VA's Open GAO Software License Rec | Avalon Technology Services

The Finding

In January 2024, GAO reviewed how agencies manage their most widely used software. The report, Federal Software Licenses: Agencies Need to Take Action to Achieve Additional Savings (opens in a new tab) (GAO-24-105717), found that none of nine selected agencies, VA among them, had fully determined whether their five most widely used software licenses were over- or under-purchased.

GAO made two recommendations to VA. The first asks VA to track the software licenses currently in use for its widely used licenses. The second asks VA to compare those in-use inventories with information on purchased licenses, on a regular basis, to find ways to cut costs and better inform investment decisions. GAO lists the second one as a priority recommendation.

The comparison recommendation still appears in GAO's January 2026 letter, Chief Information Officer Open Recommendations: Department of Veterans Affairs (opens in a new tab) (GAO-26-108706). The stakes are large. In March 2026 testimony, GAO said VA planned to spend about $985 million on software in fiscal year 2025 (opens in a new tab), commercial licenses included.

Why It Keeps Happening

VA officials gave GAO two reasons for not tracking licenses in use. Their contracts allow purchases on an "as needed basis," and they relied on features inside the software products to watch historical data and trends, according to GAO's March 2026 testimony (opens in a new tab) (GAO-26-109060). Neither produces a count of what VA owns set against a count of what VA runs.

The data problem is not unique to VA. Across 24 agencies, GAO found license data for products was inconsistent and incomplete, so the most widely used and highest-paid products could not be identified government-wide.

Cloud adds a second layer. In GAO-25-107114 (opens in a new tab), GAO found restrictive software licensing practices had affected cloud efforts at five of six agencies it reviewed, VA included; four saw higher costs and three faced limits on which cloud providers they could use. GAO made two more recommendations to VA, covering guidance and assigned responsibility. VA told GAO it planned to finish that work, through a working group, by September 30, 2026.

None of this is a new requirement. The MEGABYTE Act of 2016 (opens in a new tab) already directs agency CIOs to track license usage and report savings. What VA has not yet shown GAO is the procedure.

Why It Matters to Your Bid

VA buys IT services through vehicles that include T4NG2 (opens in a new tab), the $60.7 billion vehicle VA awarded to 30 contractors in November 2023. A task order for end-user software, enterprise agreements, cloud hosting, or operations and maintenance sits right next to an open priority recommendation.

Evaluators on those buys are likely to know GAO's list. A technical volume that names the recommendation and explains how the work will produce license usage data as a by-product reads as understanding of the requirement. One that ignores it reads as a generic O&M bid.

Renewals are where this shows up first. An enterprise agreement or cloud migration decision made without an in-use count is a decision made on the vendor's numbers. The restrictive licensing costs GAO documented in GAO-25-107114 tend to surface at the same moments. A prime that can point to a sub with a defined, evidence-based method for the purchased-versus-in-use comparison has something concrete to put in front of the evaluation board.

Technical Approach

The method below comes from Avalon's FinOps service and its license rationalization work. It is read-only and evidence-first.

Build the entitlement side from contract records. Pull purchase records, enterprise agreements, and true-up terms for each widely used title into one entitlement inventory, with true-up and audit exposure flagged per title. Entitlement records are usually messier than expected, so this step gets its own schedule line.
Build the in-use side from data VA already produces. For installed software, the in-use count comes from VA's own system of record, the centralized license inventory VA told GAO it planned to launch in late March 2026. For licensing billed through cloud providers, ingest 12 to 24 months of native billing data (the AWS Cost and Usage Report, Azure Cost Management exports), normalize it to the FOCUS specification, and reconcile it against reseller invoices.
Compare and price the gap. Set entitlements against in-use counts for each title. Flag over-purchase, under-licensing exposure, unused marketplace and SaaS subscriptions, and enterprise-agreement commitments against actual consumption. On the cloud side, test licensing model fit (bring-your-own versus license-included), which is where restrictive licensing costs show up.
Validate, then hand over the evidence. Each finding is walked with the owning engineers before it ships. The output is a findings report ranked by dollar value, effort, and mission risk, an evidence workbook with line-level detail behind every number, and a 30/60/90-day remediation roadmap with owner roles.
Make the comparison recurring. A monthly review cycle tracks each finding to realization, and a quarterly executive review produces figures the CIO's office can use in data calls. That cadence is the "regular basis" GAO's recommendation asks for.

Avalon advises; VA's contracting officer negotiates with vendors. Savings depend on actions only VA can take.

What "Fixed" Looks Like

GAO's status notes set the bar. VA told GAO in February 2025 that it had new procedures for 12 of its top 15 widely used titles. GAO kept the recommendation open because VA had yet to demonstrate procedures that compare licenses in use with licenses purchased.

Partial credit elsewhere shows what GAO counts. GAO rates State's recommendation partially addressed after State issued a standard operating procedure and gave evidence for one license comparison.

Targets, then, rather than results:

A documented comparison procedure that covers every widely used title.
For each title, an entitlement count, an in-use count, and a dated comparison, repeated on a fixed cycle.
Savings or cost avoidance from those comparisons reported, as the MEGABYTE Act expects.

Status Check

Both VA recommendations from GAO-24-105717 were open as of GAO's last update, January 2026, and the comparison recommendation is a priority. The two restrictive licensing recommendations from GAO-25-107114 were also open as of January 2026.

Teaming Fit

Field	Detail
NAICS	541512, 541519
Avalon's sub role	Purchased-versus-in-use license reconciliation and cloud licensing analysis under the prime's VA IT task order
Small-business status	Small business; HUBZone (in progress)
Likely vehicles	VA T4NG2; GSA MAS (SIN 54151S IT Professional Services)

If VA software, enterprise agreement, or cloud cost work is in your capture plan, Avalon teams as the sub that produces the purchased-versus-in-use comparison GAO has asked VA for since 2024.

The License Count GAO Keeps Asking VA to Produce