Responding to a Cisco licence audit.
Cisco's shift to Smart Licensing and subscription models has quietly rebuilt how licence audits work. Telemetry now reaches Cisco before any auditor does, so a review letter usually means Cisco already believes it has found a gap. This note sets out what Cisco checks, where the real exposure sits — Smart Licensing registration, DNA subscriptions, and ELA true-forward — and how to respond before Cisco defines the claim for you.
A Cisco audit is rarely exploratory. Smart Licensing telemetry, CSSM registrations and DNA Centre usage data mean Cisco usually knows the gap before the letter arrives. The decisive move is to reconcile your own position first and engage during the compliance-review phase — before formal findings harden the number. Disciplined defence routinely resolves DNA and true-up claims well below list.
01 Key findings
Cisco audits without an auditor. CSSM registrations, DNA Centre telemetry and Meraki dashboards give Cisco real-time consumption data. A formal letter typically follows a gap Cisco has already identified — assume it holds evidence of the specific issue.
Smart Licensing registration gaps are the most common exposure. Devices deployed before Smart Licensing was mandatory, or in disconnected segments, or never onboarded, show as unregistered in CSSM regardless of whether entitlements were purchased.
DNA subscriptions are the largest commercial dispute. Mandatory tiers on Catalyst 9000, ISR/ASR and wireless drive claims that scale by device count, tier and years of retroactivity — a 500-device, three-year gap can reach $1.5–2M at list.
ELA true-forward is contestable, not fixed. True-up device counts frequently overstate the installed base through decommissioned kit, RMA duplicates, out-of-scope segments and inflated tier assignment. Every device removed reduces the payment.
Timing beats argument. Cisco's most flexible window is the data-gathering phase, before findings carry a dollar figure. Once findings issue, discount approval thresholds rise and resolution slows.
02 What Cisco checks
Cisco's compliance programme identifies potential gaps through several channels before any letter is issued. Smart Account and Virtual Account data in Cisco Smart Software Manager (CSSM) shows what is registered versus what is deployed. DNA Centre telemetry reports feature usage against DNA entitlements. Renewal conversations surface discrepancies between the installed base and active entitlements, and partners flag suspected gaps as remediation-sales opportunities. For the cross-vendor view, see our audit triggers guide.
The practical implication is that Cisco reviews arrive with a predefined scope — Smart Licensing registration gaps, DNA subscription shortfalls, or ELA true-up disputes — and the process is mostly about formalising and quantifying a gap Cisco believes it has already found.
Cisco audits without sending an auditor. Smart Licensing telemetry lets Cisco assess compliance from CSSM registrations, DNA Centre and Meraki dashboards. Formal letters typically follow where Cisco wants to formalise remediation commercially — so an organisation receiving one should assume Cisco already has evidence of the specific issue.
03 Exposure areas
Four areas drive almost every Cisco claim. Map each against your own records before engaging — the evidence source is also where the counter-argument lives.
| Exposure area | What Cisco checks | Evidence source | Typical gap |
|---|---|---|---|
| Smart Licensing registration | Devices registered to a Smart Account within 90 days of activation | CSSM registration & entitlement pools | Unregistered or evaluation-mode devices |
| DNA subscriptions | Feature usage vs Essentials / Advantage / Premier entitlements | DNA Centre telemetry | Mandatory features run without subscription |
| ELA true-forward | Device counts & tiers vs quantities licensed under the ELA | ELA schedule & true-up inventory | Overstated counts, tier reclassification |
| Entitlement channel | Whether registered licences match purchased entitlements | Invoices, POs, VLSC certificates | Direct vs partner purchases not reflected in CSSM |
04 The biggest risks
Smart Licensing replaced the product activation key (PAK) model and is now the baseline for IOS-XE, IOS-XR, NX-OS, ASA and most Cisco software. Devices must register against CSSM and periodically synchronise, creating the real-time consumption record Cisco uses as primary audit evidence. The most common gap is simply devices that were never registered — deployed before Smart Licensing was mandatory, sitting in disconnected segments, or never onboarded after install.
DNA (Digital Network Architecture) subscriptions are the larger commercial dispute. They cover intent-based features on Catalyst 9000, newer 3850/3650, and ISR 1000/4000 series — SD-Access, Encrypted Traffic Analytics, ThousandEyes integration and assurance — and are mandatory, not optional add-ons, for feature sets many organisations have run for years. DNA claims are calculated by device count and tier across the years the subscription should have applied.
Retroactive DNA claims. Cisco often dates DNA subscriptions from first deployment — in some cases 5–6 years of retroactive fees for features enabled by default in the firmware. The counter-argument is that the customer was never notified of the requirement at purchase. Challenging the coverage start date has reduced retroactive DNA claims by 60–80%.
ELA true-forward disputes turn on the device list. Counts frequently include decommissioned kit, RMA replacements appearing alongside the original, DMZ or guest segments the customer argues are out of scope, and devices reclassified to higher DNA tiers than apply. With Advantage-tier DNA on a Catalyst 9000 costing $200–400 per device per year, every device removed from the count is materially valuable.
05 Response framework
Four workstreams define your position before Cisco defines it for you. Run them in the first 48 hours after a letter arrives.
Reconcile the inventory
Export CSSM Smart Account data — registered tokens, device registrations, consumption by Virtual Account — and map it against CMDB and network discovery to separate genuine gaps from registration-process failures.
Prove the entitlements
Collect every invoice, PO, ELA schedule, partner quote and VLSC certificate across the past five years. Entitlements purchased through a different channel that predate a registration gap sharply reduce the claim.
Audit the DNA tiers
For each in-scope device, verify the features actually enabled against the tier Cisco claims. Devices running only base networking features belong at Essentials, not Advantage or Premier.
Build the removal evidence
For every device you want off Cisco's count, assemble change records, CMDB exit dates and recycler or asset-disposal certificates. Verify serials to catch RMA duplicates in the inventory.
06 Response timeline
The single highest-value process choice is when you engage Cisco. The flexible window closes once formal findings issue:
Engage during review Recommended
Respond within the compliance-review phase, while Cisco is still requesting inventory data. Request a 30-day extension on the standard 14-day deadline, reconcile internally, and negotiate before a dollar figure is fixed — the window with the most discount discretion.
Wait for findings Weaker
Let Cisco issue formal findings with a specific figure first. Internal approval thresholds for discounts rise, resolution timelines extend, and you negotiate down from a number Cisco has already committed to internally.
07 Settlement strategy
Cisco claims are rarely settled at the initial list-price calculation. The strongest position depends on the nature of the claim — entitlement proof, tier accuracy, and device-by-device reconciliation each attack a different lever.
Demonstrate that unregistered devices were covered by licences bought through a different channel. Invoices, POs and VLSC certificates predating the gap reduce Cisco's claim — the CSSM record is a registration status, not proof of non-purchase.
Contest the date mandatory coverage should start and confirm the pricing basis — historical list per year is often well below current list. Challenging the start date has cut retroactive DNA claims by 60–80%.
Obtain the full device inventory, not a summary figure. Remove decommissioned kit, RMA duplicates and out-of-scope segments, and correct inflated tiers — every device off the count reduces the incremental payment.
Facing a Cisco licence review?
Our audit-defence practice has led 50+ Cisco reviews across Smart Licensing, DNA and ELA true-up — and includes former Cisco licensing managers.
The Licensing Edge
Weekly vendor and licensing intelligence for enterprise IT leaders. 3,000+ subscribers.