Cisco's True Forward mechanism is the single biggest source of unbudgeted spend in enterprise Cisco agreements. Combined with Smart Account structural decisions made at inception, True Forward can generate invoice surprises of 30–50% above your baseline commitment. This guide explains how both systems work, how Cisco uses them commercially, and the specific negotiation strategies that contain your exposure. Part of our comprehensive Cisco Enterprise Agreement Negotiation Guide.
Cisco Smart Account is the cloud-based licence management platform that Cisco requires all EA customers to use. Introduced with the shift from node-locked licences to smart/subscription licences, Smart Account serves as the central repository where all Cisco licences are registered, deployed, and tracked. For customers, it is simultaneously a useful management tool and the mechanism by which Cisco monitors consumption to calculate True Forward charges.
Prior to Smart Licensing, Cisco used PAK (Product Activation Key) codes — customers purchased a product, received a key, and activation was largely self-managed. Smart Licensing inverted this: licences are registered in a Cisco-controlled cloud system, consumption data flows back to Cisco in near real time, and the EA True Forward reconciliation uses this telemetry as the basis for billing adjustments.
Understanding Smart Account is not optional for any enterprise with a Cisco EA. The account structure you establish at contract inception determines how True Forward is calculated, how overages are surfaced, and — critically — how much negotiating leverage you retain during reconciliation.
When you establish a Smart Account for a Cisco EA, you will face several structural choices that have lasting commercial consequences. Most customers accept Cisco's default suggestions without understanding the implications.
Want independent help negotiating better terms? We rank the top advisory firms across 14 vendor categories — free matching, no commitment.
A Smart Account contains one or more Virtual Accounts (VAs). VAs are logical containers for licences — you might create VAs by business unit, geography, product line, or technology domain. The hierarchy matters because True Forward is typically calculated at the Smart Account level, not the Virtual Account level.
This has a critical implication: if one VA is over-deployed while another has surplus licences, Cisco's system will net these at the Smart Account level. If you have siloed VAs with no pooling visibility, each business unit may believe it is compliant while the overall Smart Account shows an overage — triggering a True Forward charge.
Best practice is to design your VA structure so that licence pooling across VAs is explicit and visible, and to establish a central SAM function that monitors Smart Account utilisation across all VAs monthly.
Customers with strict data sovereignty requirements can use the Cisco Smart Software Manager On-Prem (SSM On-Prem) — formerly known as the Satellite. This runs within your network and provides a local inventory of smart licences without sending telemetry to Cisco's cloud. However, SSM On-Prem has important limitations: it does not support all Cisco product families equally, upgrades lag behind the cloud version, and you must periodically synchronise with Cisco's cloud to maintain validity.
From a negotiation perspective, SSM On-Prem gives you slightly more control over the data Cisco sees in real time — but it does not eliminate True Forward obligations. The synchronisation events will still transmit consumption data to Cisco, and your EA agreement will still include True Forward terms.
Devices can be registered to your Smart Account (fully tracked) or operate in a grace period or SLAC mode depending on product generation. Unregistered devices operating beyond the grace period enter an out-of-compliance state that can generate additional charges. Ensure your Smart Account onboarding project captures all in-scope devices at EA inception — retrospective True Forward claims tied to unregistered legacy devices are a common friction point.
The most common Smart Account mistake is establishing the account reactively — after the EA is signed — rather than designing the structure as part of contract negotiations. Once the EA is live and licences are deployed, reorganising Virtual Accounts without triggering True Forward events becomes complex. Invest time upfront in Smart Account architecture design as part of your EA negotiation process.
True Forward is Cisco's mechanism for ensuring that EA customers pay for the maximum number of licences deployed at any point during the agreement term. Unlike annual true-up models (common in Microsoft or SAP agreements) where you report consumption and pay for overages, Cisco's True Forward is designed to capture peak usage and lock in that level as the new baseline.
Cisco measures consumption across your Smart Account on an ongoing basis. At the True Forward measurement date (typically the annual EA anniversary), Cisco takes the highest measured consumption level for each licence type since the last measurement. If consumption has exceeded your purchased quantity at any point during that year, you owe the difference — prorated from the date the overage first occurred to the end of the EA term.
This prorated-to-term-end structure makes True Forward significantly more expensive than a simple annual overage. If you deploy 100 extra users in month one of a three-year EA, you pay for those 100 users for the remaining 35 months — not just for 12 months. The Cisco sales team will often present this as a feature ("you only pay for what you use") without prominently disclosing the end-of-term prorating effect.
| Product Suite | True Forward Metric | Measurement Frequency | Risk Level |
|---|---|---|---|
| Cisco DNA (Catalyst) | Device count by DNA tier | Continuous; annual reconciliation | HIGH |
| Webex (Meetings/Calling) | Named user count | Monthly peaks, annual True Forward | MEDIUM |
| Cisco Security (Umbrella, Duo) | Seat count / endpoint count | Continuous telemetry | HIGH |
| AppDynamics | Agent count / APU consumption | Monthly; annual True Forward | HIGH |
| ThousandEyes | Units of Intelligent Systems consumed | Monthly; annual True Forward | MEDIUM |
| Cisco Secure Access | Named user or device | Continuous telemetry | MEDIUM |
One of the most commercially significant features of True Forward is the ratchet effect: once your consumption level is recorded as a True Forward event, that level becomes the new minimum for the remainder of the EA. You cannot reduce below this level without a formal amendment negotiation — and Cisco will rarely agree to reductions mid-term without significant commercial concessions in return.
This means accidental over-deployment — a mass onboarding, a merger integration that temporarily inflates device counts, or a security incident response that deploys agents broadly — can permanently increase your EA cost floor. Operations teams must understand that clicking "deploy" in Cisco environments is a commercial decision, not just a technical one.
True Forward exposure typically arises from predictable scenarios. Understanding these helps you build contract language and internal controls that limit surprise charges.
Get the IT Negotiation Playbook — free
Used by 4,200+ IT directors and procurement leads. Oracle, Microsoft, SAP, Cloud — all covered.
When your organisation acquires another company and begins migrating its Cisco infrastructure into your Smart Account, device and user counts spike. If the acquired entity has 2,000 endpoints and your EA baseline is 5,000, a full migration generates a 40% overage overnight. Cisco's standard EA terms treat this as a True Forward event regardless of the commercial circumstances.
Negotiation requirement: Include a specific M&A carve-out in your EA that grants a 90-day grace period for integration of acquired entities, with no True Forward implications during the grace window. Cisco will resist this but it is achievable with sufficient leverage — particularly at initial EA signing or EA renewal.
Organisations with seasonal business cycles (retail, e-commerce, logistics) often deploy additional infrastructure for peak periods. A retailer may deploy 3,000 additional access points for the holiday season and remove them in January. Under True Forward, the peak deployment becomes the new baseline — even if it was in place for only six weeks.
Negotiation requirement: Seek a True Forward measurement methodology based on average monthly consumption rather than peak consumption. Cisco rarely agrees to this at the standard tier but it is negotiable for large EAs ($5M+ annual). Alternatively, negotiate a tolerance band (e.g., 10% above committed quantity) that does not trigger True Forward.
During a security incident, organisations sometimes need to rapidly deploy endpoint agents, network monitoring sensors, or secure access licences across infrastructure they would not normally cover under the EA. The incident is resolved, agents are removed — but the peak deployment has already been recorded in Smart Account.
Negotiation requirement: Request a specific carve-out for emergency security deployments, with written confirmation that incident response deployment above EA quantity will not trigger True Forward without a 30-day notice and dispute resolution period.
When migrating from legacy Cisco platforms to newer DNA or cloud-managed platforms, both old and new infrastructure co-exist for the migration period. This dual-running state can temporarily double your licence consumption. Cisco's standard position is that all active licences count regardless of migration context.
Negotiation requirement: Include migration transition provisions that allow a defined dual-running period (typically 6–12 months) without triggering True Forward for the legacy platform licences being retired.
True Forward terms are most negotiable at EA inception or renewal — not when a True Forward event has already occurred. Once Cisco can point to your Smart Account data showing overconsumption, their negotiating position is strengthened significantly. Use the pre-signing period to negotiate tolerance bands, averaging provisions, and carve-outs for the scenarios above. The best outcome you can achieve post-True-Forward-event is a payment plan or a credit against future growth — not elimination of the charge.
Cisco's Smart Account measurement relies on telemetry data that is not infallible. Devices can be registered multiple times (creating phantom licence consumption), CSSM synchronisation errors can inflate counts temporarily, and Virtual Account misconfigurations can misallocate licences. Before accepting a True Forward invoice, conduct an independent Smart Account audit. Practitioners consistently find 5–20% of measured consumption attributable to technical artefacts rather than genuine deployment.
Negotiate a contractual obligation for Cisco to proactively notify you when your Smart Account consumption crosses 80% of purchased quantity for any licence type. This early warning system gives you time to either manage deployment or negotiate an expansion before the True Forward measurement date. Cisco has dashboards that show this data; the question is whether they are contractually obligated to alert you rather than wait for the annual True Forward event.
For each Cisco product suite in your EA, identify at least one credible competitive alternative. For networking, this means Juniper Mist, HPE Aruba, or Extreme Networks. For security, this means Zscaler, Palo Alto, or CrowdStrike. For collaboration, this means Microsoft Teams or Zoom. The threat of partial platform replacement is more credible than a wholesale competitive displacement threat — Cisco knows you will not migrate your entire network overnight, but they do believe you might replace their cloud security suite with a competitor if pricing becomes unacceptable. Build and express these specific alternatives during EA renewal discussions.
If you are consolidating Cisco platforms as part of your EA — for example, migrating from Meraki to DNA-managed Catalyst or retiring legacy ASA firewalls for Cisco Secure Firewall — negotiate consumption credits for the retired licences. The standard Cisco position is that retired licences provide no credit; you simply stop using them. Push for a formal credit or offset mechanism that reduces your True Forward baseline in exchange for your commitment to the replacement platform.
Standard Cisco EAs do not include flex-down rights — you cannot reduce your committed quantity mid-term. Negotiate for a specific annual flex-down window (typically 10–15% of committed quantity) that allows you to reduce deployment without incurring True Forward penalties. This is most achievable in 3-year or longer EAs where Cisco values the commitment certainty. Frame it as a risk-sharing mechanism: you commit to a multi-year spend, Cisco provides some flexibility against business changes.
Cisco's default True Forward measurement date is the EA anniversary — which may fall at a commercially awkward time for your organisation (e.g., during your fiscal year-end, during budget cycles, or during seasonal deployment peaks). Negotiate to align the True Forward measurement date with your budget cycle so that reconciliation and any resulting charges can be planned and approved through your normal procurement process rather than arriving as an unbudgeted surprise mid-year.
True Forward disputes handled exclusively at the account manager and contract specialist level rarely result in significant relief. Cisco's account managers have limited authority to waive or substantially reduce True Forward charges without senior approval. When you are disputing a material True Forward invoice, escalate to your Cisco account VP and, if necessary, to Cisco's global customer success organisation. Large True Forward disputes ($500K+) typically require executive-level engagement to achieve meaningful resolution. Come prepared with your Smart Account audit data, the specific scenarios that drove the overage, and a commercial proposal — not just a complaint.
Have a True Forward dispute or upcoming EA renewal?
Our recommended firms have resolved hundreds of Cisco True Forward disputes and EA negotiations.
Beyond the tactical approaches above, there are specific contract clauses that should be non-negotiable for any EA over $2M annually. Work with legal counsel and a specialist Cisco negotiation firm to ensure these provisions are explicitly included — Cisco's standard EA template will not include them.
| Clause | What to Demand | Cisco's Default Position | Achievability |
|---|---|---|---|
| True Forward tolerance band | No True Forward triggered below 110% of purchased quantity | True Forward applies from first unit of overage | NEGOTIABLE |
| M&A grace period | 90-day no-True-Forward window post-acquisition | No grace period; immediate True Forward liability | NEGOTIABLE |
| Early warning notification | Cisco to notify at 80% consumption threshold | No notification obligation | ACHIEVABLE |
| Flex-down right | Annual 10–15% reduction right with no True Forward penalty | No flex-down; committed quantity is fixed | NEGOTIABLE |
| True Forward dispute process | 30-day dispute period; independent audit right | Invoice payable within standard terms | ACHIEVABLE |
| Measurement methodology | Average monthly consumption rather than peak | Peak consumption at any point triggers True Forward | DIFFICULT |
| Migration transition period | 6-month dual-run period; no True Forward on retired licences | All active licences count regardless of migration context | NEGOTIABLE |
| Price cap on True Forward | True Forward priced at EA discount, not list price | True Forward typically priced at list minus a smaller discount | ACHIEVABLE |
This article is part of our comprehensive Cisco Enterprise Licensing series. For full coverage of Cisco negotiation strategy, see the related guides below:
For independent rankings of the top Cisco negotiation consultants, see our Best Cisco Negotiation Consulting Firms ranking page. You may also find value in our Enterprise Software Negotiation Playbook white paper, which covers cross-vendor contract strategy applicable to Cisco EAs.
Get matched with a specialist Cisco negotiation firm that has resolved disputes at your scale and budget. Our recommendations are independent and based on verified engagement outcomes.