Attachment 4-GUS B2G HLBR - FY 2023.pdf

Business to Government (B2G)

FY 2023

High Level Business Requirement

(HLBR)

Office of the Chief Information Officer Rural Development Washington, D.C.

June 21, 2023 Version 3.0

Business to Government (B2G)

HLBR

Version 2.0

Office of the Chief Information Officer Page 2 of 17

Revision History

Version

Implemented By

Revision Date

Approved By

Approval Date Description of Change

Office of the Chief Information Officer Page 3 of 17

Project Stakeholders

Name Title Role

Office of the Chief Information Officer Page 4 of 17

Requirements Document Approval The undersigned acknowledge that they have reviewed the High-Level Business Requirements (HLBR) Specification document for Business to Government (B2G) and agree with the information presented within this document. Changes to this Requirement Specification document will be coordinated with, and approved by, the undersigned, or their designated representatives.

Approver Name / Title Project Role Signature and Date

Office of the Chief Information Officer Page 5 of 17

Table of Contents Requirements Document Approval Table of Contents 1 Overview

1.1 Purpose

1.2 Background

1.3 Intended Audience

1.4 Scope

1.4.1 In Scope

1.4.2 Out of Scope

1.5 Assumptions

1.6 Constraints

1.7 Risks and Dependencies

1.7.1 Risks

1.7.2 Dependencies

1.8 Prioritization of Requirements

2 Business Features and High-Level Requirements

2.1 Requirements Type

2.1.1 General Requirements

2.1.2 Analysis Requirements

2.1.3 Documentation

2.1.4 Development

2.1.5 B2G Integration Guide for Lenders

2.1.6 Testing Requirements

2.1.7 Transition

2.1.8 Training

2.1.9 Reporting, Logs, Dashboards and Data Analytics Requirements

2.2 Interface Requirements

Appendix A – Acronyms, Terms and Definitions Appendix B – References

Office of the Chief Information Officer Page 6 of 17

1 Overview

1.1 Purpose

The purpose of this document is to define the business requirements for Business to Government development. The United States Department of Agriculture (USDA) Rural Development (RD) Single- Family Housing Guaranteed Loan Program (SFHGLP) is seeking analysis and development of a secure Business to Government (B2G) solution using the RD Guaranteed Underwriting System (GUS) Specification to automate the transfer of application data via an API from a lender’s loan origination system (LOS) to RD for processing without entering GUS.

1.2 Background

The SFHGLP is administered by USDA RD. It addresses the requirements of Section 502(h) of the Housing Act of 1949, as amended, and includes policies regarding originating, servicing, holding, and liquidating SFHGLP loans. This no down payment, 100% financing program assists approved lenders in providing low- and moderate-income households the opportunity to own adequate, modest, decent, safe and sanitary dwellings as their primary residence in eligible rural areas. Eligible applicants may purchase existing homes (which may include costs to rehabilitate, improve or relocate the dwelling) or build new.

USDA provides a loan note guarantee to approved lenders, encouraging participation by minimizing their risk. This program helps lenders work with low- and moderate-income families living in rural areas to make homeownership a reality. Providing affordable homeownership opportunities promotes prosperity, which in turn creates thriving communities and improves the quality of life in rural areas.

GUS2 supports the new Uniform Residential Loan Application (URLA). The SFHGLP Technical Handbook, HB-1-3555, provides Agency staff and lenders participating in the SFHGLP with the tools needed to originate, underwrite, and service loan guarantees efficiently and effectively.

Functionality implemented in GUS2 gives lenders the ability to import the Desktop Underwriter (DU), complies with the Uniform Residential Loan Application (URLA) version 3.4 form, and supports use of the Uniform Loan Application Dataset (ULAD) XML file to alleviate the need to manually map application data to the MISMO reference model. DU was specified by the Federal National Mortgage Association (FNMA – Fannie Mae), and URLA 3.4 by the Mortgage Industry Standards Maintenance Organization

(MISMO).

The Business to Government (B2G) functionality will allow lenders the ability to send the application data to the agency via a secure API from their Loan Origination Systems (LOS) without entering the GUS2 user interface (UI). Lenders being able to completely process and underwrite loans from their systems is standard functionality in the mortgage industry. USDA is the outlier.

Office of the Chief Information Officer Page 7 of 17

1.3 Intended Audience

This document is intended to be used by the decision-makers, IT Governance, IT Management, Investment Managers, Project Managers Architects, Security, QA, Operations and other stakeholders. These requirements will also be reviewed and approved by the Project Manager, Business Sponsor and Subject Matter Experts (SME).

1.4 Scope

The intent of this document is to identify the business requirements for the RD Business to Government (B2G) solution:

• IT Impact Analysis by Enterprise Architecture Team, which will include the following existing systems:

o Guaranteed Underwriting System (GUS2)

- Including the development of Business to Government (B2G) Application Programming

Interfaces (API) that will give lenders the ability to send application data to the agency via a secure API from their Loan Origination Systems (LOS) without entering the GUS2 user interface (UI).

o Application Authorization Security Management (AASM) o Imaging/Electronic Customer File (ECF) o Data Warehouse/Reporting

• An estimate Level of Effort (LOE) and cost for the initiative, which includes detailed requirements analysis, design, development, testing & implementation phases and intended Technology that will be used for the development.

1.4.1 In Scope

The contractor must analyze, design, develop and implement the USDA Business to Government (B2G) solution including B2G Intelligent Replacement functionality. This functionality will allow lenders the ability to send the Uniform Residential Loan Application (URLA) data, required documents and agency specific data to Guaranteed Underwriting System (GUS) via a secure API without accessing the GUS user interface. The URLA data will be validated and if no errors are found, GUS will be updated. If errors are found, the system will return appropriate error message(s). The solution will be a bi-directional data exchange between a Lender’s LOS and GUS. The B2G solution must follow the industry standards for MISMO XML and follow RD security and architectural design requirements.

Changes will include the following:

- Analysis for USDA GUS2 B2G solution and USDA GUS2 B2G intelligent replacement of the USDA GUS2 Specification in GUS.

- Documentation of the USDA GUS2 B2G solution, USDA GUS2 B2G intelligent replacement of the USDA GUS2 Specification in GUS2 and any other related documents

- Production of a USDA GUS2 B2G Integration Guide for Lenders/Vendors

Office of the Chief Information Officer Page 8 of 17

- Design and Development of the USDA GUS2 B2G solution, and B2G intelligent replacement of the USDA GUS2 Specification in GUS2.

- Support all system testing efforts with internal and external users and groups to include USDA RD teams, SFHGLP Lenders and other USDA Vendors

- Support all system training efforts with internal and external users and groups to include USDA

RD teams, SFHGLP Lenders and other USDA Vendors

- Implementation of USDA GUS2 B2G Solution

- Develop and execute a USDA GUS2 B2G O&M Transition plan and Warranty Period

- The GUS B2G Solution should be a secure and mutually authenticated connection that follows federal guidelines, must be easily maintained within the current environment or with minimal changes. The solution must be approved by RD Technology Office

- Support lenders as they integrate the new B2G web service (API).

1.4.2 Out of Scope

• N/A

1.5 Assumptions

- e-Authentication/Login.gov may be used.

- ECF changes will need to be completed as part of this project.

- Warehouse changes will be needed to be completed as part of this project.

- AASM change will be needed as part of this project.

- A secure API must be approved by the Technology Office Security Team.

- System must be scalable for future delegated authority changes.

1.6 Constraints

- Funding Risks and Dependencies

- Compliance with all federal and agency mandated directives associated with the security on API

1.7 Risks and Dependencies

1.7.1 Risks

- Internal RD Technology Office Project Schedule and available resources

Office of the Chief Information Officer Page 9 of 17

- Known security vulnerabilities due to existing outdated technology (AASM)

- Funding availability

- Security for API

- Transport Malfunction – disruption in the communications

1.7.2 Dependencies

- Internal RD Technology Office Project Schedule

- Changes in MISMO XML for the Uniform Residential Loan Application.

- Technology/Security for API

Availability of RD Salesforce Organization

Office of the Chief Information Officer Page 10 of 17

1.8 Prioritization of Requirements

Priority

Description

MUST Describes a requirement that must be satisfied in the final solution for the solution to be considered a success.

SHOULD Represents a high-priority item that should be included in the solution if it is possible. This is often a critical requirement but one which can be satisfied in other ways if strictly necessary.

COULD Describes a requirement which is considered desirable but not necessary. This will be included if time and resources permit.

WON’T Represents a requirement that stakeholders have agreed will not be implemented in a given release but may be considered for the future. (Note: occasionally the word "Would" is substituted for "Won't" to give a clearer understanding of this choice).

Table 1 – Prioritization of Requirements

Office of the Chief Information Officer Page 11 of 17

2 Business Features and High-Level Requirements

2.1 Requirements Type

2.1.1 General Requirements

2.1.1 General Requirements Priority Phase

2.1.1.1 The contractor must analyze, design, develop and implement a secure Business to Government (B2G) solution using the USDA Guaranteed Underwriting System (GUS2) Specification to automate the transfer of application data via an API from a lender’s loan origination system (LOS) to RD for processing without entering the GUS2. This functionality must also include Intelligent Replacement functionality and changes needed in GUS2. The solution will be a bi-directional data exchange between a Lender’s LOS and GUS. A finding report is part of the data exchange back to lenders. If errors are found, appropriate error messages must be sent back to the Lender.

Must 1

2.1.1.2 The contractor must analyze, design, develop and implement updates to import the USDA GUS Specification into GUS similar to the functionality for the DU V3.4 XML. The functionality must also include Intelligent Replacement functionality.

Must 2

2.1.1.3 The contractor should support updates to the external systems based on changes for B2G which includes the Application Authentication System Management (AASM), Electronic Case File (ECF), Guaranteed Underwriting System (GUS2), and RD Datawarehouse/Reporting.

Must 1

2.1.2 Analysis Requirements

2.1.2 Analysis Requirements Priority Phase

2.1.2.1 Analysis of GUS, current edits and validations, security requirements, architectural Design, current B2G specification and integration services to identify updates needed for the B2G solution (including intelligent replacement) of the USDA GUS Specification in GUS.

Analysis must include the following B2G requests:

1. Property Eligibility

2. Income Eligibility

3. Property & Income Eligibility

4. Preliminary Underwriting

Office of the Chief Information Officer Page 12 of 17

5. Final Underwriting

6. Systematic Alien Verification for Entitlements (SAVE)

7. Submit Application Documents

There are 3 additional request types available for USDA GUS API which is included with the S2S request. These are referred to as "Lender Services" and include:

1. Release Control to Lender (by Lender Agent)

2. Withdraw Application

3. Recall Final Submission

2.1.2.2 Analysis of AASM, current edits and validations, security requirements, architectural Design to identify changes needed to allow lenders to use the secure Business to Government (B2G) solution. Solution must include validation at the individual level from the Lender/Vendor

Must 1

2.1.2.3 Analysis of current upload process to ECF to identify changes needed to allow lenders to use the secure Business to Government (B2G) solution to upload documents into ECF.

Must 1

2.1.2.4 Analysis of current data warehouse loads from GUS2 to identify data changes needed when lenders use the secure Business to Government (B2G) solution. This should include changes needed to existing reports and a minimum of 3 new reports.

Must 1

2.1.2.5 Analysis to determine the requirements needed to verify Lender’s staff who initiated the B2G request has the approval for B2G.

Must 1

2.1.2.6 Analysis and design security needed for the B2G API solution.

Must be approved by the security and architecture teams.

2.1.3 Documentation

2.1.3 Documentation Priority Phase

2.1.3.1 Document Transformation logic Must 1

2.1.3.2 Update the USDA GUS Specification as needed for changes Must 1

2.1.3.3 Develop or update USDA RD’s Cybersecurity and Compliance required system documentation to include but not limited to Business Impact Assessment (BIA), Security Impact Assessments (SIA), Approval To Operate (ATO) boundary, Privacy Threshold Analysis (PTA), Privacy Impact Assessment (PIA) Application Security Profile (ASP), Configuration Management, Security Assessment & Authorization package, risk remediation plans and other documentation as required

Must 1

2.1.3.4 Update the Lender Manual Intake job aid Must 1

2.1.3.5 Update the Manual Loan Application Import job aid Must 1

2.1.3.6 Update the Employee Review job aid Must 1

Office of the Chief Information Officer Page 13 of 17

2.1.3.7 Create all required architecture documentation as determined by the Government, through each phase of the SDLC namely Architecture Definition documents – Analysis and Design Models that encompasses various architecture artifacts including the ER diagrams and other artifacts from the perspective of various stakeholder (Business, Data, Application, Technology). These artifacts are required prior to moving through each phase of SDLC with concurrence and approval from the Enterprise Architecture team

Must 1

2.1.3.8 Produce all the mandatory artifacts for all stage gate reviews to determine the approval/disapproval of a project to move to the next phase.

Must 1

2.1.3.9 Update the Salesforce UI system inventory. Must 1

2.1.3.10 Update the MuleSoft API inventory with relevant descriptions and details.

Must 1

2.1.3.11 Support the update documentation for the existing or develop documentation for a new Authority to Operate (ATO)

Must 1

2.1.3.12 Update crosswalk table in support of the USDA guaranteed specification and transformation logic

2.1.4 Development

2.1.4 Development Priority Phase

2.1.4.1 The contractor must complete the development of the B2G solution for the below request types. The development must include intelligent replacement functionality.

1. Property Eligibility

2. Income Eligibility

3. Property & Income Eligibility

4. Preliminary Underwriting

5. Final Underwriting

6. Systematic Alien Verification for Entitlements (SAVE)

7. Submit Application Documents

See attached specification: USDA GUS Specification_v3.0.0_Pre_Development.xlsx

Must 1

2.1.4.2 The contractor must complete the development of 3 additional request types available for USDA GUS API which do not require a MISMO v3.4 file format to be included with the S2S request.

These are referred to as "Lender Services" and include:

1. Release Control to Lender (by Lender Agent)

2. Withdraw Application

3. Recall Final Submission

Office of the Chief Information Officer Page 14 of 17

See attached specification: USDA GUS Specification_v3.0.0_Pre_Development.xlsx

2.1.4.3 The contractor must develop the capability to test B2G solution within USDA without lender engagement.

Must 1

2.1.4.4 The MuleSoft Anypoint GovCloud platform is RD’s integration platform used to interconnect applications and backend services as well as other infrastructure through Service Oriented Architecture (SOA) standards. This platform provides the integration layer for inter process / inter system data transfers and communication. It manages all API’s necessary for integration and transformations. The contractor must design, develop, test, and implement:

• New API’s necessary to implement the B2G design

• Modify and/or enhance existing API’s necessary to implement the B2G design

2.1.4.5 The contractor must complete the development changes for AASM based on approved requirements for B2G solution. This includes the development to verify Lender’s staff who initiated the B2G request has the approval for B2G.

Must 1

2.1.4.6 The contractor must support the development changes for ECF based on approved requirements for B2G solution.

Must 1

2.1.4.7 The contractor must support the development changes for warehouse/reporting changes based on approved requirements for B2G solution.

Must 1

2.1.4.8 The contractor must complete the development of the approved security and architectural design for the B2G API solution.

2.1.5 B2G Integration Guide for Lenders

2.1.5 B2G Integration Guide for Lenders Priority Phase

2.1.5.1 The contractor must complete the B2G Implementation guide for lenders to implement and build the data to send for the B2G API solution. This must include detailed security information needed by the lenders to use the API solution.

Must 1

2.1.6 Testing Requirements

2.1.6 Testing Requirements Priority Phase

2.1.6.1 The contractor must establish and maintain processes ensuring all deliverables are thoroughly validated and/or tested prior to delivery to the Government.

Must 1

2.1.6.2 The contractor must complete unit, functional, regression, end to end testing, and integration testing and provide the Government with the results of these test, except for unit tests.

Office of the Chief Information Officer Page 15 of 17

2.1.6.3 The contractor must work with the Government to develop test plans, test cases and test data sets including developing and modifying MISMO XML test files.

Must 1

2.1.6.4 The contractor must support the Government’s performance testing, security testing, 508-compliance testing, end to end testing, UAT, and pre-production testing.

Must 1

2.1.6.5 The contractor must remediate defects discovered during any test phase.

Must 1

2.1.6.6 The contractor must provide support for lender partner testing of the B2G solution including the intelligent replacement functionality.

2.1.7 Transition

2.1.7 Transition Requirements

Priority Phase

2.1.7.1 The contractor must transition all B2G development to Operations and Maintenance.

2.1.8 Training

2.1.8 Transition Requirements

2.1.8.1 The contractor must support all system training efforts with internal and external users and groups to include USDA RD teams, SFHGLP Lenders and other USDA Vendors.

2.1.9 Reporting, Logs, Dashboards and Data Analytics

Requirements

2.1.9 Reporting, Logs, Dashboards and Data Analytics

Requirements

Priority Phase

2.1.9.1 Solution must provide logs for operational tracking and audit purposes as well as some specific customized logs for the B2G solution.

2.1.9.2 Need a minimum of 5 new reports Must 1

Office of the Chief Information Officer Page 16 of 17

2.2 Interface Requirements

2.2 Interface Requirements

2.2.1 GUS2 must provide input validation procedures based on

business rules

Must 1

2.2.2 Role-based requirements for the B2G Solution Must 1

2.2.3 The solution must enable a RD-authenticated user with

appropriate roles & permission to use the B2G solution and import the USDA GUS Specification.

Appendix A – Acronyms, Terms and Definitions Acronyms and Terms Definitions AASM Application Authorization Security Management B2G Business to Government DA Delegated Authority ECF Electronic Customer File (system) HLBR High Level Business Requirements provide the supplier(s) and stakeholders with a definitive set of High-Level Business Requirements for the project and the business LOE Level of Effort NPAD Network Path and Application Description RD Rural Development SFHGLP Single Family Housing Guaranteed Loan Program

Office of the Chief Information Officer Page 17 of 17

Appendix B – References

Ref # Title Version #/Date Publisher

1 USDA GUS

Specification_v3.0_Pre_Devvelopment.xlsx

3.0/ August 26, 2022 RD

1.8 Prioritization of Requirements

2.2 Interface Requirements