RSA licensing is the set of terms under which RSA sells its identity and access management software. The current portfolio is SecurID for on-premises authentication, RSA ID Plus for cloud, hybrid and on-premises authentication, and Governance & Lifecycle for identity governance and administration.[3] Software is licensed by RSA Security USA LLC or the relevant RSA sales affiliate. A customer licenses it in one of three ways: directly under a signature-bearing agreement, under RSA’s End User License Agreement (EULA), or through channel partners under that EULA. RSA calls the applicable contract the “Governing Agreement”.[1]
Every licence is quantified by a Unit of Measure (UOM), “used to quantify the scope of license rights and applicable restrictions based on a particular licensing model”. Use beyond those rights “requires additional or modified license grants, and additional payment of applicable license and maintenance fees”.[1] Catalog proof: Use beyond the Unit of Measure requires additional licences and fees.
Editions
RSA publishes no price list. Its standard form agreements and documentation describe the product lines and how each is counted.
| Product line | Contract set | Main Units of Measure | Deeper article |
|---|---|---|---|
| SecurID (Authentication Manager, agents, hardware and software tokens) | EULA; Maintenance Agreement[2][7] | Users with assigned authenticators; replica limits by Base or Enterprise licence[11] | SecurID and Authentication Manager licensing |
| RSA ID Plus (plans C1, E1, M1, E2, E3) | Terms of Service for RSA Cloud Offerings; ID Plus Service Description[4][5] | Per user; MFA licences for users with registered devices[12] | ID Plus licensing |
| Governance & Lifecycle (on premises and Cloud) | EULA; Terms of Service; G&L Cloud Service Description[6] | Active, Lite and Inactive Users; Instances by deployment model[1] | Governance & Lifecycle licensing |
The EULA “Covers all products for which standard form agreements are not included or identified” on RSA’s Standard Form Agreements page. The page also lists the cloud terms, two service descriptions, the maintenance agreement, a professional services agreement, an evaluation agreement and the Units of Measure.[3] Earlier versions of these documents are on a separate legacy page, together with separate SecurID standard form agreements.[10]
Metrics
The Units of Measure document defines eleven units:[1]
| Unit | Catalog row | Definition in brief |
|---|---|---|
| User (USR) | User | Maximum Users that may be managed by, authorized to use or access the software, active or not |
| Active User | Active User | Identity verified at least once in the preceding calendar month |
| Lite User | Lite User | Governance & Lifecycle identity with fewer systems than an average Active User |
| Inactive User | Inactive User | Former Active or Lite User retained in Governance & Lifecycle, with no access |
| Appliance (APP) | Appliance | Hardware supplied by RSA, loaded with RSA Software |
| CPU | Central Processing Unit | Maximum CPUs on which the software may be installed and used |
| Concurrent (CNC) | Concurrent | Maximum concurrent Users or client connections |
| Database (DB) | Database | Maximum databases the software is used with |
| File System (FS) | File System | Each file server to be encrypted, separately for production and development |
| Instance (INST) | Instance | Maximum production installations, each with two non-production Instances |
| Server (SVR) | Server | Maximum physical servers |
Unless agreed otherwise, a “User” is one of the customer’s “agents, employees, consultants, independent contractors, or clients authorized by customer to use the RSA Software on customer’s behalf”.[1] In the cloud terms, Users exclude third parties, partners and customers unless the Service Description permits them.[4] Catalog proof: Per-User licences count every authorized User, active or not; Cloud Users exclude partners and customers unless the Service Description allows them.
Counting / floors
Licensing model (EULA s.4.B). Software “is licensed for use only in accordance with the commercial terms and restrictions of the Software’s relevant licensing model, which are stated in the Product Notice and/or RSA quote”. Limits on users, servers, hosts, relying parties or functionality in a quote, invoice or user licence certificate are incorporated into the agreement.[2] Use may require registration to obtain “an authorization key or license file”.[2] Catalog proof: Licensing-model limits on the quote or licence certificate are binding; EULA licence is for internal business purposes for the duration on the quote.
Copies (EULA s.4.C). Unless agreed otherwise or granted in the Product Notice, “Customer may only use one production copy of the RSA Software”.[2] Instance-licensed Access Software includes two non-production Instances per production Instance.[1] Catalog proof: Only one production copy unless the Product Notice grants more; Each production Instance includes two non-production Instances.
Tokens and agents. Token records for RSA authenticators are deemed RSA Software and fall under the EULA’s transfer restrictions. RSA authenticators may be used only to authenticate to RSA Software. Authentication agents may be installed as needed, as long as they serve licensed RSA Software only.[1] Tokens and user licences are separate purchases: more users do not bring more tokens, and more tokens do not raise the user limit.[11] Catalog proof: Token records are RSA Software and may not be transferred; RSA authenticators may only authenticate to RSA Software; SecurID tokens and Authentication Manager user licences are separate purchases.
Virtualization & partitioning
The Units of Measure include CPU and physical-server units. A CPU is “a single central processing unit within a computer system”, and the Server unit counts “physical servers”.[1] The retrieved documents do not say how either unit applies to virtual machines, and the main products are counted per user. Software delivered on RSA Equipment may be used only on that Equipment.[2] Authentication Manager limits replica instances by licence type rather than by host: one for a Base licence and up to fifteen for an Enterprise licence.[13] See virtualization and partitioning.
Cloud / BYOL
RSA Cloud Offerings are subscriptions under the Terms of Service for RSA Cloud Offerings and the applicable Service Description.[1] Cloud charges may include “a committed amount as well as additional amounts”, including metered overages. RSA may bill the customer directly for additional charges even when the subscription was bought through a reseller.[4] RSA monitors usage data in part for “tracking entitlements”, and the customer “must not interfere with that monitoring”.[4] No bring-your-own-licence rule exists: on-premises software and cloud subscriptions are bought separately, although ID Plus plans bundle Authentication Manager.[5] Catalog proof: Cloud charges include metered overages that RSA may bill directly; RSA monitors cloud usage, including to track entitlements.
Programs
- Subscription term and renewal. If the Order is silent, the initial subscription term is three years. Subscriptions then renew for one-year periods “at the same license quantity” unless notice of non-renewal or licence reduction is given at least 90 days before renewal. Renewal is at the same discount off the then-current list price with annual price adjustments, and late renewal payments carry 1.5% monthly interest.[2] On term purchases, “no perpetual licenses are granted” and there is no termination for convenience.[1]
- CPI adjustment. Cloud fees may be adjusted once a year for US CPI increases, upon notice and consent.[4]
- Maintenance Services and Extended Support. On-premises releases reach end of primary support (EOPS) at least 24 months after general availability. One or two years of Extended Support may follow for some products.[7] Warranty on on-premises software “runs with purchase of a maintenance support option”.[9]
- Evaluation. A 45-day, internal, non-production loan; at the end the customer must license the products or return them.[8]
Catalog proof: Subscriptions renew at the same quantity unless reduced 90 days before renewal; Term licences grant no perpetual rights and cannot be terminated for convenience; On-premises releases reach end of primary support at least 24 months after GA; Evaluations last 45 days and are non-production only.
Transfer and restrictions
The EULA grant is “nonexclusive and nontransferable” and comes “with no right to sublicense”.[2] Without RSA’s consent the customer may not use the Software “in a service bureau, application service provider or similar capacity”, disclose benchmark results, or transfer the Software to an Affiliate or third party.[2] Affiliates in the customer’s country may order under the EULA. Affiliates elsewhere first need a local participation agreement with the local RSA affiliate.[2] Assignment requires RSA’s prior written consent, “which consent shall not be unreasonably withheld”.[2] Catalog proof: No service-bureau use, benchmarking disclosure or transfer to affiliates; Affiliates may order in the customer's country; other countries need a local participation agreement; Assignment needs RSA's consent.
Audits and compliance
Under EULA s.4.H, RSA or its independent auditors may audit usage “no more than once annually”, at RSA’s expense. The audit is scheduled at least 30 days in advance and held during business hours. RSA may also “on an ongoing basis, remotely monitor the quantity of licenses in use”. If either shows usage above what was paid for, the customer must reconcile and pay the resulting invoice. The customer also consents to automatic billing for overutilization “up to the list price of the product”.[2] For on-premises installations, RSA collects System Data, among other purposes for “accurate billing of product usage”.[1] Catalog proof: RSA may audit once a year and monitor licence quantities remotely; RSA collects System Data, including for billing of product usage. See software license audit.
Out of scope
- Signed customer agreements, partner terms and prices, which are not public.
- RSA Agent ID and Outseer products. Outseer has its own standard form agreements.[3]
- Professional Services terms and the data processing addenda listed on the Standard Form Agreements page.[3]
- Country-specific variations of the EULA (United Kingdom, Ireland, European Union, Australia, New Zealand, France, Germany).[2]