Client Onboarding Sops

STANDARD OPERATING PROCEDURE: Enterprise Client Onboarding Operations

Document ID: SOP-TR-OPS-402
Effective Date: October 24, 2023
Version: 4.2
Review Cadence: Semi-Annual
Owner: Julian Vance, Chief Operations Architect, Template Registry

---

1. Executive Summary & Scope

1.1 Purpose

This Standard Operating Procedure (SOP) defines the institutional protocol for executing end-to-end enterprise client onboarding at Template Registry. The objective is to standardize the operational handoff from commercial sales to technical deployment, ensuring zero structural friction, rigorous compliance alignment (SOC 2 Type II, GDPR, ISO 27001), and rapid time-to-value (TTV) for accounts with a Contract Value (ACV) exceeding $50,000.

1.2 Scope

This procedure applies to all incoming enterprise accounts managed by the Template Registry operations, Customer Success (CS), Solutions Architecture, and Information Security teams. Operations outside this structural framework require explicit written variance authorization from the Chief Operations Architect.

---

2. Prerequisites & Required Tools

2.1 Authorized Software & Infrastructure

• CRM Platform: Salesforce Enterprise (Master Account & Opportunity Management)
• Customer Success & Lifecycle Engine: Gainsight PX / Totango
• Identity & Access Management (IAM): Okta Enterprise / Azure Active Directory (SAML 2.0 Integration)
• Data Room & Document Execution: DocuSign Enterprise / Carta
• Project Management & Ticketing: Jira Service Management (Enterprise Tier)
• Compliance Repository: Vanta / Drata Automated Compliance Platform

2.2 Compliance & Security Standards

• Executed Master Services Agreement (MSA) and Enterprise Order Form.
• Passed automated Due Diligence Questionnaire (DDQ) or bespoke InfoSec review.
• Completed internal AML/KYC (Anti-Money Laundering / Know Your Customer) clearance via Compliance Officer.

---

3. Roles & Responsibilities (RACI Matrix)

Legend: R = Responsible, A = Accountable, C = Consulted, I = Informed

---

4. Step-by-Step Procedure

Phase 1: Commercial Handoff & Pre-Onboarding Audit

• 1.1 Verify that the Enterprise Order Form is fully executed and countersigned within DocuSign, with billing terms matched in Salesforce.
• 1.2 Validate that all custom SLAs, data residency requirements, and security addendums are explicitly flagged in the Salesforce Account Record under the "Enterprise Requirements" custom object.
• 1.3 Export the client configuration profile from the Sales handover repository and attach it to the primary Jira Service Management onboarding ticket.

Phase 2: Technical Discovery & Environment Provisioning

• 2.1 Schedule and execute the Technical Discovery Workshop (TDW) with the client’s designated IT Director and System Administrator within 3 business days of contract execution.
• 2.2 Configure tenant isolation parameters, custom subdomains, and data storage regions in adherence to the client's geographic compliance mandate (e.g., EU-Central-1 vs. US-East-1).
• 2.3 Establish secure SAML 2.0 SSO integration via Okta/Azure AD, confirming group mapping rules for administrative and standard user tiers.
• 2.4 Execute initial schema mapping for template metadata, user permission sets, and API rate-limit thresholds.

Phase 3: Client Kickoff & Operational Integration

• 3.1 Dispatch the formal Enterprise Onboarding Kit via the Gainsight engagement portal, including the immutable Implementation Timeline and RACI reference sheet.
• 3.2 Conduct the official Kickoff Call, verifying project milestones, escalation paths, and identifying the client's executive sponsor.
• 3.3 Initiate the sandbox environment deployment and distribute temporary administrative credentials via encrypted vault (1Password Business or equivalent zero-knowledge channel).

Phase 4: Validation, UAT, and Go-Live

• 4.1 Supervise User Acceptance Testing (UAT) phase, ensuring zero critical-severity bugs remain unresolved across template rendering and API integration endpoints.
• 4.2 Perform final security validation check, auditing system access logs and confirming that encryption-at-rest (AES-256) and in-transit (TLS 1.3) protocols are fully active.
• 4.3 Obtain written sign-off from the client’s technical project lead approving production environment cutover.
• 4.4 Promote tenant status in Salesforce from "Onboarding" to "Active Production," triggering automated billing cycles and CSM portfolio re-allocation.

---

5. Quality Assurance & Verification

5.1 Key Performance Metrics & Thresholds

• Time-to-Value (TTV): Enterprise onboarding must reach production go-live within 21 calendar days of contract execution.
• SLA Compliance: 100% adherence to specified data residency and IAM requirements.
• UAT Defect Density: Zero P1 (Blocker) or P2 (Critical) issues unresolved at the point of production sign-off.

5.2 Common Operational Pitfalls

• Pitfall: Initiating technical provisioning prior to InfoSec clearance on custom DPAs (Data Processing Addendums). Correction: Ensure automated blocks in Jira remain active until the ICO signs off in Vanta.
• Pitfall: Incomplete SAML metadata exchanges leading to SSO authentication failures during UAT. Correction: Mandate automated pre-flight assertion tests using the Template Registry diagnostic tool.

5.3 Audit Checklist

• Fully executed MSA and Order Form archived in repository.
• Salesforce Account fields populated without missing enterprise tags.
• UAT sign-off certificate timestamped and attached to the core ticket.
• Post-mortem feedback score recorded in Gainsight (Target CSAT ≥ 90%).

---

6. Troubleshooting FAQ

Q1: The client's security team halts the SSO configuration due to an unrecognized metadata fingerprint. How do we resolve this without violating compliance protocols?
A: Immediately pause Phase 2 provisioning. Generate a fresh cryptographic assertion signing certificate via the Okta integration console, cross-verify the SHA-256 fingerprint against our published Vanta compliance trust portal, and supply the updated metadata XML directly to the client's security architect via secure transfer. Do not transmit metadata via unencrypted email.

Q2: The designated client project lead becomes unresponsive during Phase 3 (UAT), threatening the 21-day TTV threshold. What is the operational escalation path?
A: Execute the 3-day rule: On Day 3 of unresponsiveness, the CSM must trigger an automated escalation notification to the secondary operational contact. Simultaneously, the Sales Executive must engage the client’s Executive Sponsor (identified during Phase 1 contract negotiation) to realign resource commitment and reset the project timeline within the Jira ticket tracker.