clean records for the three largest vendors give the fastest payback.
- Governance keeps the gains. A named owner, a fixed cadence and procurement gates turn tool data into reliable entitlement positions.
- Plan six to twelve months per stage. People and process adoption set the pace, so budget for owner time before tool rollout.
What is an ITAM maturity model and why use one?
An ITAM maturity model is a staged map of capability. Each stage describes how reliably you track entitlements, reconcile them against deployments and feed the result into procurement. It shows where you stand today and what the next stage buys you in lower cost and lower audit exposure.
The value for an enterprise buyer is commercial. At low maturity, software asset management is a cost center that answers audit letters. At higher maturity it becomes a negotiating advantage, because you walk into every renewal knowing what you own, what you use and what you can drop.
Which standards does an ITAM maturity model rest on?
The discipline rests on ISO/IEC 19770-1, the international standard for an IT asset management system. The current edition dates from 2017 and adds IT specific requirements on top of ISO 55001:2014, the general asset management standard. Its companion, the SWID tag standard (ISO/IEC 19770-2:2015), defines the software identification tags that discovery tools read.
Vendor rules sit alongside the standards. Microsoft licensing documentation and Microsoft 365 enterprise guidance are good examples of the publisher material your records must match. Use the standards as the backbone and adapt the detail to your own vendors and contracts.
What are the five stages?
- Initial. Assets are tracked ad hoc and there is no single source of truth. An audit letter starts a scramble through email and invoices.
- Reactive. An inventory exists, but it is only updated under pressure, usually when a renewal or audit is already running.
- Proactive. Reconciliation happens on a regular cycle and entitlement records are kept for each major vendor.
- Managed. Automated discovery feeds procurement decisions, so purchase requests are checked against what you already own.
- Optimized. Optimization is continuous and evidence is ready before a vendor asks for it.
Which dimensions do you score?
Score five dimensions separately, because a single overall grade hides the gap that matters. The lowest dimension caps your real maturity, however strong the others are.
- Data quality. Can you trust the deployment and entitlement numbers without a manual check?
- Process. Is there a defined reconciliation cycle, and does it run on schedule?
- Tooling. Do discovery and inventory tools cover servers, desktops, virtual hosts and cloud subscriptions?
- Governance. Does a named person own each major vendor's data and answer for its accuracy?
- Procurement integration. Does a purchase or renewal request have to pass an entitlement check before it is approved?
What have we seen in recent ITAM maturity reviews?
Maturity was the strongest predictor of negotiating outcome in our recent work, stronger than total spend or which vendor sat across the table. That held across roughly 40 to 50 software asset management reviews we ran in 2024 and 2025, and three patterns came up again and again.
- Overpayment below proactive. Organizations below the proactive stage overpaid by 15 to 30 percent on at least one major vendor.
- Fast recovery from clean data. Building clean entitlement data for the top three vendors recovered 10 to 20 percent within the first year.
- Faster audits. Audit outcomes improved sharply once the team could reconcile deployment data in days where it used to take weeks.
The speed point is easy to underrate. When reconciliation takes weeks, the vendor's auditors control the timetable and their numbers become the working draft. When it takes days, you review their findings against your own and dispute errors before they harden into a claim.
Why a new SAM platform rarely lifts maturity on its own
The usual advice is to buy a software asset management platform and let the tool raise your maturity. We disagree. In roughly 28 of the 45 ITAM programs we assessed, the organization already owned capable tooling and still sat at a low stage, because data ownership and governance were missing.
Fix process and accountability before you add tools, in this order.
- Assign a clear data owner for each major vendor.
- Define a reconciliation cadence and hold to it.
- Tie entitlement records to procurement approval.
In our reviews, a disciplined team with a basic tool reached a reliable license position sooner than a loosely run team with an expensive one. When you do reach the tooling decision, our SAM tool comparison covers the main platforms.
ITAM Maturity Guide
The maturity scorecard, five stage roadmap and entitlement evidence pack in one download.
Get the white paper →How does ITAM maturity translate into savings?
Savings come through three channels: reclaiming unused licenses, negotiating from accurate data and removing true up surprises. Each one compounds as data quality rises, which is why the returns climb at every stage.
| Stage | Data reliability | Negotiating position | Typical savings |
|---|---|---|---|
| Reactive | Low | Vendor sets the facts | Minimal |
| Proactive | Medium | Reconcile before renewal | 10 to 15 percent |
| Managed | High | Negotiate from evidence | 15 to 25 percent |
| Optimized | Very high | Continuous optimization | 25 percent and rising |
What does the business case look like in numbers?
Take a hypothetical company whose top three vendors account for $9 million of annual software spend. It staffs the program with two analysts at $150,000 each, fully loaded, and a tool subscription of $200,000 a year, so the program costs $500,000 annually.
| Stage reached | Savings rate applied | Annual savings | Net of $500,000 program cost |
|---|---|---|---|
| Proactive, low end | 10 percent | $900,000 | $400,000 |
| Proactive, high end | 15 percent | $1,350,000 | $850,000 |
| Managed, high end | 25 percent | $2,250,000 | $1,750,000 |
At the low end the program pays for itself in under seven months of savings ($500,000 divided by $900,000, times 12). The cash does not arrive evenly, though. Savings land on renewal and true up dates, so a program that starts eight months before its largest renewal will show little until that date.
Why fix the weakest link first?
Money spent on a strong dimension does not move your stage while a weak one holds it down. Advanced tooling bought while governance lags is mostly wasted, so the fastest payback usually comes from closing the weakest gap.
A strong discovery tool with no owner for the data produces reports that the renewal team will not rely on, and the vendor's figures fill the gap.
How do you assess your current ITAM maturity?
Score each of the five dimensions from the evidence you can produce today. A simple test works well: ask the owner of your largest vendor to produce the current license position within five working days, and note where the request stalls.
Which reports show your real position?
Most of the evidence already exists in consoles you own. What is usually missing is someone who pulls it on a schedule and reconciles it against the contract.
- Microsoft. Microsoft 365 admin center usage reports show each user's last activity by service, and Entra ID sign in logs show which licensed accounts have not signed in for months.
- Oracle Database. The DBA_FEATURE_USAGE_STATISTICS view records which options and management packs have been used, which is where many audit findings start. Our Oracle software asset management guide explains how to read it.
- IBM. Sub capacity licensing depends on the IBM License Metric Tool. IBM's terms require it within 90 days of your first eligible deployment and reports at least every quarter, as our ILMT sub capacity guide sets out.
- Virtual infrastructure. vCenter host and cluster inventory shows physical cores and where workloads can move, which drives licensing for products counted by processor.
- Contracts. Order forms, amendments and reseller invoices form the entitlement record. Without proof of purchase, a vendor can treat an owned license as unlicensed.
For the Oracle side, the step from contract to deployment is covered in detail in our guide to Oracle entitlement reconciliation. For Microsoft, see our Microsoft SAM guide.
How does the assessment change with company size?
Take two hypothetical buyers. A 2,000 employee company can reach the proactive stage with one part time owner, the vendor portals and a well kept spreadsheet, as long as the top three vendors are reconciled on schedule. Tooling can wait.
A 50,000 employee group needs a named owner per major vendor, automated discovery across data centers and cloud accounts, and a rule that no renewal goes to signature without an entitlement check. Its weakest dimension is usually governance across business units.
What will vendors say about your ITAM data, and how should you answer?
Account teams know that a buyer with weak data accepts the vendor's numbers. Expect some version of these lines, and have the answer ready before the renewal or audit starts.
- "Let us run our scripts so we can confirm you are compliant." Reply that you will run the scripts yourselves, review the output and share what the contract requires, on a timetable you agree in writing.
- "Our partner offers a free license review." Ask in writing who receives the final report and whether its findings can be used in a compliance claim or a sales proposal.
- "Your renewal quantity should be last year plus growth." Reply with your reconciled usage, including the dormant licenses you plan to drop, and quote from that number.
- "Your own tool shows you are over deployed." Ask which measurement rules the tool applied. Discovery counts installations, while the contract counts licenses under specific metrics, and the two rarely match without adjustment.
In a software negotiation, the side with the better data wins. Maturity is the discipline of having it.
How do you build an ITAM maturity roadmap?
Sequence the roadmap by payback, not by stage number. Start where reliable data opens the largest savings, then widen coverage and automation once that foundation holds.
- Baseline your maturity across all five dimensions.
- Pick the top three vendors by spend to fix first.
- Establish clean entitlement and deployment records for those vendors.
- Set a reconciliation cadence and assign data owners.
How long does each stage take?
Plan six to twelve months per stage. Data quality and process adoption set the pace, so the timetable depends on people and governance far more than on tool rollout. A typical first year toward the proactive stage runs like this.
| Months | Focus | Output |
|---|---|---|
| 1 to 3 | Baseline and scope | Scores for the five dimensions, top three vendors chosen, contracts collected |
| 4 to 6 | Entitlement records | One reconciled license position per vendor, gaps and surplus listed |
| 7 to 9 | Cadence and owners | Named owner per vendor, reconciliation cycle running on schedule |
| 10 to 12 | Procurement link | Entitlement check built into purchase and renewal approval, stage reassessed |
What governance keeps maturity from slipping?
Three things hold the gains: a named owner, a fixed cadence and a link to procurement gates. Without them, maturity decays as soon as the project team is reassigned.
The procurement link does the most. Put an entitlement check in front of every new purchase request, every renewal from 12 months out, every acquisition or divestiture, and every cloud migration that shifts licensed workloads.
Which mistakes stall ITAM programs?
- Trusting the tool's license position as final. Tools report installations. Without the vendor's metric rules applied, you negotiate against inflated numbers.
- Starting with every vendor at once. The effort spreads thin and no single position is reliable when the first renewal arrives.
- Letting a project team own the data. When the project closes, the data ages, and within a year you are back to the reactive stage.
- Keeping proof of purchase in email. Contracts and invoices that cannot be found during an audit are licenses you may have to buy again.
- Reporting hours and tickets. Report reclaimed licenses, avoided true ups and renewal reductions, because that is what keeps the budget in place. Our shelfware audit guide shows how to count them.
If you want an outside view of where you stand, a software spend assessment scores the five dimensions against your actual contracts and deployments.
What to do next
- Score from evidence. Rate your ITAM maturity on each of the five dimensions, using only what you can prove today.
- Find the leak. Identify the weakest dimension and the largest cost leak it causes.
- Fix the top three vendors. Build clean entitlement records for your three largest vendors by spend.
- Set the rhythm. Run a regular reconciliation cadence with a named owner for each vendor.
- Connect procurement. Make entitlement evidence a required step in purchase and renewal approval.
- Automate later. Automate discovery once process and governance hold.
- Reassess yearly. Score your maturity again each year and reset the target stage.
Frequently asked questions
What is an ITAM maturity model?
It is a staged model that rates how well an organization manages its software and hardware assets, from ad hoc tracking to optimized, governed practice. It gives you a baseline and a target, so you can decide where the next dollar of ITAM investment should go and justify it to finance.
Why does ITAM maturity matter for licensing cost?
Higher maturity lowers licensing cost and audit risk directly. With reliable entitlement and deployment data you negotiate from facts, avoid true up surprises and reclaim unused licenses, which routinely saves double digit percentages. Without it, the vendor's own count becomes the basis for your renewal quote.
What are the stages of ITAM maturity?
Most models use five: initial, reactive, proactive, managed and optimized. The early stages build a basic inventory; the later ones add automated reconciliation and continuous optimization tied to procurement. The jump from reactive to proactive is usually where the first real savings appear.
How do I assess my current ITAM maturity?
Score data quality, process, tooling, governance and procurement integration separately, using evidence you can produce today. The lowest score is your real stage, and that weakest link is usually where the next investment pays back fastest. An outside assessor helps when internal teams grade their own work.
What tools support ITAM maturity?
Discovery tools, a software asset management platform and a configuration management database all help, but tools alone do not raise maturity. They collect installations. Process and governance apply each vendor's metric rules to that data and turn it into an entitlement position you can put in front of an account team.
How long does it take to move up a maturity stage?
Six to twelve months per stage is realistic for most enterprises. The limiting factor is data quality and how quickly teams adopt the process, so a sound plan budgets for owner time and training and treats the tool go live date as one milestone among several.
Does ITAM maturity reduce audit exposure?
Yes. When you know your position before the vendor does, an audit becomes a reconciliation of two data sets instead of a surprise claim. You can check the auditor's findings line by line and dispute errors early, and that capability alone often justifies the program.
Where should a low maturity organization start?
Start with accurate discovery and a clean entitlement record for your top three vendors by spend. Collect every order form and amendment first, since proof of purchase is the part that cannot be rebuilt later. That foundation delivers the fastest savings and supports every later stage.