A01-PWS_GUS Support TO1 v8_06182024.pdf

Performance Work Statement (PWS) Single-Family Housing Guaranteed Loan Program (SFHGLP) Guaranteed

Underwriting System (GUS) Support Indefinite Delivery Indefinite Quantity (IDIQ) Contract/Task Order #1

Guaranteed Underwriting System (GUS) Business to Government (B2G) Integration

As of 06/18/2024

I. DEFINITIONS/ACRONYMS:

ACRONYM/TERM DEFINITION

API Application Programming Interface ART Agile Release Train Assistant Chief Data Officer (ACDO)

The ACDO leads the Rural Development (RD) Mission Area data strategy and governance activities, and provides leadership by establishing consistency and governance in managing data across RD so that data can be more easily used and shared within proper security parameters; oversees centralized analytics teams and provides analytics capacity to address cross-cutting questions or issues within RD; enables program areas to conduct program-specific analytics with common tools; and ensures RDs alignment with the United States Department of Agriculture’s (USDA) data strategy.

Assistant Chief Information Officer

(ACIO)

RD’s ACIO coordinates with RD’s ACDO as counterparts in ensuring that the departmental vision is carried out at the Mission Area level and that business and technology requirements are met to support this vision.

ATO Authority to Operate CFR Code of Federal Regulations

CI/CD Continuous Integration/Continuous Development CIW Capital Investment Workbook CLIN Contract Line-Item Number Contracting Officer

(CO)

A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government.

A CO the is only individual who can legally bind the government only to the extent of the authority delegated.

Contracting Officer’s Representative (COR)

A representative from the requiring activity appointed in writing by the CO to perform surveillance and to act as liaison to the contractor. This individual has authority to provide technical direction to the Contractor if that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

COR Advisor A representative from the requiring activity appointed in writing by the CO to perform surveillance and to act as liaison to the Contractor. This

Page: 2 individual does NOT have authority to change the terms and conditions of the contract.

COTS Commercial off-the-Shelf (COTS) is software or hardware product that already exists in the commercial market and is available for sale to the public

CRM Customer Relations Management DC District of Columbia Delivery-order contract Federal Acquisition Regulations (FAR) Subsection 16.501-1 defines a delivery order contract as a contract for supplies that does not procure or specify a firm quantity of supplies (other than a minimum or maximum quantity) and that provides for the issuance of orders for the delivery of supplies during the period of the contract.

Deployment Software and administrative changes made in the Production environment.

DU Desktop Underwriter DevSecOps Development Security Operations DME Development, Modernization and Enhancement DOL Department of Labor Epic A container for a significant Solution development initiative that captures the more substantial investments that occur within a portfolio, which require the definition of a Minimum Viable Product (MVP) and approval by Lean Portfolio Management before implementation.

ERD Entity Relationship Diagram FA Functional Area FAR Federal Acquisition Regulations is the primary regulation for use by all executive agencies in their acquisition of supplies and services with appropriated funds. The FAR also contains standard solicitation provisions and contract clauses and the various agency FAR supplements.

Feature A service that fulfills a stakeholder need. Each feature includes a benefit hypothesis and acceptance criteria and is sized or split as necessary to be delivered by a single ART in a Program Increment (PI).

FedRAMP Federal Risk and Authorization Management Program. Provides a standardized approach to security authorizations for Cloud Service Offerings.

FISMA Federal Information Security Management Act of 2002 (FISMA).

FNMA Federal National Mortgage Agency, i.e., Fannie Mae FOC Fully Operational Capability GFE Government Furnished Equipment GUS Guaranteed Underwriting System.

Indefinite – Quantity Contract

FAR Section 16.504 defines an indefinite-quantity contract as a contract that provides for an indefinite quantity, within stated limits, of supplies or services to be furnished during a fixed period, with deliveries or performance to be scheduled by placing orders with the contractor.

Page: 3

HSPD-12 Homeland Security Presidential Directive 12 IDIQ Indefinite Delivery or Indefinite Quantity IDW Interactive Design Workshops. Workshops held between Software and solution Subject Matter Experts (SMEs) to align functionality.

iLAD Industry Loan Application Dataset. The iLAD is a compendium of data points and allows for the seamless exchange of loan application data between industry partners. It reduces friction and improves efficiency as originators can use this one resource rather than have to create their own proprietary exchange.

Intelligent Replacement

A GUS function allowing the upload of an updated Fannie Mae Desktop Underwriter (DU) MISMO 3.4 file (version 1.8.3, 1.8.4, and 1.8.5 xml files) into GUS without completely overwriting the existing GUS application. It will only update fields in the GUS database that have different values than the values contained in the uploaded file when a valid GUS ID is contained in the file. Thus, it does not delete any of the existing USDA proprietary data fields.

IPT Integrated Project Team Iteration Each iteration is a standard, fixed length timebox, where Agile Teams deliver incremental value in the form of working, tested software and systems. This PWS defines the duration of the timebox to be three weeks.

ITPM IT Program Manager LOS Loan Origination System.

MISMO Mortgage Industry Standards Maintenance Organization Minimal Viable Product (MVP)

The minimum capabilities a product will have to meet the Government’s objectives.

MO The State of Missouri NIST National Institute of Standards and Technology O&M Operations and Maintenance

Office of the Chief Information Officer

(OCIO)

An Office within the Office of Administration and Management at RD.

OCIO is responsible for providing state-of-the-art, reliable, and quality products, and services whenever and wherever needed with customer collaboration and teamwork. OCIO ensures that the products and services provided emanate from RD’ strategic goals and values. Additionally, OCIO provides proper resource alignment for the delivery of reliable and sustainable information services. Finally, OCIO ensures infrastructure services are readily accessible to all RD customers.

OMB Office of Management and Budget PBL Product Backlog POA&M Plan of Action & Milestones (pronounce PO-AM) PoP Period of Performance PDR Preliminary Design Review

Page: 4

Program Increment

(PI)

A Program Increment (PI) is a timeboxed planning interval during which an Agile Release Train plans and delivers incremental value in the form of working, tested software and solutions.

Also referred as Planning Interval in SAFe V 6.0.

PII Personally Identifiable Information Planning Interval See Program Increment (PI) PMO Procurement Management Office PO Product Owner POS Point of Sale system PPM Program and Project Management Performance Work Statement (PWS)

A statement of work for performance-based acquisitions that describes the required results in clear, specific, and objective terms with measurable outcomes.

Quality Assurance The government will evaluate the contractor’s performance under each Task order in accordance with the Quality Assurance Surveillance Plan (QASP).

This plan is primarily focused on what the Government will do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

Quality Assurance Surveillance Plan

(QASP)

An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance to assure services meets the requirements of the Performance Work Statement.

Quality Control Plan The contractor shall develop and maintain an effective quality control plan (QCP) to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s QCP is how it is assured that work complies with the requirement of the contract.

RTE The Release Train Engineer (RTE) is a servant leader and ART coach who facilitates ART events and processes and supports teams in delivering value.

Rural Development

(RD)

A USDA Mission Area committed to helping improve the economy and quality of life in rural America by offering loans, grants, and loan guarantees to help create jobs and support economic development and essential services such as housing; health care; first responder services and equipment; and water, electric and communications infrastructure.

Rural Development Technology Office

(RDTO)

Led by the RD Assistant Chief Information Officer, RDTO is responsible for developing, maintaining, and operating a portfolio of automated systems, and for providing technology-related services, in support of RD’s core businesses and back-office operations.

Rural Housing Services (RHS/ Agency)

A USDA RD sub-agency that offers a variety of programs to build or improve housing and essential community facilities in rural areas, by offering loans, grants and loan guarantees for single- and multi-family housing, childcare centers, fire and police stations, hospitals, libraries, nursing homes, schools, first responder vehicles and equipment, housing for farm laborers and much more.

Page: 5

SAFe Scaled Agile Framework. A knowledge base for adopting agile work methods in large organizations.

SDLC System Development Life Cycle methodology – mandatory use of RD’s SDLC methodology

SFH Single Family Housing Shall The word “shall” be denoted to mean a mandatory duty or obligation.

SCLS Service Contract Labor Standards SFHGLP Single-Family Housing Guaranteed Loan Program SME Subject Matter Expert SOP Standard Operating Procedure. A procedural document specific to your operation that describes the activities necessary to complete tasks in accordance with laws, regulations, instructions, or solution activities.

Sprint See iteration. Used interchangeably.

Task-order contract FAR Sebsection16.501-1 defines a task order contract as a contract for services that does not procure or specify a firm quantity of services (other than a minimum or maximum quantity) and that provides for the issuance of orders for the performance of tasks during the period of the contract.

TO Technology Office UAT User Acceptance Testing ULAD Uniform Loan Application Dataset URLA Uniform Residential Loan Application United States Department of Agriculture (USDA)

USDA provides leadership on food, agriculture, natural resources, rural development, nutrition, and related issues based on public policy, the best available science, and effective management. USDA’s vision is to provide economic opportunity through innovation, helping rural America to thrive;

to promote agriculture production that better nourishes Americans while also helping feed others throughout the world; and to preserve our Nation’s natural resources through conservation, restored forests, improved watersheds, and healthy private working lands.

USDA/ IT United States Department of Agriculture/ Information Technology XML Extensible Markup Language: documents written in XML are called XML documents, since XML is the file’s format.

II. GENERAL REQUIREMENTS:

1. Introduction:

The United States Department of Agriculture (USDA) Rural Development (RD) Single-Family Housing Guaranteed Loan Program (SFHGLP) is seeking analysis and development of a secure Business to Government (B2G) solution using the USDA Guaranteed Underwriting System (GUS) Specification to automate the transfer of application data via an API from a lender’s Loan Origination System (LOS) to RD for processing without entering the GUS. GUS, which deployed on March 1, 2021, updated from the legacy system for compliance with new standards and specifications.

2. Background:

Page: 6

The SFHGLP is administered by USDA RD. It addresses the requirements of Section 502(h) of the Housing Act of 1949, as amended, and includes policies regarding originating, servicing, holding, and liquidating SFHGLP loans. This no down payment, 100% financing program assists approved lenders in providing low- and moderate-income households the opportunity to own adequate, modest, decent, safe and sanitary dwellings as their primary residence in eligible rural areas. Eligible applicants may purchase existing homes (which may include costs to rehabilitate, improve or relocate the dwelling) or build new. USDA provides a loan note guarantee to approved lenders, encouraging participation by minimizing their risk. This program helps lenders work with low- and moderate-income families living in rural areas to make homeownership a reality.

Providing affordable homeownership opportunities promotes prosperity, which in turn creates thriving communities and improves the quality of life in rural areas.

GUS supports the new Uniform Residential Loan Application (URLA) (Freddie Mac Form 65 • Fannie Mae Form 1003). The SFHGLP Technical Handbook, HB-1-3555, provides Agency staff and lenders participating in the SFHGLP with the tools needed to originate, underwrite, and service guaranteed loans guarantees efficiently and effectively.

The functionality currently implemented in GUS gives lenders the ability to import the Fannie Mae Desktop Underwriter (DU) MISMO 3.4 version 1.8.3, version 1.8.4, and version 1.8.5 xml files into GUS or manually enter the URLA data directly into the GUS user interface (UI). USDA proprietary loan data must be manually entered into the GUS UI.

The B2G functionality will allow lenders the ability to send the URLA application data as well as the USDA proprietary data points (all of which are mapped to the MISMO 3.4 reference model) to the agency via a secure Application Programming Interface (API) from their Loan Origination Systems (LOS) without entering the GUS UI. Included in the effort is the development of ability to import the USDA GUS Specification via the GUS UI, including file import transformation logic, mapping, validations, etc. Lenders being able to completely process and underwrite loans from their systems is standard functionality in the mortgage industry, but due to cost of integration, some lenders may continue processing loans via the GUS UI, but may want the ability to import a USDA GUS specification file that includes the USDA proprietary data elements to help streamline the application process.

The USDA GUS Specification is intended to be used by USDA approved lenders and Loan Origination System (LOS) providers to collect the required data to support a USDA Loan Guarantee request. The USDA B2G Specification details the following request types, which can be submitted via an API once the required integration agreements have been signed and approved by USDA.

1. Property Eligibility

2. Income Eligibility

3. Property & Income Eligibility

4. Preliminary Underwriting

5. Final Underwriting

6. Systematic Alien Verification for Entitlements (SAVE)

7. Submit Application Documents

There are three additional request types available for the USDA GUS Application Programming

Page: 7

Interface (API) that are included with the System-to-System (S2S) request. These are referred to as Lender Services and include:

1. Release Control to Lender (by Lender Agent)

2. Withdraw Application

3. Recall Final Submission

2.1 Statutory authority, regulations, or policy affecting the overall requirement as applicable include but are not limited to:

• Clinger-Cohen Act (also known as the “Information Technology Management Reform Act of 1996”) (40 U.S.C. § 11101-11704);

• E-Government Act of 2002 (44 U.S.C. Chapters 35 and 36);

• Federal Information Security Modernization Act of 2014 (44 U.S.C. Chapter 35, Subchapter II);

• Federal Information Technology Acquisition Reform Act (FITARA) (Pub. L. 113-291);

• Paperwork Reduction Act (PRA) of 1980, as amended by the Paperwork Reduction Act of

1995 (44 U.S.C. Chapter 35);

• Privacy Act of 1974, as amended (5 U.S.C. § 552a);

• Digital Accountability and Transparency Act of 2014 (Pub. L. 113-101);

• Electronic Signatures in Global and National Commerce Act (E-Sign) (15 U.S.C. Chapter

96);

• Government Paperwork Elimination Act of 1998 (44 U.S.C. § 3504);

• Government Performance and Results Act (GPRA) of 1993, as amended by the

Government Performance and Results Modernization Act (GPRA Modernization Act) of 2010 (5 U.S.C. § 306 and 31 U.S.C. §§ 1115 et seq.);

• Office of Federal Procurement Policy Act (41 U.S.C. Chapter 7);

• Budget and Accounting Procedures Act of 1950, as amended (31 U.S.C. Chapter 11);

• Chief Financial Officers Act (31 U.S.C. § 3512 et seq.)

• USDA RD Resources, Directives, and Regulations: https://www.rd.usda.gov/resources

• USDA RD Single Family Housing Guaranteed Loan Program:

https://www.rd.usda.gov/programs-services/single-family-housing-programs/single-family-housing-guaranteed-loan-program

• USDA Cloud Computing: https://www.usda.gov/directives/dr-3650-001

• USDA Departmental Regulations, Notices, Manuals, and Secretary Memoranda:

https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories

• USDA Digital Strategy: https://www.usda.gov/digital-strategy

• CIO.gov Policies and Priorities: https://www.cio.gov/policies-and-priorities/

3. Type of Contract:

This Task Order shall be a Firm-Fixed Price (FFP) type of contract.

4. Non-personal and Not Inherently Governmental Services All services requested under this acquisition and PWS are non-personal and not inherently governmental in nature.

5. Place(s) of Performance The Contactor shall perform the requirements of this contract at the authorized Government work locations unless otherwise specifically stated in this PWS. The current work locations are:

https://www.rd.usda.gov/resources https://www.rd.usda.gov/programs-services/single-family-housing-programs/single-family-housing-guaranteed-loan-program https://www.rd.usda.gov/programs-services/single-family-housing-programs/single-family-housing-guaranteed-loan-program https://www.usda.gov/directives/dr-3650-001 https://www.ocio.usda.gov/policy-directives-records-forms/directives-categories https://www.usda.gov/digital-strategy https://www.cio.gov/policies-and-priorities/

Page: 8

i) Customer Site Location (remote/virtual)

Changes in Authorized Work Locations Work locations are subject to change when it is advantageous to the Government to eliminate or add a work location or change work locations to remote. Shall a change occur, the contractor will be notified in writing by the CO. Should the Contractor decide to relocate existing employees due to a change, employee relocation will be done at no cost to the government.

The Contractor may propose contractor work locations in addition to those identified in Places of Performance when it is advantageous to the government. This includes contractor employee telework locations during specified periods when the government facilities are closed due to weather and other emergency situations and/or when government facilities are unavailable due to other events making a government facility uninhabitable. The alternate work locations will be coordinated with the COR in advance and shall be at no additional cost to the government.

The Contractor shall ensure all government furnished equipment (GFE) assigned to individual employees are safely and securely operated and maintained regardless of the location where the work is performed.

Note: USDA expects to have a mixed (virtual/in person) federal workforce but does not expect any contractors to perform work onsite at government locations unless requested to attend in-person meeting, which would be infrequent.

6. Days and Hours of Performance

The Contractor is required to be available on non-government holidays from 8:00 am EST until 6:00 pm EST, Monday through Friday to correspond with USDA RD’s point of contacts, such as the Contracting Office, Contracting Officer’s Representative, and the Program/Technical Office.

The Contractor is required to provide emergency phone numbers, along with regular contact phone numbers and email addresses.

Federal Holiday Schedule New Year’s Day Martin Luther King, Jr. Birthday Washington’s Birthday Memorial Day Juneteenth National Independence Day Labor Day Columbus Day Veterans Day Thanksgiving Day Christmas Day

Page: 9

7. Performance Period or Delivery Date

The period of performance is for a period of 12-Months following award and is broken out as follows:

Activity Start Duration Transition In (On-boarding) Contract Award Date 4 weeks PI 1 No later than 1 Month after

Contract Award 9 weeks

PI 2-4 Immediately after previous PI 39 weeks Transition Out (Optional) 30 days prior to the end of PI 4

4 weeks

8. Kickoff Meeting Upon contract award, within 5 business days of award, Contractor shall initiate work on this contract by meeting with the ITPM, CO, COR, USDA SFHGLP representatives and key government representatives to ensure a common understanding of the requirements, expectations, and ultimate end products.

Contractor shall discuss the overall understanding of the initial and overall projects and review the background information and materials provided by the government. Discussions will also include the scope of work, deliverables to be produced, how the efforts will be organized, and project conducted, assumptions made/expected and results. A concerted effort shall be made to gain a thorough understanding of the government USDA RD expectations. However, nothing discussed in this or in any subsequent meeting(s) or discussions between the government and Offeror shall be construed as adding, deleting, or modifying any IDIQ Task Order requirements, including deliverable specifications and due dates. Any additions, deletions, or modifications to this Task Order requirement must be approved by the CO.

9. Travel:

Travel will not be provided under the IDIQ or any associated Task Orders.

10. Government-furnished Property, Equipment, and/or services

The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to provide support as defined in this Performance Work Statement (PWS) except for those items specified below as government furnished property and services:

• Laptops – Receipt of government issued laptops are contingent upon Contractor employees passing Suitability Requirements.

• PIV Card – A USDA Personal Identity Verification (PIV) card, which contains the necessary data for the cardholder to be granted to Federal facilities and information systems and assure appropriate levels of security for all applicable Federal applications will need to be obtained by Contractor employees. The COR will work with Contractor to obtain PIV cards for Contractor’s employees.

• Workspace and utilities shall be provided at USDA’s if applicable.

a) USDA Rural Development 1400 Independence Ave Washington, D.C. 20250

b) USDA Rural Development, 211 North Broadway, Suite 1701, St. Louis, MO 63102

Page: 10

c) Other government offices as required under acquisition work performance

11. Identification of Contractor Employees All contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. When performing work outlined in this PWS while in USDA facilities or RDs sites, Contractor employees are required to wear a federal government-issued personal identification card.

12. Non-Disclosure and Confidentiality

The work to be performed under this acquisition and the data released to the Contractor’s personnel shall be treated as sensitive and confidential in nature and is not to be discussed with or released to anyone except USDA employees assigned to work with the contractor and other contractor personnel working on this acquisition. The Contractor is responsible for requiring all its employees working under this acquisition, who have access to privileged information, to sign the USDA Non-Disclosure Agreement, provided as an attachment to the solicitation and contract.

USDA, as it deems appropriate, may require additional certifications be completed by the contractor at any time during acquisition performance.

The Contractor is required to develop and utilize procedures for custody, use/handling, reproduction, preservation, storage, safeguarding, and disposition of all documents and information of this nature so that there is no unauthorized disclosure of such documents and information throughout the course of performance. The Contractor shall be responsible for the security of all project documents provided to them for work under this acquisition. It is essential that this information be properly handled, stored, and protected from the risk and magnitude of loss or harm that could result from inadvertent or deliberate disclosure, alteration or destruction.

The Contractor shall protect and not disclose any PII.

Contractor-generated preliminary and final deliverables, all associated working papers, and other material RD deems relevant in the performance of this acquisition are the property of the U.S.

Government and must be submitted to the CO by the conclusion of this acquisition and shall not be reproduced or retained by the Contractor. The Contractor shall not release any information without the written consent of the CO.

When no longer required, this information, data, or equipment shall be returned to Government control; destroyed; or held until otherwise directed by the CO. Items returned to the Government shall be hand carried or emailed to the CO or other designee. The Contractor shall destroy unneeded items by burning, shredding or any other method that precludes the reconstruction of the material.

The Contractor shall immediately notify the appropriate CO upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment.

This non-disclosure agreement does not bar disclosures to Congress or to an authorized official of an executive agency or the Department of Justice that are essential to reporting a substantial

Page: 11 violation of law and this Agreement does not prohibit disclosures which are required under order of a court of competent jurisdiction. These provisions are consistent with and do not supersede, conflict with, or otherwise alter the obligations, rights, or liabilities created by existing statutes or Executive orders relating to (1) classified information, (2) communications to Congress, (3) the reporting to an Inspector General of a violation of any law, rule, or regulation, or mismanagement, a gross waste of funds, an abuse of authority, or a substantial and specific danger to public health or safety, or (4) any other whistleblower protection. The definitions, requirements, obligations, rights, sanctions, and liabilities created by controlling Executive orders and statutory provisions are incorporated into this agreement and are controlling. These controlling Executive orders and statutory provisions include Executive Order No. 12958, as amended; Section 7211 of Title 5, United States Code (governing disclosures to Congress); Section 2302(b)(8) of Title 5, United States Code, as amended by the Whistleblower Protection Act (governing disclosures of illegality, waste, fraud, abuse or public health or safety threats); the Intelligence Identities Protection Act of 1982 (50 USC 3121 et seq.) (governing disclosures that could expose confidential Government agents); and the statutes which protect against disclosure that may compromise the national security, including Sections 641, 793, 794, 798, and 952 of Title 18, United States Code, and Section 4(b) of the Subversive Activities Act of 1950 (50 USC 783(b)).

Training. All Contractor employees assigned to this acquisition who create, work with or otherwise handle records are required to take USDA-provided records management training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

The contractor must ensure their employees (including subcontractor personnel) complete the training course(s) listed below in the frequency identified. The contractor must maintain records of course completion and provide them to the Contracting Officer or Contracting Officer Representative upon request.

Course Name Frequency (Once, Quarterly, Annually, etc.)

Method of Training

Length of Training

Completion Date

Understanding and Interrupting Unconscious

Bias

Annually AgLearn 90 minutes 90 days after assignment in AgLearn

Anti-Harassment Training:

Identifying and Preventing

Workplace Harassment

Annually AgLearn 60 minutes 90 days after assignment in AgLearn

Information Security Awareness

Annually AgLearn 60 minutes 1 year since last completion date

Page: 12

USDA Records Management

Annually AgLearn Or Paper- based

60 minutes 60 days after assignment

Section 508 Annually AgLearn 60 minutes 45 days after assignment

Proprietary Information In the event that performance of any work under this acquisition causes the Contractor to gain access to proprietary or confidential information of other firms/contractors, the Contractor is required to immediately execute Technology Exchange Agreements/Non-Disclosure Agreements with those firms/contractors, in order to protect the information from unauthorized use. The Contractor is required to refrain from using any such information for any purposes other than for which it was furnished. The Contractor must immediately provide the CO with a copy of any such agreements with original signatures affixed.

13. HSPD-12 Credentials Contractor personnel must complete necessary requirements to obtain HSPD‐12 credentials immediately upon beginning work on the contract. Failure to obtain HSPD‐12 credentials is grounds for removal/suspension of contractor personnel from the contract.

https://www.dhs.gov/homeland-security-presidential-directive-12

14. Contractor Personnel Security Requirements

• Information Technology Systems Requirements:

The Contractor shall establish and implement appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of sensitive Government information, data, and/or equipment.

The Contractor shall comply with IT systems security and/or privacy specifications set forth in Rural Development and USDA directives, policy, and procedures; the Computer Security Act of 1987; OMB Circular A-130; and the Federal Information Security Management Act of 2002

(FISMA).

The Contractor shall be responsible for assuring that each Contractor employee who requires routine unaccompanied physical access to a Federally controlled facility and/or unaccompanied access to a Federally controlled information system, including a Rural Development- issued computer, completes Computer Security Awareness training prior to performing any work under this contract.

The Contractor is required to maintain a listing of all individuals who have completed Computer Security Awareness training and submit this listing to the COR with a copy to the Contracting Officer within ten calendar days of an individual starting work on this contract.

Access Requirements https://www.dhs.gov/homeland-security-presidential-directive-12

Page: 13

Contractor Access to USDA’s Network/Systems. The Contractor shall require access to the USDA’s Network/Systems to perform work under the contract. The COR will oversee such access.

Information Assurance The Contractor shall protect and not disclose any PII. The term “PII,” as defined in OMB Memorandum M-07-1616 refers to information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important for an agency to recognize that non-PII can become PII whenever additional information is made publicly available – in any medium and from any source that, when combined with other available information, could be used to identify an individual.

15. Onboarding Process

The Contractor shall manage the onboarding of its staff for all Contractor personnel who have not yet been onboarded at USDA. Onboarding includes steps to obtain a USDA network and email account, complete training, initiate background investigations, and gain physical and logical access, which may include elevated privileges to the necessary development and test environments for the various systems to be enhanced.

A single Contractor Onboarding point of contact (POC) shall be designated by the Contractor that tracks the onboarding status of all Contractor personnel. The Contractor Onboarding POC shall be responsible for accurate and timely submission of all required USDA onboarding paperwork to the COR. The Contractor shall be responsible for tracking the status of all its staff’s onboarding activities and report the status at the staff level during onboarding status meetings. The Contractor shall include Onboarding Status for any staff with outstanding onboarding requests in the Weekly Status Report.

Additional information regarding the Onboarding process is addressed in the attachment “PWS

BACKGROUND INVESTIGATION REQUIREMENTS.”

Deliverable:

1. Inclusion of the following information in the Weekly Status Report:

1. All outstanding onboarding requests that need to be reviewed by the COR.

2. Contractor personnel who began the onboarding process in the last 7 days.

3. Report of Contractor personnel who completed the onboarding process in the last 7 days.

16. Contractor Personnel Staffing and Assignments

(1) Federal employees, contractors, subcontractors, experts, consultants, and paid/unpaid interns hired for work within the United States or its territories who require access to USDA Mission Areas, Agencies and Staff Offices or controlled facilities, Information Technology (IT) systems or security items or products, must be either U.S. citizens or Lawful Permanent Residents, also known as “green card” holders.”

(b)In the event that any of the key personnel named in the Contractor’s quotation, as accepted by the Government at award, are unable to perform because of death, illness, resignation from the

Page: 14

Contractor’s employ, dissolution of agreement, or other reasons, the Contractor shall submit within 24 hours to the CO/COR, detailed written explanations of the circumstances necessitating the proposed substitutions, complete resumes for the proposed substitutes, and any other information that the CO/COR deems pertinent to approve the substitution. No substitution is to be made without the prior written approval of the CO/COR. No increases in pricing will be allowed when substitutions are authorized by the Government.

(c) Personnel possessing unique technical specialties may be required for certain services related to the acquisition tasks. Such personnel shall have qualifications as required by the applicable tasks and approved by the CO/COR, which are appropriate to the nature of the services that will be provided.

(d) The CO will have the right to effect removals of any Contractor employees working under the awarded acquisition, if those employees are deemed not to possess the proper level of competence or abilities, or otherwise found to be unsuitable for work required. In such cases, the Contractor must promptly submit the names and any other information pertinent to approvals of substitutions if requested.

(e) Failure or delays by the Contractor in providing qualified personnel who meet the stated requirements of this acquisition, may be deemed sufficient reason by the COR to recommend termination for cause to the CO.

(f) The Contractor shall provide the CO with a primary and alternate administrative point of contact (POC) after award. One of these points of contact must be a Contract Executive. The Contractor shall notify USDA RD of any changes in contact information as expeditiously as possible.

17. Compliance with IT Security Policies:

• Information systems and system services provided to USDA by the Contractor must comply with the current USDA/ IT security and privacy policies as outlined in the Security and Privacy Requirements for Information Technology Procurements, and USDA Cyber Supply Chain Risk Management (C-SCRM) Contract Language. These are attached and incorporated into this contract.

18. Special Considerations

Contractor Collaboration: At the CO’s direction, the Contractor may be required to work in conjunction with other vendors. In addition, the Contractor may be required to meet and work with said other vendors regularly. However, it is expected that vendor collaboration working meetings would not be more frequent than twice a week at a duration of not more than 3 hours per meeting. These meetings may be obligatory to address project issues/concerns/improvements, etc.

Collaboration working meetings are in addition to the meetings listed in the deliverables table.

At the CO’s direction, the Contractor may be required to provide PMO ad hoc status reports in addition to any status reports in the deliverable table.

This authority shall not be delegated to any COR.

Meetings: Please be advised that most acquisition meetings are held in Microsoft TEAMS.

Page: 15

Meetings may be recorded for the contract file. The COR or CO is to set up meetings in TEAMS to facilitate meeting transcripts.

19. Organizational Conflict of Interest (OCI) Contractor and subcontractor personnel performing work under this acquisition may receive, have access to proprietary or information (e.g., cost/pricing, specifications, work statements, etc.) or perform services which may create a current or subsequent OCI as defined in FAR Subpart 9.5.

The Contractor shall notify the CO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the CO to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the CO and in the event the CO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the CO may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the CO and in the event the CO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the CO may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent acquisition requirements which may be affected by the OCI.

An example of preclusion of participation/bidding on a subsequent acquisition requirement may be the following scenario: Contractor One, per Contract One developed the architectural structure, strategic plan, etc. (aka PWS Tasks/Plan) for Requirement Two which will be competed in order to award Contract Two. Because of Contractor One created/wrote the PWS Tasks/Plan, Contractor One will be precluded from bidding on Requirement Two solicitation. Preclusion in this instance helps to ensure best value for the government while keeping a fair and unbiased acquisition competition environment.

20. DATA RIGHTS. The Government has unlimited rights to all documents/material produced under this Task Order. All documents and materials produced under this acquisition shall be Government-owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the Contractor without written permission from the Contracting Officer. This right does not abrogate any other Government rights.

USDA Visual Identity Guidelines All visual materials intended for release to the public, both electronic and printed, delivered in the performance of this contract, must wholly conform to the current USDA Rural Development Visual Identity Guidelines. See attachment, “USDA Visual Identity Guidelines.”

21. Constraints or Assumptions Contractor shall adhere to USDA Digital Strategy, US Web Design Standards, and Chief Information Officers Council (CIO.gov) policies and priorities.

22. Order of Precedence In the event of inconsistencies, between the Contractor’s proposal/quote and PWS, the required work specified in this PWS will take precedence over the Contractor’s proposal/quote.

Page: 16

23. Service Contract Labor Standards (SCLS) (formerly known as the Service Contract Act of

1965) applicability Contractors are to quote based on any wage determination that may be applicable per SCLS. It is the Contractor’s responsibility to review its employee roles that may be employed during administration of the ensuing contract and/or its tasks orders in context of the SCLS for potential labor categories covered under the SCLS.

This is not a labor hour contract. The contractor is to propose its own labor category mix based on the tasks included in this PWS.

Contractor awardee may want to contact its legal advisor to provide itself more information.

FAR 52.222-41 and FAR 52.222-43 are included as clauses in this acquisition that will carry over to the contract.

Wage determinations will be provided to the awardee based on the Contractor awardee’s proposed locations, as well as any updated ones as required per any exercised option.

The Contractor awardee is responsible for ensuring that its personnel subject to the SCLS meet or exceed the corresponding minimum wages established by the Department of Labor (DOL) for the corresponding region (State/county) in which the task order is performed.

USDA will not be liable for any increased costs due to the Contractor awardee’s failure to identify SCLS categories or failure to pay minimum wages established by DOL.

24. Attachments that are incorporated into this PWS

• 508 Compliance and Internet Protocol

• Baseline Security References

• Background Investigation Requirements

• USDA Cyber Supply Chain Risk Management (C-SCRM) Contract Language

• IT Security Privacy Language

• Conflict of Interest Disclosure Form-Contractor

• Defect Management -Acceptance and Defect Rubric

• Network Access Security Policy

• Web Content Accessibility Guidelines

• Non-Disclosure Agreement

• Privacy Contract Clauses

• Software Development Lifecycle (SDLC) Process Guide

• USDA Visual Identity Guidelines

• NIST Special Publications (SP) 800-204, Security Strategies for Microservices-based

Application Systems

• USDA GUS Specification_v3.0_Pre-Development

• NIST Special Publications (SP) 800-207, Zero Trust Architecture

III. SCOPE of Work I. General Scope

The Agency is seeking the continued modernization of the GUS system. Solutions shall deliver business-level functionality as defined in the High-Level Business Requirement attachment, comply with RD’s technical architecture, leverage RD’s Technical Landscape, and include evolving requirements using SAFe methodology for software development. These best practices include but are not limited to open-source code, human-centered design, and with an extensible infrastructure and robust communication between the product sponsor and the project team.

Page: 17

The Contractor shall develop in a Shared Salesforce Org and use BigPicture as required by the Master IDIQ contract.

This task order provides specific requirements for the Contractor to provide services for analysis, design, development, and implementation of the USDA Business to Government (B2G) specification into an electronic, web-based set of services using the RD GUS Specification to automate the transfer of application data via an API from a lender’s Loan Origination System (LOS) to RD systems for processing without entering the GUS UI. The solution shall include enhancements to the current B2G Intelligent Replacement functionality services using the Fannie Mae Desktop Underwriter (DU) MISMO 3.4 version 1.8.3, version 1.8.4, and version 1.8.5 xml files. Included in the effort is the development of ability to import the USDA GUS Specification via the GUS UI, including file import transformation logic, mapping, validations, etc.

Once implemented, the solution must enable end to end integration between a lender’s Loan Origination Systems (LOS) and the GUS system. The solution must provide capabilities for transmitting all MISMO Uniform Residential Loan Application (URLA) data to GUS, all required Loan Application supporting documents and agency specific data to GUS, as defined in the B2G specification. The solution must operate via a secure API using XML without accessing the GUS user interface.

The solution must validate the URLA XML transmission’s document, fields and data values for compliance with the B2G specification. If error free, then GUS will be updated. If errors are found, the system must return appropriate error message(s) as defined in the B2G specification. The solution must provide a bi-directional data exchange between a Lender’s LOS and GUS. The B2G solution shall follow the industry standards for MISMO XML and follow RD security and architectural design requirements.

Figure 1 - Interaction with GUS for Base Period

Page: 18

The selected contractor shall provide Focus Area (FA) support for the following FAs:

FA 1: Program and Project Management

FA 2: Development, Modernization and Enhancement (DME) FA 3: Subject Matter Expert (SME) FA 6: Training (OPTIONAL) FA 7: Transition-In FA 8: Transition-Out (OPTIONAL)

II. Requirements by Focus Area (FA) The Contractor shall perform all the following tasks:

FA 1: Program and Project Management The Contractor shall support the government portfolio management and software development program based on the latest Scaled Agile Framework (SAFe) principles to plan and execute program-wide value delivery for the government. The Contractor shall have scrum teams for each iteration that will operate around a Program Increment (PI). For each PI, the Contractor shall document how planning, requirement analysis (user story building), design, coding, testing, quality assurance, and documentation will all meet the Agencies definition of done.

USDA RD’s expectation is that the Contractor shall provide capacity to deliver planning and design outputs, a development environment, an installed product, or code base with accessibility by RD users via a web interface, configured with eAuthentication/Login.gov within the first PI.

The MuleSoft Anypoint GovCloud platform is RD’s integration platform used to interconnect applications and backend services as well as other infrastructure through Service Oriented Architecture (SOA) standards. This platform provides the integration layer for inter-process/intersystem data transfers and communication. It manages all API’s necessary for integration and transformations. The Contractor shall design, develop, test, and implement:

Program Management The Contractor shall provide the following program management activities:

• Enhance communication, share lessons learned, and facilitate rapid identification and mitigation of dependencies between various functional entities.

• Prepare and deliver weekly project status reports discussing action items, issues resolved, and updates on any risks realized and on risk mitigation progress.

• Prepare and deliver monthly status reports documenting deliverables and milestone status, risk and mitigation status, and a backlog burndown chart.

• Interact with Product Owners, Application Architecture Contractors, Enterprise Architecture Team, Technology Office Team, Project Management Branch, Security Team, and business owners to transform the User Stories contained in the Product Backlog into operational, test-driven developed code that is promotable to RD testing environments.

Agile Product Delivery

Page: 19

The Contractor must use an Agile development methodology based on principals identified in the Scaled Agile Framework (SAFe). The Contractor must plan and execute solution delivery. The Contractor shall:

• Perform a combination of collaboration, functioning software (code), and a demonstration of the work completed as the primary measure of progress.

• Perform continuous attention to technical excellence, continuous learning, and good design.

• Deliver functional capabilities (software) at pre-defined iterations and intervals within a phase of work or program increment.

• Participate in an active partnership with the Government team – Technology Office, Portfolio Office, SFH Guaranteed Loan Program staff, Procurement/Contracting, other Contractors, other Vendors and other personnel.

• Cooperate to co-create the best possible solution and…