Checklist for Client Onboarding

DOCUMENT CONTROL BLOCK

• Document ID: SOP-TR-OPS-402
• Effective Date: October 24, 2023
• Version: 4.2
• Review Cadence: Semi-Annual

1. Executive Summary & Scope

Purpose

This Standard Operating Procedure (SOP) defines the institutional-grade framework for executing client onboarding at Template Registry. The objective is to transition newly acquired accounts from sales execution to active operational status with zero friction, complete regulatory compliance, and total alignment with SLA parameters.

Scope

This protocol applies across all Template Registry operational units, Account Management, Legal/Compliance, and Technical Integration teams. It governs all enterprise, mid-market, and self-serve tier-1 accounts from contract countersignature to the post-onboarding stabilization review.

---

2. Prerequisites & Required Tools

Required Software & Systems

• CRM Platform: Salesforce Enterprise (Client Record of Truth)
• Identity & Access Management (IAM): Okta SSO / Enterprise Directory
• Billing & Invoicing: Stripe Enterprise / NetSuite ERP
• Project Management: Jira Service Management / Asana Enterprise
• Compliance Repository: Vanta / Secureframe

Compliance & Security Standards

• SOC 2 Type II Compliance Framework
• GDPR and CCPA Data Processing Addendum (DPA) Execution
• ISO/IEC 27001 Information Security Standards

---

3. Roles & Responsibilities (RACI Matrix)

• R = Responsible (The role that performs the activity)
• A = Accountable (The role with final approval and ownership)
• C = Consulted (The role providing advisory input)
• I = Informed (The role kept updated on progress)

---

4. Step-by-Step Procedure

Phase 1: Pre-Onboarding & Administrative Handover (T-minus 5 Days)

• 1.1 Verify execution of Master Services Agreement (MSA), Order Form, and DPA within Salesforce Enterprise.
• 1.2 Confirm receipt of initial billing payment or issuance of Purchase Order (PO) in NetSuite.
• 1.3 Audit CRM metadata for data hygiene: ensure correct company legal name, primary billing contact, and SLA tiers are documented.
• 1.4 Generate internal Slack private channel (#client-[name]) and link corresponding Jira operational epic.

Phase 2: Technical Provisioning & IAM Setup (T-minus 3 Days)

• 2.1 Provision tenant environment within the Template Registry core infrastructure via automated IaC pipelines.
• 2.2 Configure Client Identity Provider (IdP) integration parameters (SAML 2.0 / OIDC configuration via Okta).
• 2.3 Assign Role-Based Access Control (RBAC) tiers according to the client's submitted organizational matrix.
• 2.4 Execute preliminary environment health-check and SSL/TLS certificate validation.

Phase 3: Alignment & Discovery Kickoff (Day 1)

• 3.1 Dispatch automated welcome packet containing secure credentials portal, documentation links, and office hours schedule.
• 3.2 Host 45-minute Executive Kickoff call with client stakeholders, CSM, and Solutions Architect.
• 3.3 Confirm timeline for historical data migration, user training sessions, and acceptance testing milestones.
• 3.4 Establish primary communication protocols and escalate threshold matrix within the operational wiki.

Phase 4: Integration & UAT Verification (Days 2–10)

• 4.1 Oversee secure ingestion and transformation of client template libraries and legacy data stores.
• 4.2 Execute end-to-end User Acceptance Testing (UAT) scenarios covering API calls, webhooks, and UI rendering.
• 4.3 Validate audit logging, compliance controls, and data residency configurations against DPA parameters.
• 4.4 Conduct administrative training session for client super-users and record baseline competency metrics.

Phase 5: Go-Live & Operational Handover (Day 14)

• 5.1 Obtain formal, written UAT sign-off from the Client Stakeholder via Jira Service Management ticket.
• 5.2 Transition account status in Salesforce from Pipeline-Closed/Won to Active-Operational.
• 5.3 Schedule 30-day Post-Implementation Review (PIR) and transition primary relationship to CSM.
• 5.4 Archive onboarding project workspace and lock baseline configuration profiles.

---

5. Quality Assurance & Verification

Key Performance Indicators & Thresholds

• Time-to-Value (TTV): Fully operational environment within $\le 14$ business days from contract execution.
• UAT Defect Density: Zero critical (P0/P1) bugs unresolved at the time of Go-Live sign-off.
• IAM Security Compliance: 100% of provisioned users mapped to approved enterprise roles prior to Day 1.

Common Operational Pitfalls

• Scope Creep: Permitting uncontracted custom integrations during Phase 4 without an executed change order.
• Data Silos: Failure to sync initial CRM metadata with technical provisioning specs, leading to IdP misconfigurations.
• Delayed Sign-offs: Leaving UAT validation ambiguous without a traceable, time-stamped ticket status.

Audit Checklist

• Executed MSA and DPA attached to Salesforce account record.
• Automated tenant health check logs clear of anomalies.
• Client super-user confirmation ticket closed and countersigned.
• CSM recurring touchpoint calendar invites dispatched.

---

6. Troubleshooting FAQ

Scenario A: Client SSO / SAML integration failure during Phase 2 provisioning.

• Symptom: Authentication requests return a 500 Invalid Assertion or timeout error when testing identity federation via Okta.
• Root Cause: Mismatch between the Template Registry Entity ID / Assertion Consumer Service (ACS) URL and the client's internal IdP metadata configuration, or expired X.509 signing certificates.
• Direct Solution:
  1. Instruct Solutions Architect to pull the latest metadata XML from the tenant configuration registry.
  2. Validate the client's IdP configuration against Template Registry documentation spec SOP-SEC-109.
  3. Re-import the updated certificate and execute a dry-run authentication test through the staging gateway.

Scenario B: Data migration stalling due to non-compliant source file formats.

• Symptom: Ingestion pipeline aborts with a schema validation failure during Phase 4 bulk template import.
• Root Cause: Client data structures contain unescaped characters, missing relational metadata, or exceed standard payload size thresholds.
• Direct Solution:
  1. Halt the automated pipeline execution to prevent partial database corruption.
  2. Run the diagnostic schema validator script (/tools/validate-import-v4.py) against the client source package to isolate corrupt records.
  3. Provide the client with the standardized transformation template and instruct them to re-export the affected dataset, or deploy an automated schema-mapping patch via professional services.