The six services, in order.

A Red Hat compliance review or formal audit letter is the trigger for the lead service in the practice. The notice arrives by email, by certified post, or as a calendar invitation framed in account team language; in each form it cites a clause in the subscription agreement and asks the buyer to produce evidence of entitlement against deployment by a stated date. Audit defense is the engagement the practice runs in response, and it sits at the top of the priority list because the response window is short, the figures at stake are large, and a default response posture costs the buyer money that better posture would have preserved.

What the engagement delivers is three things in sequence. First, a response strategy: which clause has been invoked, which deployment surfaces are likely to be in scope, what the early evidence ought to read like, and which questions ought to be answered narrowly versus declined. Second, a settlement negotiation: the figure on the first settlement letter is rarely the figure on the final one, and the practice has handled the conversation often enough to know where each band typically lands. Third, a protection of the record going forward, so the same surfaces are not re opened in the next audit cycle on the same evidence. The full treatment lives at the audit defense hub.

Audit defense is named the lead service because the clock on the response window starts the day the notice is dated, not the day the buyer reads it. Time pressure is the one variable a buyer cannot purchase back. Every other surface in the practice can wait a quarter. This one cannot.

The window for the second service is the ninety days before the renewal signature. Earlier than ninety days the figures from Red Hat have not landed, and the conversation lives in posture rather than in numbers. Later than ninety days the buyer is negotiating against a calendar the seller controls, and the seller's calendar is structured around the seller's quarter close, not the buyer's budget cycle. The practice runs renewal negotiation as a fixed scope engagement across that ninety day window.

Coverage includes RHEL, OpenShift, Ansible Automation Platform, and JBoss. Each product line carries its own concession band, its own typical renewal uplift behaviour, and its own typical bundle dynamics. A renewal that treats all four as one number is rarely the renewal that lands in the middle of the available concession range. The engagement structures each line separately, then composes them back into a contract that the buyer's procurement and legal teams sign on a calendar the buyer controls.

The third service is hygiene work. Subscription assessment reconciles entitlement on the contract against deployment in the estate. It is most useful in two windows: pre renewal, so the buyer signs for what is actually run rather than for what was forecast three years earlier; and pre audit, so the figure a Red Hat audit notice produces is one the buyer has already produced internally and can therefore frame rather than react against.

The engagement covers RHEL socket pairs, virtual datacenter, unlimited virtual, the Smart Management add ons, OpenShift core counting in virtualized environments, Ansible Automation Platform managed node counts, and the JBoss EAP estate. Output is an entitlement to deployment reconciliation that the buyer can hand to procurement and to the internal audit function and that the practice can use later as the evidence base for either a renewal or a defense.

The fourth service is data. Benchmarking supplies concession band figures across signed Red Hat contracts the practice has closed, organised by product, by region, and by deal size. It is the figure comparable buyers actually paid, net of bundle accommodations and the multi year commitments that produced it, rather than the figure on the current Red Hat quote.1

The benchmark is most useful in the ninety days before a renewal closes, and in the thirty days after a compliance review settles. In the first window it sets the floor for the renewal conversation. In the second it sets the anchor for the next two contract cycles, since the figure on the executed settlement letter tends to travel forward. Where the audit notice is already in hand, benchmarking feeds the settlement conversation rather than the renewal one, and the lead service remains audit defense.

The fifth service is migration economics. Exit planning structures the workload model and the cost case for moving some or all of a Red Hat estate off RHEL onto Rocky Linux, AlmaLinux, Oracle Linux, or the SUSE Liberty programme.2 The engagement covers the technical migration profile, the support model implications, the regulatory implications where they apply, and the realistic cost difference net of internal labour.

What the engagement frequently produces is a renewal that the buyer signs with Red Hat at a materially better number than was first offered, on the strength of a credible alternative the buyer has actually scoped. The exit plan changes the renewal even when the client stays. That is the typical outcome of the engagement in the practice's record, and it is the reason the service is offered at the same fixed fee whether or not the buyer ultimately migrates.

The sixth service is the only one structured as an annual commitment rather than a fixed scope project. The advisory retainer places the practice on call across the full contract lifecycle. It is the engagement a buyer takes up after the first two or three discrete engagements have shown what good Red Hat posture looks like, and the buyer's internal team wants the same posture maintained across the years between renewals.

What the retainer covers: questions on inbound Red Hat correspondence, mid term contract amendments, mergers and divestitures that change the entitlement footprint, OpenShift node sizing changes, JBoss product family transitions, and the early signal work that catches a compliance review before it becomes an audit. The annual fee is set against the size of the Red Hat estate, and the engagement is structured so the buyer always knows what the next call costs before placing it.

A typical engagement arc runs in a sequence the practice has seen frequently enough to treat as a baseline. An audit notice arrives. The buyer engages audit defense. The settlement letter is signed. In the thirty to ninety days after settlement, the buyer engages subscription assessment, on the reasoning that the estate is now thoroughly understood by the practice and the hygiene work is cheaper to commission now than later. A benchmark delivery follows in the run up to the next renewal. The renewal closes against the benchmark and the cleaned estate, and the buyer signs an advisory retainer to hold the posture going forward.

The arc is not mandatory. Each of the six services is independent and each is fixed scope. A buyer may engage benchmarking alone, or renewal negotiation alone, or the retainer alone. What the arc captures is the order in which the surfaces tend to add value when taken together, and the reason audit defense leads the sequence is procedural rather than commercial. The notice arrives on a calendar the buyer does not control. The other five engagements live on calendars the buyer does.

A second pattern, less common but worth naming, runs the other direction. A buyer with an advisory retainer in place reads the early signal correctly, commissions a subscription assessment ahead of the next contract anniversary, and lands a renewal that does not produce a compliance review at all. In that pattern the audit defense engagement never arises, and the buyer pays for posture rather than for incident response. The practice considers that arc the better one, and structures the retainer to make it the most likely outcome for the clients who keep it in place across multiple years.

Preparing a response? The practice keeps a one-page Red Hat audit response checklist — what to acknowledge, what to preserve, and what not to volunteer in the first fourteen days after the letter arrives.