The previous blog post made the case that coverage, not accuracy, is the binding constraint. This post defines what coverage actually means, the phases it’s measured against, the layered data model behind it, and the four decisions that turn it into a number you can manage.
Phases aren’t identical across SAM and HAM
Coverage is measured against lifecycle phases, and the two estates don’t use the same set. Software runs General Availability → End of Support → End of Extended Support → End of Life. Hardware adds one phase software doesn’t have: End of Sale, the cutoff between “orderable through the manufacturer” and “installed-base only.” Software has no equivalent purchase milestone, so reports and approximation rules should respect that asymmetry, not force one model across both.
One phase to read carefully: End of Extended Support isn’t “all support has ended.” It’s the narrowed window where only critical security patches continue, the signal to plan migration. End of Life is the terminal date.
Treat lifecycle data as a system
Not every date carries the same confidence, and that’s fine, if the confidence is visible. A tiered model lets the most authoritative source win without forcing a choice between “perfect” and “present.”
Tiers 1–2 are Content Library (publisher data and labeled approximations); Tiers 3–4 are user-controlled. Tier 1 is preferred wherever it exists; Custom records override all. For your organization, they’re the truth.
These tiers aren’t interchangeable. A coverage program counts dates across all four because that’s an honest measurement, but it should always prefer to climb toward explicit publisher data where it can.
Start with Content Service
Before standing up any user-controlled mechanism, engage the Content Team. Their job is to make sure no publicly available lifecycle information is missed. They source publisher and manufacturer disclosures, track policy changes, and curate the Content Library behind Tiers 1 and 2. This is your first line of coverage. Skip it and your internal estimates end up competing with data the Content Team could have sourced authoritatively. Wasted effort, lower quality.
Engage early and scope explicitly. Agree on three things up front: scope (which publishers and product families matter most by install count and audit exposure), timeline (when baseline coverage should be in place), and prioritization (which gaps close first). Content requests go through KB0790305, but they work best as a planned engagement, not one-off tickets.
Measuring coverage: four decisions
Every program makes these four decisions, explicitly or by default. Making them explicitly is what turns coverage into a number worth reporting.
Measure by install count, not row count. Weighing each product by its installs maps to what auditors, security, and finance care about: exposure, not catalog size. A handful of products usually carry most of the footprint. Close those first.
Scope to Licensable and Not Licensable. That’s where license and audit risk live. Exclude Child, Patch, Driver, and Unknown by design: their lifecycle is inherited or unpublished, and counting them as gaps punishes the team for items no auditor tracks.
Use cross-EOX priority, not single-phase strictness. Don’t define coverage as “has an EOL date.” Pick a preferred phase (most choose End of Support), then fall through to EOES and EOL. A record is covered if any end-of phase has a usable date.
Count codes as coverage, not just dates. APX, END, and EXC records document an investigated, auditable answer where no explicit date exists. Counting them makes the report self-prioritizing: explicit dates need no action, codes are classified, and records with neither are the only urgent gaps.
IT Asset Management (ITAM) is comprised of SAM and HAM.
Where to go next
Essential references
KB1642485 — Software Lifecycle Codes reference
KB2726382 — Hardware Lifecycle Codes reference
KB0790305 — Submitting Content Requests
© 2026 ServiceNow, Inc. All rights reserved. ServiceNow, the ServiceNow logo, Now, and other ServiceNow marks are trademarks of ServiceNow, Inc.
