Operational ITAM Podcast

Ninety-five million dollars in penalties, a moving company that shouldn't have been there, and the standard that quietly changed nine months ago.

At the end of life, a device stops being an asset and becomes a liability with a serial number. Disposal is the only gate in the lifecycle where getting it wrong doesn't cost you efficiency or budget — it costs you a regulator.

This episode covers what actually changed when NIST published SP 800-88 Revision 2 in September 2025 and withdrew Revision 1 the same day: the shift from a device-by-device technical manual to a program-level governance framework, the deferral of technique detail to IEEE 2883, the retirement of degaussing and multi-pass overwriting, and new language on establishing trust in a vendor's implementation. Then the regulatory stack — GLBA, FACTA, HIPAA, PCI DSS, Sarbanes-Oxley, Regulation S-P — and why one device can sit under five frameworks at once.

The centerpiece is a public enforcement case. Morgan Stanley paid $95 million across two regulators after handing roughly 4,900 devices to a moving and storage company with no data destruction experience. Devices reached an internet auction site with unencrypted customer information intact. Every control that failed was an asset management control.

Plus a listener question from Marcus in Fort Wayne on whether wiping drives in-house before they reach the ITAD vendor is duplicated effort.

IN THIS EPISODE

- NIST SP 800-88 Revision 2 — published September 2025, Revision 1 withdrawn the same day
- Why the media-specific tables were removed and what replaced them
- Clear, Purge, Destroy — what survived and what didn't
- Why degaussing and multi-pass overwriting are the wrong answer for modern media
- Cryptographic erase, and why it's the one technique NIST kept
- Should you wipe in-house before the ITAD vendor? A listener question
- The Morgan Stanley case: $95 million, 15 million customers, 42 unaccounted servers
- The regulatory stack, and why one device sits under five frameworks
- R2v3, e-Stewards, and NAID AAA — what each actually verifies
- The downstream gap auditors find over and over
- What makes a certificate of destruction defensible, and what makes it worthless
- Deaccession, the ledger, and why the shredder isn't the point

CHAPTERS

• (00:03) - Disposal’s Hidden Liability

NIST SP 800-88 Rev. 2 — current standard, published 26 September 2025
https://csrc.nist.gov/pubs/sp/800/88/r2/final

NIST announcement and summary of changes from Revision 1
https://www.nist.gov/news-events/news/2025/09/guidelines-media-sanitization-nist-publishes-sp-800-88r2

NIST SP 800-88 Revision 1 — withdrawal notice
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r1.pdf

IEEE 2883 — Standard for Sanitizing Storage
https://standards.ieee.org/ieee/2883/10277/

SERI — R2v3 standard and certified facility directory
https://sustainableelectronics.org

e-Stewards certified recycler directory
https://e-stewards.org/find-a-recycler/

i-SIGMA — NAID AAA certification
https://isigma.org

Note: NIST SP 800-88 Revision 1 (2014) was withdrawn and superseded in September 2025. A great deal of the ITAD guidance still circulating online cites the withdrawn version.

LISTENER CASE FILES

Got a situation you'd like worked on air? Send it over — anonymized, sanitized, no company names. Real constraints, real politics, real budgets. operationalitam.com

ABOUT THE SHOW

Operational ITAM is a podcast about the unglamorous machinery of enterprise technology — hardware and software asset management, licensing, audit defense, SaaS governance, and the money quietly leaking out of all of them.

Bill Van Nort has led IT asset management, end-user computing, IT operations, and workplace technology at large organizations across banking, mortgage, and automotive. He has reclaimed millions in software spend and survived audits from the biggest publishers on the planet.

Consulting enquiries and listener case files: operationalitam.com

Three years, four, or five? Three curves you can measure in your own environment — and why the confident numbers are the least trustworthy.

Somebody in your organization decided how long a laptop lives. Ask where that number came from and you'll usually get "it's industry standard," "that's what the lease term was," or a long pause. Meanwhile it quietly determines a seven-figure line item every year.

This episode doesn't hand you a number. It hands you a method. The Three Curves — failure, cost, and value — each measurable in your own environment from data you already have, and where they intersect is your refresh cycle rather than a vendor's.

Along the way: why the widely quoted refresh statistics don't survive being traced to their sources, what actually fails in a modern laptop and why it's cheaper to fix than you think, the residual value you forfeit by stretching a cycle, and how the Windows 11 hardware requirements turned refresh from a hardware question into a platform runway question.

Plus a listener question from Tony in Toledo, whose CFO wants to move from four years to six — and the argument that actually works in that meeting.

IN THIS EPISODE

- Why most refresh cycles have no documented origin
- The provenance problem: tracing the widely quoted statistics back to dated or vendor-funded sources
- Curve one — failure: what actually breaks in a modern laptop, and why it's rarely the drive
- Curve two — cost: building your own support-cost-by-age curve in an afternoon
- Why the cost curve turns upward exactly when the warranty expires
- Curve three — value: the residual recovery you forfeit by stretching the cycle
- Paying twice, in two different budgets, across an accounting seam
- How Windows 11 hardware requirements changed refresh from hardware to platform runway
- Buying for supported life rather than unit price
- The AI PC question, and whether NPU capability justifies acceleration
- Weeding the collection: why librarians never withdraw a book for turning four
- Segmenting the fleet — why one cycle is wrong for most of your users

CHAPTERS

• (00:03) - Refresh Debate Begins

Microsoft — Windows 10 end of support
https://www.microsoft.com/en-us/windows/end-of-support

Microsoft — Windows 11 system requirements
https://www.microsoft.com/en-us/windows/windows-11-specifications

A note on evidence: the refresh statistics circulating in this field are unusually poorly sourced. Figures on failure rates and support costs for aging hardware typically trace back either to studies more than a decade old or to research funded by hardware manufacturers. This episode deliberately avoids quoting them. The Three Curves framework exists so you can measure your own environment instead of borrowing someone else's number.

LISTENER CASE FILES

Got a situation you'd like worked on air? Send it over — anonymized, sanitized, no company names. Real constraints, real politics, real budgets. operationalitam.com

ABOUT THE SHOW

Operational ITAM is a podcast about the unglamorous machinery of enterprise technology — hardware and software asset management, licensing, audit defense, SaaS governance, and the money quietly leaking out of all of them.

Bill Van Nort has led IT asset management, end-user computing, IT operations, and workplace technology at large organizations across banking, mortgage, and automotive. He has reclaimed millions in software spend and survived audits from the biggest publishers on the planet.

Consulting enquiries and listener case files: operationalitam.com

Unsanctioned software isn't a discipline problem. It's your users telling you what IT failed to deliver.

The instinct is to treat shadow IT as rebellion — something to be found, blocked, and punished. That instinct is why it keeps happening.

This episode reframes unsanctioned technology as a demand signal. Every credit card SaaS subscription is a documented case of someone needing a capability badly enough to solve it themselves. The security exposure and license liability are real, and this episode does not soften them. But the durable fix isn't enforcement; it's service.

Bill covers how to find what's actually running, how to triage it by risk rather than by annoyance, and how to build an intake path fast enough that going around IT stops being the rational choice. The measure of an ITAM program isn't how much it prevents. It's how little anyone needs to go around it.

IN THIS EPISODE

- Why shadow IT is a demand signal, not a discipline problem
- Business units now control the overwhelming majority of SaaS spend — and what that means
- Finding what's actually running: expense reports, SSO logs, network data, and their blind spots
- Triage by risk, not by annoyance — a practical severity model
- The real exposure: data residency, license liability, and orphaned admin accounts
- AI-native tools entering through expense reports faster than governance can respond
- Building an intake path fast enough that going around IT stops making sense
- Why enforcement-first programs generate more shadow IT, not less
- Service as the organizing principle — measuring how little anyone needs to route around you

CHAPTERS

• (00:02) - Hunting Shadow IT

Zylo 2026 SaaS Management Index
https://zylo.com/2026-saas-management-index

Findings summary and methodology
https://zylo.com/news/2026-saas-management-index

Flexera 2026 State of ITAM Report
https://www.flexera.com/blog/it-asset-management/state-of-itam-2026/

IBM Cost of a Data Breach Report
https://www.ibm.com/reports/data-breach

ABOUT THE SHOW

Operational ITAM is a podcast about the unglamorous machinery of enterprise technology — hardware and software asset management, licensing, audit defense, SaaS governance, and the money quietly leaking out of all of them.

Bill Van Nort has led IT asset management, end-user computing, IT operations, and workplace technology at large organizations across banking, mortgage, and automotive. He has reclaimed millions in software spend and survived audits from the biggest publishers on the planet.

Consulting enquiries and listener case files: operationalitam.com

The findings document is an opening offer, not a verdict. How claims get inflated, and how settlements actually get made.

Part two of two, picking up exactly where the last episode left off: the findings document has landed and the number on it is worse than you expected.

That number is a negotiating position. This episode covers how publisher claims get inflated in the first place, why opening claims routinely land several times higher than eventual settlements, what the publisher actually wants out of this — which is rarely the cash figure in front of you — and how zero-cash resolutions get traded into renewal and subscription commitments instead.

Audit defense ends in commerce. The practitioners who understand that walk away with a business outcome. The ones who treat it as a compliance verdict write the check.

IN THIS EPISODE

- Why the findings document is an opening position, not an invoice
- How claims get inflated: measurement errors, wrong metrics, and unverified assumptions
- Auditing the audit — challenging methodology before you challenge the number
- What the publisher actually wants, and why it's rarely the cash figure
- Zero-cash resolutions: trading findings into renewal and subscription commitments
- Where the leverage sits, and the timing that determines who has it
- Back maintenance, penalties, and which line items are genuinely negotiable
- Getting it in writing: release language and what a settlement should close
- Building the evidence discipline that prevents the next one

CHAPTERS

• (00:02) - Audit Defense Payoff

Flexera 2026 State of ITAM Report
https://www.flexera.com/blog/it-asset-management/state-of-itam-2026/

ISO/IEC 19770-1 — IT Asset Management Systems
https://www.iso.org/standard/68531.html

A note on evidence: software audit settlements are almost universally subject to non-disclosure terms, which means no public dataset of settlement outcomes exists. The negotiation guidance in this episode reflects licensing advisory practice and thirty years of firsthand experience on the customer side of the table. It is presented as practitioner knowledge, not as research.

ABOUT THE SHOW

Operational ITAM is a podcast about the unglamorous machinery of enterprise technology — hardware and software asset management, licensing, audit defense, SaaS governance, and the money quietly leaking out of all of them.

Bill Van Nort has led IT asset management, end-user computing, IT operations, and workplace technology at large organizations across banking, mortgage, and automotive. He has reclaimed millions in software spend and survived audits from the biggest publishers on the planet.

Consulting enquiries and listener case files: operationalitam.com

The first seventy-two hours decide the outcome. Five opening moves for the moment the audit notice arrives.

Part one of two. The letter arrives — or, increasingly, the friendly invitation to a "SAM engagement" that is an audit wearing a nicer coat. What you do in the first seventy-two hours shapes everything that follows.

Bill lays out five opening moves: contain it, read the contract, control the terms, build your own position before you share anything, and control the data. Along the way: which publishers audit most aggressively, why third-party audit firms are paid by the vendor and what that means for you, why unverified script output drives more inflated claims than actual non-compliance does, and the single most expensive instinct in this situation — panic-buying licenses after the notice arrives, which frequently doesn't count toward the findings anyway.

Plus a listener question from Sandra in Grand Rapids on the soft-audit trap.

Part two picks up when the findings document lands.

IN THIS EPISODE

- The five opening moves for the first seventy-two hours
- Soft audits and "SAM engagement" invitations — the audit wearing a nicer coat
- What your contract's audit clause actually permits, and what it doesn't
- Why third-party audit firms are paid by the publisher, and what that changes
- Building your own license position before you share a single data point
- Controlling the data: what you provide, in what format, and what you never send
- Why unverified script output drives more inflated claims than real non-compliance
- The most expensive instinct in the room: panic-buying licenses after the notice
- Which publishers audit most aggressively, and what the current data shows

CHAPTERS

• (00:03) - Audit Defense Begins

Flexera 2026 State of ITAM Report — audit activity by publisher
https://www.flexera.com/blog/it-asset-management/state-of-itam-2026/

ISO/IEC 19770-1 — IT Asset Management Systems
https://www.iso.org/standard/68531.html

Audit incidence and publisher behavior in this episode is drawn from licensing advisory practice and from thirty years of firsthand audit response. Where a figure rests on industry survey data rather than primary research, it is stated as such on air.

ABOUT THE SHOW

Operational ITAM is a podcast about the unglamorous machinery of enterprise technology — hardware and software asset management, licensing, audit defense, SaaS governance, and the money quietly leaking out of all of them.

Bill Van Nort has led IT asset management, end-user computing, IT operations, and workplace technology at large organizations across banking, mortgage, and automotive. He has reclaimed millions in software spend and survived audits from the biggest publishers on the planet.

Consulting enquiries and listener case files: operationalitam.com

Request to disposal, gate by gate — what each stage captures, how each one fails, and why custody is the whole game.

Hardware asset management is a custody discipline. This episode walks the full lifecycle gate by gate — request, procure, receive, deploy, maintain, recover, dispose — and applies the same three questions at every stage: what is this gate, what data has to be captured here, and how does it typically fail?

Part two moves to the end of life, where the risk concentrates: data sanitization under NIST SP 800-88 Revision 2, what R2v3, e-Stewards, and NAID AAA certifications actually mean when you're selecting an ITAD vendor, the real economics behind refresh cycle decisions, and ghost assets — the machines your records insist you still own.

If your inventory can't survive a simple question about where a specific laptop is today, this is the episode that fixes it.

IN THIS EPISODE

- The seven gates of the hardware lifecycle: request, procure, receive, deploy, maintain, recover, dispose
- What data has to be captured at each gate, and how each one typically fails
- Ghost assets: why your records insist you own machines that left two years ago
- Refresh cycle economics, and what the failure-rate data actually supports
- Data sanitization under NIST SP 800-88 Revision 2, and why Revision 1 is withdrawn
- Choosing an ITAD vendor: what R2v3, e-Stewards, and NAID AAA actually certify
- Why degaussing and multi-pass overwriting are the wrong answer for modern flash media
- Custody as the organizing principle behind every hardware asset decision

CHAPTERS

• (00:03) - HAM Lifecycle Overview

NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization (current standard, September 2025)
https://csrc.nist.gov/pubs/sp/800/88/r2/final

Full text (PDF)
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-88r2.pdf

IEEE 2883 — Standard for Sanitizing Storage
https://standards.ieee.org/ieee/2883/10277/

SERI — R2v3 standard and certified facility directory
https://sustainableelectronics.org

e-Stewards certified recycler directory
https://e-stewards.org/find-a-recycler/

i-SIGMA — NAID AAA certification
https://isigma.org

Note: NIST SP 800-88 Revision 1 (2014) was withdrawn and superseded in September 2025. Much of the ITAD guidance circulating online still cites the withdrawn version.

ABOUT THE SHOW

Operational ITAM is a podcast about the unglamorous machinery of enterprise technology — hardware and software asset management, licensing, audit defense, SaaS governance, and the money quietly leaking out of all of them.

Bill Van Nort has led IT asset management, end-user computing, IT operations, and workplace technology at large organizations across banking, mortgage, and automotive. He has reclaimed millions in software spend and survived audits from the biggest publishers on the planet.

Consulting enquiries and listener case files: operationalitam.com

Installs are not entitlements. Building an Effective License Position, and why the gap between the two is where the money hides.

Crossing over to the intangible side of the house. Where hardware asset management is about custody, software asset management is about evidence — and the evidence standard is considerably higher, because the party asking to see it has a financial interest in the answer.

This episode covers the discipline of reconciling what's deployed against what you're entitled to deploy: how publisher licensing metrics actually work, why an installation count is not a license position, and how to construct an Effective License Position that holds up when someone external is checking your arithmetic.

The homework matters more than usual on this one. The entitlement library you build here is the same document that determines how the next two episodes go for you.

IN THIS EPISODE

- Why software asset management is an evidence discipline, not an inventory discipline
- Entitlements versus installations, and why counting deployments proves nothing
- How publisher licensing metrics actually work — per-user, per-device, per-core, per-employee
- Building an Effective License Position that survives external scrutiny
- Oracle's per-employee Java licensing and what it changed
- VMware under Broadcom: subscription-only, per-core, and the sixteen-core minimum
- Where the money hides: unused licenses, wrong editions, and unclaimed downgrade rights
- The entitlement library — your homework, and the foundation for audit defense

CHAPTERS

• (00:02) - Software Asset Basics

Oracle Java SE Universal Subscription (per-employee licensing)
https://www.oracle.com/java/java-se-subscription/

Broadcom / VMware Cloud Foundation licensing
https://www.broadcom.com/products/software/vmware-cloud-foundation

Zylo 2026 SaaS Management Index
https://zylo.com/2026-saas-management-index

Flexera 2026 State of ITAM Report
https://www.flexera.com/blog/it-asset-management/state-of-itam-2026/

ISO/IEC 19770-1 — IT Asset Management Systems
https://www.iso.org/standard/68531.html

ABOUT THE SHOW

Operational ITAM is a podcast about the unglamorous machinery of enterprise technology — hardware and software asset management, licensing, audit defense, SaaS governance, and the money quietly leaking out of all of them.

Bill Van Nort has led IT asset management, end-user computing, IT operations, and workplace technology at large organizations across banking, mortgage, and automotive. He has reclaimed millions in software spend and survived audits from the biggest publishers on the planet.

Consulting enquiries and listener case files: operationalitam.com