ERP Vendor Compliance Response Guide.pdf

Columbia Association ERP Modernization | Page 1

VENDOR RESPONSE WORKBOOK GUIDELINES

Detailed Step-by-Step Instructions for Understanding, Compiling, and Formally Submitting the Self-

Certification SLA & Technical Integration Telemetry Workbook https://xnet.columbiaassociation.com/CACommittees/CA_logo/Stacked_Tree/Stacked_TreeColor2spot_png.png

Columbia Association ERP Modernization | Page 2

Table of Contents

1. Sourcing Governance, Mission Context & Instructions

Workbook Navigation Structure

2. Section 2: Gating Compliance Matrix & Pre-Qualification Rules

3. Section 3: SLA Compliance Matrix & Granular Controls

Standardized Delivery Classification (Column F)

Risk Severity Ratings (Column D)

Granular Requirement Categories to Address

1. Identity & Access Management (IAM)

2. Rules-Based Property tax Billing (ACA Replacement)

3. High-Performance Integration Middleware

4. Zero-Trust Security Engineering

5. Operational Finance, Migration & Governance………………………………………………………………………………….8

4. Section 4: Technical Integration Telemetry & Integration Depth

The Four Required Integration Tests

Guidelines for Formatting Telemetry Code Blocks

5. Section 5: Automated Integrity Audits & Gating Linkages

The Four System Integrity Checkpoints

Direct Linkages to the Master ERP Scorecard

Columbia Association ERP Modernization | Page 3

1. Sourcing Governance, Mission Context & Instructions

Columbia Association (CA) is executing a comprehensive, board-authorized technology transformation to modernize its back-office systems. The primary strategic directive is the retirement of CA's legacy, private-cloud Infor/Lawson V10 financial core, the custom COBOL-based Annual Charge Application (ACA), and

Questica PowerPlan budgeting software. These legacy systems have accumulated decades of technical debt, relying on manual file manipulations (such as editing SDAT files in WordPad to delete zero-dollar accounts to prevent system crashes) and fragile point-to-point flat-file data transfers.

This procurement represents a critical operational milestone for CA:

• Revenue at Stake: The Annual Charge billing process manages CA's annual operating revenue ($50M in Annual Charge billings) across approximately 27,000 community accounts.

• The Mission: Transition CA to a unified 'Lead-to-Lease-to-Ledger' cloud ERP architecture that automates the financial chain, enforces strict data quality, and integrates resident self-service securely.

• A Defensible Selection: To ensure an objective, transparent, and legally defensible technology selection process, all vendors are required to formally self-certify and prove their compliance using the erp-vendor-response-workbook.xlsx. This workbook will become a contractually binding addendum to the final procurement agreement.

Workbook Navigation Structure

Vendors must complete and submit the workbook exactly as structured, preserving all formula fields and drop-down constraints. The workbook contains five sheets:

Tab Name Target Group Functional Focus & Auditing Role

TOC & Dashboard Executive / PMO

Features the Table of Contents, interactive navigation hyperlinks, color-coded eligibility summary cards, and the central Gating Eligibility Status indicator

(ELIGIBLE/DISQUALIFIED).

Gating Matrix Procurement /

AP

Contains the 6 non-negotiable Pass/Fail pre-qualification gates. Any 'No' or 'Partial' selection instantly disqualifies the vendor.

SLA Matrix Finance / IT

Catalogs 28 granular requirements with drop-down compliance classifications (Native, Configurable, Add-

On, Custom, Non-Compliant), Risk Severity Scores, and mandatory technical evidence input fields.

Columbia Association ERP Modernization | Page 4

Integration Depth IT Architects

Forces vendors to submit actual or simulated API execution logs, JSON schemas, and query latency metrics for CA's core retained spoke integrations.

System Integrity Audit Sourcing Chair

An automated validation tab running diagnostic tests to flag omitted answers, unevidenced claims, and excessive-customization TCO risks.

CRITICAL SOURCING RULES FOR THE VENDOR RESPONSE WORKBOOK:

1. DO NOT Alter, Modify, or Delete any formula cells or drop-down constraint validations on the TOC &

Dashboard, Gating Matrix, or System Integrity Audit sheets.

2. UNBIASED EVALUATION: All proposals will be evaluated programmatically. The Gating Compliance Matrix is a hard filter. Any self-certified 'No' or 'Partial' on these gates triggers immediate, automatic system-wide disqualification.

3. PROVE EVERY COMPLIANT CLAIM: Entering 'Fully Compliant (Native)' or 'Configurable (Standard)' on the SLA

Matrix is legally binding and must be accompanied by detailed technical evidence referencing exact proposal pages.

4. COMPLETENESS CHECK: The System Integrity Audit sheet must display '✅ PASSED' for all audit lines before submission, or the proposal will be rejected as non-responsive.

Columbia Association ERP Modernization | Page 5

2. Section 2: Gating Compliance Matrix & Pre-

Qualification Rules

The Gating Matrix represents Columbia Association’s mandatory pre-qualification filter. To be eligible for detailed scorecard evaluation and live product demonstrations, the vendor must formally self-certify and prove 100% compliance with these six non-negotiable security, architectural, and financial gates. Selecting

'Non-Compliant' or 'Partially Compliant' on any single gate will trigger immediate complete disqualification, with zero mathematical exceptions or workarounds.

Gate ID Compliance Domain Mandatory Target Capability &

Standard

Disqualification

Trigger

GATE-SEC-001 Security & Audit

Vendor must possess active, third-party audited SOC 2 Type II and ISO/IEC 27001 certifications.

Any status except

“Pass” (i.e., any

“Partial,” “No,” or

“Non-Compliant” self-certification, or failure to attach active SOC 2 Type II and ISO/IEC 27001 auditor opinions to the Technical

Proposal, results in immediate and automatic disqualification. No exceptions, workarounds, or retroactive remediation plans will be accepted

GATE-PAY-001 PCI Compliance

System must integrate a PCI-DSS v4.0 Tier-1 payment gateway utilizing tokenized hosted fields to isolate credit card data.

Failure to prove zero raw credit card details transit or populate local networks

GATE-IAM-001 Identity Access Logins must federate with enterprise identity providers

Lack of native directory federation

Columbia Association ERP Modernization | Page 6 using SAML 2.0 or OIDC and support Multi-Factor

Authentication (MFA).

Automated SCIM user provisioning is evaluated separately under SLA-IAM-003.

or manual provisioning dependencies

GATE-BIL-001 Rules Engine Core

Core billing engine must calculate property assessments, cap phase-ins, and late fees natively without custom COBOL.

Requirement of any custom coding, bespoke script, or external manual calculation

GATE-MIG-001 Data Privacy

All non-production environments must use Static

Data Masking (SDM) to permanently scramble PII (SSNs, banking details).

refreshing sandboxes with unmasked live production data

GATE-DR-001 Technical Resilience

Disaster recovery objectives guaranteeing a Recovery Time

Objective (RTO) < 4 hours and

Recovery Point Objective (RPO) <

1 hour.

Inability to demonstrate multi-zone database failover and automated PITR checkpoints

Columbia Association ERP Modernization | Page 7

3. Section 3: SLA Compliance Matrix & Granular

Controls

The SLA Matrix contains 28 non-negotiable requirements that dictate the operational logic, security protocols, and integration latency metrics of CA’s target technology stack. Vendors must evaluate each line item and complete the compliance fields strictly according to the guidelines below.

Standardized Delivery Classification

For every requirement, the vendor must select one of the following five-tier classifications from the dropdown list. Selecting an incorrect classification to artificially inflate scores represents misrepresentation and is grounds for immediate disqualification.

• Fully Compliant (Native): The requirement is met completely out-of-the-box using standard platform resources, requiring zero custom fields, custom coding, or external add-on modules.

• Configurable (Standard): The requirement is met through standard, built-in system configurations and workflow rules, requiring no custom scripting or custom software development.

• Add-On Module: The requirement is met through a separate, commercially available product module or a certified partner application listed in the vendor's standard marketplace.

• Custom Extension: The requirement can only be met through custom code development, bespoke

API wiring, or proprietary scripting compiled specifically for CA.

• Non-Compliant: The platform is unable to meet or support the requirement under any circumstances.

Risk Severity Ratings (Column D)

Each requirement is pre-populated with a Strategic Risk Severity rating. This rating informs the automated

System Integrity Audit and dictates the depth of verification required:

• Critical: Governs the core revenue cycle or cybersecurity perimeter. Requires exhaustive technical evidence, including sample payloads or architecture diagrams.

• High / Medium / Low: Governs day-to-day operations or support functions. Requires written technical justification and references to standard product documentation.

Granular Requirement Categories to Address

Vendors must formally declare and prove their capabilities across these five highly critical, stakeholder-prioritized domains:

Columbia Association ERP Modernization | Page 8

1. Identity & Access Management (IAM)

Prove native federation with enterprise directory services using SAML 2.0 or OIDC. Solutions must support contextual MFA, automated SCIM provisioning, Role-Based Access Control (RBAC), automatic session timeout controls, and secure token rotation policies. Vendors should provide documentation demonstrating separation-of-duty controls for financial transactions and administrative access.

2. Rules-Based Property and Assessment Billing (ACA Replacement)

Demonstrate native support for Maryland SDAT file ingestion, anomaly and zero-dollar transaction filtering, assessment-cap phase-in calculations, and county tax credit or abatement processing. Vendors must explain how these functions are executed without manual intervention, spreadsheets, or legacy custom processing.

3. High-Performance Integration Middleware

Demonstrate support for event-driven integrations, webhooks, change-data-capture processes, dead-letter queues, transaction idempotency controls, Club Automation integrations, Ceridian Dayforce integrations, and Smartsheet-to-EAM workflows. Vendors should describe architecture, monitoring, throughput, and latency controls.

4. Zero-Trust Security Architecture

Prove encryption-at-rest using modern key management services, TLS 1.3 and mutual TLS, centralized immutable audit logging, static data masking for lower environments, DTMF masking for telephony payment interactions, and privileged-access-management controls including Just-In-Time administration and break-glass procedures.

5. Operational Finance, Migration & Governance

Demonstrate support for refund-workflow tracking, cutover governance, financial-period close controls, automated collections and dunning processes, platform availability monitoring, disaster recovery reporting, migration reconciliation, trial-balance validation, and post-conversion audit capabilities.

Vendors should provide examples of operational metrics, workflow logs, and governance dashboards supporting these capabilities.

Columbia Association ERP Modernization | Page 9

4. Section 4: Technical Integration Telemetry &

Integration Depth

CA’s technology modernization abandons legacy point-to-point flat file transfers and manual 'swivel-chair' re-keying in favor of real-time, API-driven synchronization. To verify vendor claims of 'Fully Compliant

(Native)' or 'Configurable (Standard)', the vendor is required to submit actual or simulated telemetry logs, JSON payloads, and execution traces for the core integrations and operational integration scenarios listed within the workbook, including Club Automation, Ceridian Dayforce, 8x8/Diagenix IVR, and Smartsheet-to-EAM processing workflows.

The Four Required Integration Tests

Test ID Integration Endpoint Required Latency SLA Telemetry Evidence

Required

TEST-INT-001

Club Automation POS webhooks

< 5 minutes ingestion latency

JSON sample payload of a membership fee posting with X-Idempotency-Key headers and mock API execution logs.

TEST-INT-002

Ceridian Dayforce GL payroll sync

< 15 minutes processing window

Asynchronous message queue logs showing how the system ingests, balances, and posts cross-departmental labor allocations.

TEST-INT-003

8x8 PBX / Diagenix IVR balance queries < 100 ms query latency

API logs demonstrating bi-directional IVR balance lookups query an isolated read-replica or Redis cache under 500 requests/second.

TEST-INT-004

Smartsheet CA Support

Hub / EAM Integration

< 10 second processing target

Webhook execution logs, workflow trace demonstrating work-order creation, downstream procurement/GL

Columbia Association ERP Modernization | Page 10 processing records, and representative payload samples

Guidelines for Formatting Telemetry Code Blocks

When completing Sheet 4 (Integration Depth), the vendor must paste clean, unformatted JSON schemas and actual log blocks inside the designated cells. Ensure that all code blocks use standardized spacing, identify specific API versions (e.g., v2 or v4), and explicitly highlight how the platform natively handles data validation errors (such as routing a malformed payroll cost code directly to a Dead-Letter Queue in <

500ms rather than crashing the interface).

Columbia Association ERP Modernization | Page 11

5. Section 5: Automated Integrity Audits & Gating

Linkages

The Vendor Compliance Response Workbook.xlsx contains active formulas, data validations, and automated audit controls designed to automatically audit vendor entries prior to submission. This ensures process transparency and prevents vendors from attempting to submit incomplete or lopsided proposals.

The Four System Integrity Checkpoints

Sheet 5 (System Integrity Audit) runs continuous diagnostics across the entire workbook. Evaluators will check this sheet first upon receiving proposals. Audit Checks 1 through 3 must display a passing status before submission. Audit Check 4 is an informational customization and TCO risk indicator; a warning does not automatically disqualify the Vendor but may affect evaluation scoring and implementation-risk assessment.

• 1. Audit of Omitted Answers: The workbook checks if any of the 6 Gating or 28 SLA requirements were left blank. Any omitted row will trigger a '❌ FAILED' flag, and the proposal will be rejected as non-responsive.

• 2. Audit of Unsubstantiated Claims: If the vendor self-certifies a requirement as 'Fully Compliant

(Native)' or 'Configurable (Standard)' but leaves the mandatory 'Evidence Reference' cell blank, this audit line will fail, indicating a high compliance risk.

• 3. Gating Eligibility Linkage: The workbook automatically links the Gating Matrix and the TOC &

Dashboard. If any gate contains a 'Fail', the Gating Eligibility status cell dynamically displays '❌

DISQUALIFIED', and the workbook is flagged as ineligible.

• 4. TCO Customization Risk Check: The audit sheet programmatically calculates the vendor's delivery model. If the platform meets more than 30% of CA's compliant scope via 'Custom Extension' or 'Add-

On Module', this check will trigger a yellow warning flag, alerting the Sourcing Committee of a high

Total Cost of Ownership (TCO) risk.

Direct Linkages to the Master ERP Scorecard

The compiled results from the Vendor Compliance Response Workbook.xlsx link directly to the ERP

Requirements Traceability Matrix.xlsx and the Sourcing Scorecard used during the evaluation workshops.

The compliance rates and API latencies certified by the vendor will serve as the baseline performance expectations in the final contract, establishing an auditable and mathematically sound procurement record that eliminates brand bias and secures long-term operational success for the Columbia Association.