1. You must give IBM a detailed report of all deployed programs within 30 days of a request
What IBM says:
“Client will, for all Programs at all Sites and for all environments, create, retain, and each year provide to IBM upon request with 30 days’ advance notice: i) a report of deployed Programs, in a format requested by IBM, using records, system tools output, and other system information and ii) supporting documentation (collectively, Deployment Data).” 1
What changed?
IBM already had the right to request usage data for software in IBM Program License Agreements (IPLAs). Now, this right extends to IPAAs.
Previously, you only needed to retain IBM License Metric Tool (ILMT) audit snapshots for sub-capacity eligible products for two years. You must now maintain yearly compliance for all IBM products. However, the IPAA doesn’t specify how long to retain your annual positions.
IBM is also pushing back on written confidentiality agreements with independent auditors. This move indicates that attaining a separate NDA with IBM’s appointed independent auditors might be more difficult. We advise you to work with a partner who can provide an additional NDA that offers you protection.
What does this mean for you?
You must keep annual records of your IBM software usage—for all your locations and environments. If requested, you must send IBM this information within 30 days of notification.
IBM still reserves the right to conduct a full audit every three to four years. But IBM will now use your yearly report as a baseline for the audit while retaining the right to request additional data.
1 IBM (2023, January 31). International Passport Advantage Agreement, Section 4.1a. IBM Terms. Retrieved March 10, 2023, from https://www.ibm.com/support/customer/csol/terms/?id=Z125-5831&lc=en#detail-document