Wibbi

• Discovery & scoping

• Objectives defined: Align on goals, success metrics, and expected business outcomes.

• Stakeholders identified: IT, operations, finance, compliance, end-users.

• Current-state assessment: Review existing systems, data sources, processes, and integrations.

• High-level requirements: Desired features, customizations, reporting needs, security/compliance requirements.

• RACI / timeline rough plan: Responsibility matrix and initial milestones.

• Solution design & roadmap

• Solution architecture: Data model, workflows, roles, permissions, and UX considerations.

• Data mapping: Identify source data, data quality gaps, transformation rules.

• Integration plan: ERP/CRM, BI tools, HRIS, or other systems; APIs, middleware, or ETL needs.

• Customization feasibility: What can be configured out-of-the-box vs. custom development.

• Change management plan: Training, onboarding, and adoption strategy.

• Environment setup

• Sandbox / development environment: For configuration and testing.

• Production environment readiness: Security controls, backups, disaster recovery, and performance baselines.

• Configuration & customization

• Configuration: Settings, workflows, dashboards, permissions, notifications.

• Custom development (if needed): Any bespoke modules, scripts, or connectors.

• Data migration planning: Data extraction, cleansing, mapping, and migration cutover plan.

• Automation & workflows: Rule-based automations, alerts, and approvals.

• Testing

• Unit & integration testing: Validate each component and end-to-end flows.

• User acceptance testing (UAT): Key users validate against requirements.

• Security & compliance testing: Access controls, data privacy checks, audit trails.

• Out-of-the-box configurability: Which modules and features can be turned on/off, renamed, or rearranged without code.

• Workflow builder: Can you design and modify approval workflows, routing rules, SLA timers, and escalation paths in a no-code/low-code environment.

• Field-level customization: Can you add, remove, or rename data fields? Are there limits on field types (text, number, date, picklist, lookup, computed fields).

• UI/UX personalization: Can dashboards, reports, and views be tailored by user role or team? Can you create multiple dashboards for different personas.

• Notifications & alerts: Can you configure trigger-based alerts (email, in-app, SMS) and escalation rules without developers.

• Setup / implementation fee:

  • One-time or phased payments for discovery, design, and initial configuration

  • Often includes project management, data migration planning, and training

• License / subscription costs:

  • Per-user, per-month/year, or tier-based pricing

  • May include access to core modules and a baseline feature set

• Customization/implementation services:

  • Fees for any bespoke development, integration work, or consulting

• Data migration:

  • Costs for data extraction, cleansing, transformation, and loading

• Training:

  • User and admin training sessions, workshops, and materials

• Support & maintenance:

  • SLA-based support (response times, uptime guarantees)

  • Access to product updates, security patches, and new features

• Infrastructure costs (if on-prem or hybrid):

  • Hosting, backups, DR, and ancillary services

• Other potential costs

  :

  • Add-ons, premium connectors, advanced analytics, or dedicated customer success manager

• Onboarding program: structured kickoff with goal setting, success metrics, and a project plan.

• Role-based training: targeted sessions for end users, managers, and admins.

  • End users: how to perform day-to-day tasks, navigate the UI, and run standard reports.

  • Admins: configuration, user management, security, integration monitoring, and data governance.

• Training formats:

  • Live virtual or on-site training sessions

  • Self-paced e-learning modules

  • Quick-start guides and in-app help widgets

  • Interactive sandboxes or practice environments

• Admin enablement: workshops on configuration, workflow design, automation, and monitoring.

• Training materials: user manuals, cheat sheets, video tutorials, and knowledge base access.

• Certification or accreditation: optional programs for advanced admins or power users.

• Change management & adoption: user adoption plans, communication templates, and rollout playbooks.

• Hypercare/support period: elevated support (e.g., 2–6 weeks post go-live) to address immediate issues and stabilize usage.

• Ongoing support: standard helpdesk, tiered support (P1–P3), escalation paths, and accessibility during business hours or 24/7 per SLA.

• Data classification and governance: data ownership, data retention policies, and data lifecycle management.

• Access control: RBAC (role-based access control), MFA, least-privilege principles, and regular access reviews.

• Data in transit and at rest:

  • Encryption standards (e.g., TLS 1.2+/1.3 for in transit)

  • Encryption at rest (AES-256 or equivalent)

• Identity security: integration with SSO, SCIM provisioning, and passwordless options if applicable.

• Security certifications and audits:

  • ISO 27001, SOC 2 Type II, PCI DSS relevance (if handling payment data), GDPR readiness, HIPAA (if healthcare), etc.

  • Frequency of third-party penetration testing and remediation timelines.

• Data residency and sovereignity: where data is stored geographically and any data transfer safeguards.

• Major/minor releases: periodic major releases with new features and breaking changes, plus smaller, frequent patches.

• Continuous delivery model: frequent incremental updates (weekly or biweekly) with automated testing.

• Scheduled maintenance windows: predictable downtime or in-place updates during off-hours.

• Backward compatibility: guidance on deprecations, feature toggles, and upgrade paths.

• Change management for customers: release notes, customer通知, and optional user acceptance testing during a window.

• APIs for data access: Existence and maturity of APIs for extracting data on demand.

• ETL/BI compatibility: Supported data connectors or export templates for common BI tools.

• Data schema stability: Consistency of data models across updates to avoid breaking exports.

• Migration assistance: Does Wibbi offer data migration services or documentation to facilitate migration to another platform.

Scaling up (expansion)

• Pricing impact: How are additional seats, modules, or throughput priced? Tier changes and potential volume discounts.

• Deliveryability: Does Wibbi provide ramp-up plans, onboarding for new users, and any required configuration adjustments.

• No downtime guarantees: Are there staged rollouts to minimize business disruption.

Scaling down (reduction)

• Minimum commitments: Any minimum user counts or term lengths to reduce.

• Notice periods: Required lead time to scale down (e.g., 30–90 days).

• Term length options: Common terms (12, 24, 36 months) and any discount for longer commitments.

• Renewal negotiation rights: Opportunity to renegotiate features, service levels, or scope at renewal.

• Data rights at renewal: Continuation of data access during renewal discussions vs. post-renewal termination.

• Early termination largely: Fees, penalties, or “pay/terminate” clauses; any cap on termination costs.

• Service continuity post-termination: Transitional support (e.g., 60–180 days) to extract data and decommission.

• Clause for price protection: Any caps on price increases during renewal.

• Notice period: Required notice time to cancel (often 30–90 days before renewal).

• Return of data: Timeframe and process for exporting data before termination.

• Decommissioning support: Assistance with disabling access, archiving logs, or migrating off-platform.

• Non-renewal penalties: Any fees if you choose not to renew at term end.

• Post-termination support: Availability and cost of support after cancellation, if needed.

• Information Security Management: ISO 27001 certification (and scope).

• Security & controls: SOC 2 Type II or SOC 3 reports; PCI DSS applicability if handling payment data.

• Privacy: GDPR readiness, CCPA/CPRA considerations, and data processing addendum (DPA).

• Industry-specific: HIPAA (healthcare), FERPA (education), SOX (financial controls), depending on sector.

• Data protection measures: Data encryption at rest/in transit, key management, and vulnerability management.

• Audits & assessments: Frequency of third-party audits, penetration testing cadence, and remediation timelines.

• Data processing & subprocessors: List of subprocessors, DPA terms, and how subprocessor changes are communicated.

• Data residency & sovereignty: Regions where data is stored and data transfer safeguards (e.g., SCCs/UK IDTA if applicable).

• Breach notification: RPO/RTO for incident responses and notification timelines.