Cerri Project

Discovery and scoping

Objectives definition: clarify goals, success metrics, and key processes to support (project intake, planning, execution, reporting).

Stakeholder mapping: identify sponsors, PMO, finance, IT, HR, and end users.

Current state assessment: review existing tools, data models, workflows, and integrations.

Output: high-level requirements, success criteria, risk register, and a draft project plan.

Solution design and configuration

Architecture decisions: deployment model (cloud SaaS vs. on-premises), data architecture, security/compliance needs.

Module mapping: which features will be enabled (portfolio management, resource management, time tracking, timesheets, approvals, dashboards).

Data model and migrations: mapping fields,建立 master data (cost centers, accounts, resources), data cleanup plan.

Customization scope: standard configurations vs. code-level customizations (if supported).

Output: detailed design document, data migration plan, risk/mitigation plan, and a test plan.

Integration and data migration

Systems to connect: ERP/financials, HRIS, CRM, bug/issue trackers, CI/CD tools, time/expense systems.

Data migration activities: extract, transform, load (ETL), data cleansing, validation scripts.

Security and access control: roles, permissions, SSO, MFA, audit trails.

Output: integration specs, API mappings, migration cutover plan, validation results.

Deployment and testing

Environment setup: dev, test/UAT, pilot, and production environments (if applicable).

Testing types: functional, integration, performance, user acceptance, data integrity.

User readiness: training materials, runbooks, and ta/rts.

Output: test results, acceptance sign-off, go-live checklist.

Change management and training

Training programs: admin training, end-user training, quick-start guides, video tutorials.

Change enablement: communication plan, champions network, support handoffs.

Output: training completion metrics, knowledge bases, support plan.

Go-live and stabilization

Cutover activities: data finalization, last-mile migrations, switch-over window.

Hypercare: 1–4 weeks of elevated support to address issues and fine-tune configurations.

Post-go-live review: lessons learned, plan for continuous improvement.

Workflow customization: approval workflows, custom stages, conditional routing.

Fields and data model: custom fields, custom objects, enterprise data dictionary.

Reports and dashboards: custom KPIs, nested dashboards, export formats.

Automation and rules: triggers, alerts, notifications, scheduled actions.

Integrations: pre-built connectors, REST/SOAP APIs, webhooks, middleware (e.g., iPaaS).

UI/UX tweaks: branding, page layouts, user roles, permission sets.

Security: custom RBAC, data residency options, encryption at rest/in transit, audit logging.

Extensibility: plugin/module development, sandbox environments, upgrade safety.

License/subscription fees: per user, per month/year, tiered by role or usage.

One-time setup/implementation fee: often 10–40% of the first-year software cost, or a fixed range depending on scope.

Data migration fees: if significant cleansing or mapping is required.

Customization charges: hourly or per-project estimates; some vendors offer fixed-price for defined scopes.

Integrations/connectors: may be included in base, or billed per integration and per data volume.

Training costs: on-site or virtual training, and learning materials access.

Hosting/infra costs: cloud hosting fees, if not included in subscription.

Ongoing maintenance and support:

• Standard support: basic incident response within defined SLAs, typically included or low-cost.

• Premium/enterprise support: faster response, 24/7 coverage, dedicated account management.

• Support consumables: time-based or ticket-based support credits, optional managed services.

Admin training: configuration, security roles, SSO, backup/restoration, user management.

End-user training: project creation, task management, time tracking, approvals, dashboards.

Role-based curricula: PMO, project managers, resource managers, financial analysts, developers, testers.

Delivery formats: live instructor-led, interactive virtual labs, on-demand e-learning, quick-start guides.

Training materials: user manuals, cheat sheets, video tutorials, knowledge base, sample projects.

Certification or competency paths: any vendor-recognized credentials.

Training timeline: typical duration (e.g., 1–2 days for admins, 1 day for end users) and pacing (rolling vs. batch).

Assessments and validation: quizzes, hands-on labs, sign-off requirements.

Accessibility and localization: languages supported, regional content, accessibility standards.

Training hours and access: included with implementation, or available as a separate service; any renewal or refresher options.

Data residency and sovereignty: where data is stored (regions, data centers) and under what laws.

Data encryption: at rest (AES-256, for example) and in transit (TLS 1.2/1.3); key management options.

Identity and access management: SSO (SAML, OpenID Connect), MFA, role-based access control (RBAC), fine-grained permissions.

Audit and monitoring: immutable logs, audit trails, log retention periods, anomaly detection.

Data isolation and privacy: multi-tenant vs. single-tenant options; data segmentation.

Backup and disaster recovery: RPO/RTO targets, backup frequency, failover mechanisms.

Security certifications and attestations: SOC 2/3, ISO 27001, HITRUST, GDPR/CCPA compliance, PCI-DSS if applicable.

Vulnerability management: regular vulnerability scans, penetration testing cadence, responsible disclosure process.

Incident response: defined SLAs, on-call contacts, post-incident reviews.

Change management for security: how security patches and upgrades are tested and deployed; change control processes.

Data retention and deletion: policies for data retention, anonymization, and secure deletion on request.

Third-party risk: vendor risk assessment, subprocessor disclosures, and written security addenda.

Release cadence: how often updates are released (monthly, quarterly, biannual, as-needed).

Update types: feature releases, security patches, bug fixes, and critical hotfixes.

Deployment model for updates: automatic, opt-in, or manual upgrades; phased rollout strategies.

Backward compatibility: how upgrades affect customizations, integrations, and data models.

Testing and validation: available test/staging environments; expected effort to validate upgrades.

Roll-back procedures: ability to revert if an update causes issues; data safety during upgrade.

Downtime expectations: maintenance windows; whether updates require downtime and how long.

Upgrade cost and licensing impact: any additional license requirements or per-upgrade charges

Communication and change logs: how customers are informed about changes, deprecations, and sunset timelines.

End-of-life policy: support timelines for versions and required migrations to newer releases.

Data ownership rights: confirm that your organization retains ownership of all data you input into Cerri Project.

Data usage rights: clarify permitted uses of your data by the vendor (e.g., for product improvement) and any data licensing terms.

Data portability: ability to export data in open, machine-readable formats (CSV, JSON, XML, or API-backed exports) and the scope of export capabilities.

Data retention and deletion post-termination: how long data remains accessible after contract ends, and the process/timeline for data deletion or secure deletion certification.

Data migration assistance: availability of migration services to move data to another system, including format compatibility and any fees.

Data localization and residency: where data is stored (regions/datacenters) and whether data can be geo-fenced or restricted from leaving certain jurisdictions.

Backups and recovery: backup frequency, retention windows, and how data integrity is ensured in restorations.

Subprocessor disclosures: list of third parties that may process data and their data protection commitments.

Breach notification: incident response timelines and notification procedures in case of a data breach.

Security controls linked to data: how data is segmented in multi-tenant setups, and encryption practices for data at rest/in transit.

Scaling model: how scaling is handled (per-user licenses, per-seat, per-resource, or usage-based).

Minimum/maximum capacity: any minimum commitments or tiered limits.

Elasticity and provisioning time: how quickly you can scale up or down (days vs. hours) and any lead-time requirements.

Pricing implications: how scaling affects pricing (tier changes, bulk discounts, prorations on mid-cycle changes).

Contract alignment: whether scaling requires contract amendments or if a single master agreement covers changes.

Data and feature impact: whether scaling affects available features, modules, or data quotas.

Termination with scaling: how scaling changes interact with renewal notices and termination rights.

Renewal terms: auto-renewal vs. manual renewals; renewal notice periods; price renewal rules (cap, inflation, increase caps).

Price protection: whether price increases are limited and how exemptions are handled.

** Term length and upgrade options**: standard contract durations (1–3 years) and options to upgrade during renewal.

Cancellation rights: notice periods, early termination penalties, and any wind-down or data access rights post-cancellation.

Data return or deletion at termination: final data export rights, deletion timelines, and certification of data destruction.

SLA continuity on renewal: whether existing SLAs persist through renewal or change upon renegotiation.

Transition assistance: dedicated support during wind-down, access to data, and knowledge transfer.

Vendor-supported migrations: assistance with moving to alternate solutions at contract end, including third-party support.

Compliance and audit rights: ongoing compliance attestations during the contract term and post-termination data handling audits.

Security certifications: ISO 27001, SOC 2 Type II, SOC 3, PCI-DSS (if payments), HITRUST, CSA STAR.

Privacy and data protection: GDPR/CCPA compliance, data processing addendum (DPA), data residency options, data minimization practices.

Industry-specific controls: HIPAA (if healthcare) or other sector-specific standards.

Software development and security practices: secure SDLC, vulnerability management, penetration testing cadence, secure coding standards.

Audit and reporting: frequency of audits, scope of reports, third-party assessor reports.

Business continuity and disaster recovery: BCP/DR testing, RPO/RTO targets.

Subprocessor transparency: published list of subprocessors and changes.