Client Onboarding Process

Standard Operating Procedure: Client Onboarding Process

Document Control Block

• Document ID: SOP-TR-OPS-402
• Effective Date: October 24, 2023
• Version: 3.4
• Review Cadence: Semi-Annual

Executive Summary & Scope

This Standard Operating Procedure (SOP) defines the operational lifecycle for acquiring, provisioning, and integrating new institutional clients into the Template Registry ecosystem. The objective is to standardize the transition from executed master services agreement (MSA) to fully operationalized client access, ensuring strict adherence to data security compliance, SLA baselines, and resource provisioning matrices. This procedure applies to all new enterprise, mid-market, and strategic partner accounts managed by Template Registry operations, account management, and security compliance teams.

Prerequisites & Required Tools

• Software Stack: Template Registry Enterprise Core, Salesforce CRM, Jira Service Desk, Okta IAM, DocuSign Enterprise.
• Compliance Standards: SOC 2 Type II, ISO/IEC 27001, GDPR, HIPAA (where applicable).
• Access Credentials: Privileged Access Management (PAM) vault access, Master Admin role authorization for tenant provisioning.
• Documentation: Executed MSA, Statement of Work (SOW), Security Addendum, and Data Processing Agreement (DPA).

Roles & Responsibilities

Step-by-Step Procedure

Phase 1: Intake and Contract Verification

• 1.1 Receive executed MSA and SOW via the Salesforce CRM automated trigger upon contract closure.
• 1.2 Verify that all financial terms, tier limits, and SLA metrics match the approved sales quote within 2 business hours of receipt.
• 1.3 Create the master client tracking ticket in Jira Service Desk using template TR-ONBOARD-DEFAULT.
• 1.4 Assign the primary Account Manager (AM) and Solutions Architect (SA) within the Jira ticket metadata.

Phase 2: Technical Provisioning and Architecture Setup

• 2.1 Initiate tenant isolation workflow within the Template Registry Enterprise Core provisioning console.
• 2.2 Configure client-specific database shards, encryption keys (using customer-managed KMS if contracted), and regional data residency constraints.
• 2.3 Establish Identity and Access Management (IAM) federation endpoints via Okta for Single Sign-On (SSO) and Multi-Factor Authentication (MFA) enforcement.
• 2.4 Run automated environment health checks to verify API response latency and storage allocation limits.

Phase 3: Compliance and Security Clearance

• 3.1 Verify execution of the Data Processing Agreement (DPA) and Business Associate Agreement (BAA) if applicable.
• 3.2 Conduct automated dependency and access vulnerability scans on the newly provisioned tenant instance.
• 3.3 Log compliance metadata and retention schedule parameters in the institutional audit ledger.
• 3.4 Obtain formal digital sign-off from the Compliance Officer via the Jira gate mechanism.

Phase 4: Billing, Activation, and Kickoff

• 4.1 Input finalized billing profiles, tax exemptions, and invoicing cadences into the Billing Ops module.
• 4.2 Dispatch the automated Welcome Package and credential retrieval link to the client-designated security admin via encrypted channel.
• 4.3 Schedule and conduct the technical onboarding sync (Kickoff Meeting) with the client technical leads within 5 business days of contract execution.
• 4.4 Update Salesforce CRM stage from "Closed Won" to "Onboarding Complete" upon successful completion of the kickoff session.

Quality Assurance & Verification

• Key Metric Thresholds:
  • Time-to-Provision (TTP) must not exceed 48 business hours from contract verification.
  • Initial system access authentication success rate must be 100%.
• Common Pitfalls:
  • Provisioning environments prior to full DPA execution.
  • Failing to enforce MFA policies on the initial administrative login.
• Audit Checklist:
  • Signed MSA, SOW, and DPA archived in digital vault.
  • Tenant isolated and encrypted with client-specific keys.
  • IAM/SSO protocols successfully tested by client administrator.
  • Jira ticket closed with complete operation audit trail.

Troubleshooting FAQ

Q1: The automated tenant provisioning script fails due to a regional data residency conflict. What is the corrective action?

A: Halt the automated workflow immediately. Verify the agreed-upon data storage jurisdiction specified in the SOW. Manually select the compliant cloud region within the infrastructure provisioning console, document the exception in the Jira audit log, and rerun the deployment script.

Q2: The client's designated administrator is unable to authenticate via their corporate Okta SSO integration during Phase 4. How do is this resolved?

A: Verify that the client's Security Assertion Markup Language (SAML) metadata URL and X.509 certificate have been correctly mapped within the Template Registry IAM module. If validation errors persist, issue a temporary, time-bound break-glass admin credential via the secure PAM vault to complete initial testing while escalating the SAML attribute mapping issue to the enterprise support engineering queue.