Non production and dev test deployments that slip into scope.

One of the quietest sources of audit exposure is the environment nobody counted. A developer spins up a copy of a database for testing, a staging cluster mirrors production, a disaster recovery node runs warm. Each feels incidental, but unless a specific entitlement or program term exempts it, an installed and runnable copy of IBM software is licensable. By the time an audit looks at the estate, these copies are deployments, and the obligation has been accruing the whole time.

Why non production is rarely free

IBM licensing generally attaches to installation and the capacity available to the software, not to whether the workload is labeled production. Some programs do grant limited non production or development use, and some bundles include test rights, but those are specific terms in the license information document, not a general rule. Absent that grant, a test server running WebSphere or Db2 counts toward your PVU or user obligation exactly as a production server does. The label on the environment has no standing unless the entitlement says it does.

How they slip into scope

These environments accumulate outside the procurement process. They are stood up quickly, cloned from production images that carry the same software, and rarely tracked against entitlements. Common patterns include the following.

• Test and staging clusters cloned from licensed production images
• Cold or warm standby nodes that count unless a backup term applies
• Developer copies stood up outside procurement and never retired
• Demonstration or training environments left running after use
• Virtualization that places non production on the same hosts as production

Keeping them out of a finding

The defense is inventory and entitlement matching before an auditor does it for you. Identify every installed copy regardless of label, then check each against the actual license terms to see whether a non production or backup right applies. Where a copy has no entitlement, decide deliberately: license it, retire it, or document the term that exempts it. Sub-capacity rules still apply, so non production on shared hosts needs the same ILMT coverage as anything else, or it defaults to full capacity.

The buyer side position

Treat every environment as in scope until proven otherwise, because that is how an audit will treat it. A documented map of installs to entitlements, including the specific terms that cover dev, test, and standby, turns a category of hidden exposure into a controlled line you can defend. The surprise findings are the ones nobody mapped; mapping them first removes the surprise.