Customer Requirements Specification for a New CRM System
The company requires a central CRM system for 40 sales representatives at three locations. The system shall manage leads, quotes, customer visits, orders and invoices, while providing mobile access, management reporting and GDPR-compliant storage in the EU.
1. Introduction and objectives
Customer information is currently maintained in spreadsheets and Outlook. The company intends to introduce one central CRM system for its sales organisation.
The main objectives are to standardise sales processes, improve data quality, support mobile working and provide reliable information for sales management.
- Central and consistent customer, contact, lead and quote information.
- Structured recording of customer visits on smartphones.
- Visibility of related ERP orders and invoices.
- Reduced manual reporting and improved sales forecasting.
2. Current state
The sales team consists of 40 representatives working at three locations. Customer data is distributed across spreadsheets and individual Outlook mailboxes, with no stated central CRM.
Leads, quotes and visit information are not currently managed in one consistent process. Sales management reporting is therefore expected to require manual consolidation.
- Customer and contact records may be duplicated or outdated.
- Relevant customer communication may remain in individual Outlook mailboxes.
- Sales activities and visit results are difficult to compare across locations.
- Orders and invoices are held in the ERP and are not centrally visible to sales users in the current process.
- The ERP product, interfaces and available data fields are not yet specified (assumption).
3. Functional requirements
The CRM shall support the following business functions. All information shown to users shall be subject to role-based access rights.
User access and roles
The CRM shall provide individual user accounts and configurable roles for sales representatives, sales management and system administrators.
Acceptance: An administrator can create, disable and assign a role to a user. A test user can only view and change records permitted by the assigned role.
Customer and contact management
The CRM shall maintain accounts, customer contacts, addresses, communication details, responsible sales representatives and relevant relationship information.
Acceptance: A user can create, edit and view an account with at least one contact, responsible representative and address. Changes are visible to authorised users without updating separate spreadsheets.
Lead management
The CRM shall record, qualify, assign, follow up and convert leads into accounts, contacts or opportunities.
Acceptance: A user can create a lead, assign an owner, set a status and next action, and convert a qualified lead while retaining its history.
Opportunity and quote management
The CRM shall manage opportunities and quotes, including value, probability, expected close date, products or services, status, version and responsible representative.
Acceptance: A user can create and update an opportunity and at least one quote, change the quote status and retrieve the complete quote history from the related customer record.
Mobile visit reports
The CRM shall allow sales representatives to create and submit visit reports on smartphones, including customer, date, participants, purpose, result, next steps and attachments where applicable.
Acceptance: Using a smartphone, a test representative can create and submit a visit report in no more than five minutes. The report is linked to the selected customer and visible to authorised sales management.
Activities, tasks and reminders
The CRM shall provide activities, follow-up tasks, due dates, reminders and status tracking for leads, customers, opportunities and visits.
Acceptance: A user can create a follow-up task from a lead or visit report, assign a due date and mark it complete. Overdue tasks are identifiable in the user's task view.
Outlook integration
The CRM should allow authorised users to associate relevant Outlook emails and calendar activities with CRM records without manually re-entering all information.
Acceptance: In a test Outlook account, a user can link a selected email and calendar appointment to an existing customer or opportunity, and the linked items are visible in the CRM.
ERP orders and invoices
The CRM shall display relevant orders and invoices from the ERP in the context of the related customer and, where available, the opportunity or quote.
Acceptance: For a test customer with ERP data, the CRM displays order number, date, status, value and invoice number or status received from the ERP. The CRM does not create duplicate ERP transactions.
Sales reporting and dashboards
The CRM shall provide reports and dashboards for sales management covering leads, opportunities, quote values, conversion rates, activities, visits, orders and invoices.
Acceptance: A sales manager can filter a dashboard by representative, location and period, and export the displayed report. The figures can be reconciled with the underlying CRM records.
Search, filtering and record views
The CRM shall provide global search and filtering for accounts, contacts, leads, opportunities, quotes, visits, orders and invoices.
Acceptance: A user can find a test customer by name, email address or customer number and filter opportunities by owner, status and expected close date.
Data quality and duplicate control
The CRM shall validate mandatory fields and identify potential duplicate accounts and contacts during creation or import.
Acceptance: The system prevents saving a record without configured mandatory fields and flags a test account matching an existing account by name or customer number.
History and audit trail
The CRM shall retain a history of material changes to customer, lead, opportunity, quote and visit records, including user and timestamp.
Acceptance: After changing a test quote status, an authorised administrator can see the previous value, new value, user and timestamp in the audit history.
Privacy and retention controls
The CRM shall support configured retention, anonymisation or deletion rules for personal data and shall allow authorised users to retrieve records relating to a data subject.
Acceptance: An administrator can execute a documented test data-subject export and apply the configured anonymisation or deletion process, with an audit record of the action.
Data export
The CRM shall allow authorised administrators to export CRM data and reports in commonly usable formats such as CSV or XLSX.
Acceptance: An authorised administrator can export accounts, contacts, leads and opportunities with the configured fields, while an unauthorised sales user cannot perform the same export.
4. Non-functional requirements
The CRM shall be suitable for daily use by the sales organisation and shall meet the following operational, security and quality requirements.
Performance
For the expected user and data volumes, normal page loads, searches and record saves shall complete within three seconds for at least 95% of requests, excluding ERP response time.
Acceptance: A performance test using the agreed production-like data volume records at least 95% of the specified transactions within three seconds.
Availability
The hosted CRM shall provide at least 99.5% monthly availability during agreed business hours, excluding notified maintenance windows.
Acceptance: The supplier provides monthly availability measurements and incident records demonstrating compliance during the first three months after go-live.
Security and access control
The CRM shall use encrypted connections, role-based access, strong authentication and protection against unauthorised access. Multi-factor authentication shall be enabled for administrators and supported for all users.
Acceptance: A security test confirms TLS-protected connections, enforced role restrictions, multi-factor authentication for administrators and automatic session expiry after the configured period.
Usability and mobile support
The CRM shall provide a responsive web interface or supported mobile application for current company smartphones and shall use consistent, understandable field names and error messages.
Acceptance: Representatives from all three locations can complete the agreed lead, quote and visit-report scenarios on a smartphone without desktop-only functions.
Backup and recovery
The service shall provide encrypted backups with a maximum recovery point objective of 24 hours and a maximum recovery time objective of eight business hours.
Acceptance: The supplier provides backup logs and completes a documented restoration test demonstrating the agreed recovery point and recovery time.
Operational monitoring and supportability
The service shall provide monitoring, error logging, interface monitoring and documented procedures for incident handling, maintenance and release management.
Acceptance: A test interface failure generates a monitored alert, and the supplier provides access to the agreed operational reports and support procedures.
5. Interfaces and data migration
The CRM shall integrate with the existing ERP for customer-related orders and invoices and shall provide an appropriate integration with Outlook for relevant emails and calendar activities. The ERP name, version and technical interface are not yet known (assumption).
Existing spreadsheets shall be inventoried, mapped and cleansed before migration. Relevant Outlook contacts and agreed customer communication shall be migrated or linked; a complete migration of all historical mailbox content is not assumed.
- The supplier shall document field mappings, ownership, synchronisation frequency, error handling and reconciliation for the ERP interface.
- Customer and contact data shall be migrated through at least one test migration followed by a controlled production migration.
- The migration shall identify duplicates, invalid mandatory fields and records without an assigned owner.
- The company shall approve the migration result against record counts and agreed sample records.
- The CRM should support an identity provider or single sign-on if available in the company environment (assumption).
6. Framework conditions
Personal data shall be processed in accordance with the GDPR and the company's data protection policies. The supplier shall provide a data processing agreement, a list of subprocessors, security documentation and support for data-subject rights.
Production data, backups and disaster-recovery copies shall be hosted and processed within the EU. Any transfer outside the EU requires prior written approval and a documented legal basis.
- The company shall define the purposes, legal bases, retention periods and deletion rules for CRM processing before go-live.
- Access shall follow least privilege, and administrator actions and relevant data changes shall be auditable.
- The supplier shall provide information about encryption at rest and in transit, vulnerability management, incident notification and penetration testing.
- If the CRM records individual employee activity, performance indicators, location information or other data that could monitor employees, the works council shall be consulted and any required co-determination completed before deployment.
- The solution shall not enable employee monitoring beyond agreed sales-process records without documented approval from the company, data protection officer and, where applicable, works council.
- The hosting contract shall define data ownership, data return, deletion after termination, service levels and exit support.
7. Volume and users
The initial user population is 40 sales representatives across three locations. Up to eight additional named users for sales management, administration and support are assumed, giving an initial total of 48 users (assumption).
For sizing and performance planning, the initial data volume is assumed to be 10,000 accounts, 25,000 contacts, 50,000 historical activities, 10,000 leads or opportunities and up to 5 GB of documents (assumption).
- All three locations shall be able to use the same central CRM tenant.
- The design shall allow at least 20% growth in users and annual data volume without a redesign (assumption).
- Smartphone access shall be available to all 40 sales representatives.
- The final user roles, concurrent-user estimate and data volumes shall be confirmed before contract award.
8. Scope of delivery
The implementation scope shall include requirements validation, solution configuration, integrations, data migration, testing, go-live support and handover to the company.
The supplier shall provide training and documentation suitable for sales representatives, sales management, administrators and support staff.
- Project planning, design workshops and a documented implementation plan.
- Configuration of accounts, contacts, leads, quotes, visits, tasks, reporting and roles.
- Implementation and testing of the ERP and agreed Outlook interfaces.
- Data cleansing support, test migration, production migration and migration reconciliation.
- User acceptance testing with representatives from all three locations.
- Role-specific training materials, administrator documentation and end-user guidance.
- Go-live support and a defined post-go-live support period.
- Service desk, incident priorities, response times and escalation paths documented in the support agreement.
9. Time frame and budget frame
A project duration of approximately six months from contract award to production go-live is assumed, including discovery, configuration, integration, migration, testing, training and a controlled rollout (assumption).
An implementation budget of EUR 150,000 to EUR 250,000 excluding VAT is assumed. Recurring licence, hosting, support and interface costs shall be quoted separately (assumption).
- Month 1: requirements confirmation, data assessment, security and solution design.
- Months 2 to 4: configuration, integrations, reporting and initial migration preparation.
- Month 5: test migration, system integration testing, user acceptance testing and training.
- Month 6: final migration, go-live and hypercare support.
- The final schedule shall include dependencies on ERP access, Outlook configuration, data cleansing and works council or data protection approvals.
10. Acceptance
Acceptance shall be based on successful completion of documented test cases covering all MUST requirements, the agreed migration, interfaces, security controls and operational procedures.
User acceptance testing shall include sales representatives from all three locations, at least one sales manager and a system administrator. The company shall issue written acceptance after critical defects have been resolved.
- All MUST functional and non-functional acceptance criteria are passed or have an agreed written workaround.
- The ERP interface and agreed Outlook functions pass end-to-end tests.
- Migrated record counts, mandatory fields, ownership and sample records reconcile with the approved migration results.
- No unresolved severity-one or severity-two defect remains at go-live.
- Training, administrator documentation, support contacts and operational handover documents have been delivered.
- A 30-day post-go-live review confirms agreed availability, incident handling and data quality measures.
To clarify before use
These points and assumptions are open in the example — your initiative needs to settle them.
- Which ERP product and version are used, and which technical interfaces and order or invoice fields are available?
- Which Outlook integration is required: email linking, calendar synchronisation, contact synchronisation, mailbox migration or another scope?
- What are the exact additional user groups, final user count, role model and expected number of concurrent users?
- What are the actual spreadsheet structures, customer and activity volumes, document volumes, data owners and data quality issues?
- Which smartphones, operating systems, mobile-device-management controls and offline capabilities must be supported?
- What are the legally approved purposes, retention periods, deletion rules and procedures for GDPR data-subject requests?
- Will the CRM record employee performance, location or activity data that requires works council co-determination?
- What are the approved target go-live date, recurring cost ceiling, support hours and required service levels?