A licence is not a one-time purchase you can forget: a subscription renews, an account is tied to a person, and a departing employee can take access with them. The Canadian Centre for Cyber Security recommends maintaining a centralized inventory of all hardware and software (Obsolete products (ITSAP.00.095)). This page offers no legal opinion on vendors' licence terms.
Short answer
You describe your software, your users and your current subscriptions: your request is reviewed by the Courtier TI team, then entrusted to the IT services company that will prepare your quote and supply the licences. Inventory, renewals and account management are set with you.
What the quote should cover
- An inventory of software, licences and subscriptions in place
- The licences or subscriptions to acquire or renew
- Tying subscriptions and accounts to the company
- Tracking renewal dates and end-of-support dates
- Assigning licences to users
- Removing access and licences when someone leaves
- Installing and updating software on computers
Start with the inventory
According to the Canadian Centre for Cyber Security's publication Obsolete products (ITSAP.00.095), organizations should maintain a centralized inventory of all hardware, software and network-connected components, record product name, version, location, business owner and vendor support status, and track vendor end-of-sale and end-of-support dates.
For a licensing request, add to this inventory the number of licences held, their type (per user, per device, subscription), who they are assigned to and the renewal dates. You will then see unused licences, duplicates and software whose support is ending.
Subscriptions and renewals
For each subscription, state the renewal date, billing frequency, number of accounts and the person who receives the vendor's notices. Ask the quote to state who tracks renewals, how licences are added or removed during a subscription, and how you are notified before a renewal.
The Centre recommends that organizations discontinue the use of products once they are no longer supported. So list the older software you still use, so the quote accounts for it.
Accounts in the company's name
A subscription opened with the personal address of an employee or a former provider can become hard to recover. Ask that subscriptions, administrator accounts and billing addresses be in the company's name and accessible to a designated person. If an IT services company manages your licences, specify how access will be handed back if you change providers.
When an employee leaves
The Centre's baseline cyber security controls for small and medium organizations ask organizations to remove accounts and/or functionality when employees no longer require these for their tasks (BC.12.3). For software, the departure procedure should cover disabling accounts, removing or reassigning licences, transferring useful files and changing passwords for common accounts.
For Microsoft 365, the Microsoft 365 licensing page describes the steps published by Microsoft. For the computers themselves, the departure procedure is part of device management.
Terms of use
Each vendor sets its own terms: number of installations allowed, commercial use, remote use, transfer of a licence. These terms are not summarized here. Ask the quote which terms apply to the proposed licences and attach the licence documents you already hold. For a legal question, consult a legal advisor.
What to specify in your request
- The list of software used and its version
- The number of licences per software and their type
- Subscription renewal dates
- The addresses and people tied to the accounts
- The software to add or replace
- The current procedure when an employee leaves
You can then describe your project: the team will contact you to clarify your needs and provide a quote.
Frequently asked questions
Why take an inventory of licences?
The Canadian Centre for Cyber Security recommends maintaining a centralized inventory of hardware and software, with their version, business owner and vendor support status (ITSAP.00.095). For licences, the inventory also shows unused licences and upcoming renewals.
Who should own the subscriptions?
Ask that they be in the company's name, with a company address and a designated person, rather than in the name of an employee or a provider. This makes departures and provider changes easier.
What should we do with a departing employee's licences?
The Canadian Centre for Cyber Security asks organizations to remove accounts and/or functionality when employees no longer require them (BC.12.3). The departure procedure should cover disabling accounts and removing or reassigning licences.
Should software that is no longer supported be replaced?
The Centre recommends discontinuing the use of products once they are no longer supported, with a planned transition period (ITSAP.00.095).
Does this page say whether our licences meet vendors' terms?
No. Each vendor sets its own terms. Ask the quote which terms apply to the proposed licences and, for a legal question, consult a legal advisor.