The file's text, extracted by GovTribe without its formatting.
Request for Proposal (RFP) for Mortgage-Backed Securities Issuance & Bond Administration (MBSIBA) in support of The Government National Mortgage Association (Ginnie Mae)
| NCR Project Number: | ID11200023 | |
| Solicitation PIID: | | 47QFDA20K0027 |
| Question # |
| Section |
| Paragraph |
Number
| Page Number |
| Question/Comment |
| Government Response |
B
| B.4 |
| 6 |
| The second paragraph of section B.4 indicates that the final option period for the contract will be a nine (9) month period. However, Sections F.2 and M.4.d and the Pricing Schedule indicate that the final option period will be a six (6) month period. Please confirm whether this period will be six (6) or nine (9) months. |
| The final option period is six (6) months pursuant to FAR clause 52.217-9 Option to Extend the Term of the Contract. RFP Section B.2 [reference corrected] has been revised accordingly. |
Note: RFP Section M.4.d refers to the six (6) month option authorized pursuant to FAR clause 52.217-8 Option to Extend Services.
| 2 |
| B / L |
| B.4 / L.10.2 |
| 6 |
| The third paragraph of Section B.4 and the second paragraph of Section L.10.2 indicate that the offeror shall propose ceiling /maximum rates for T&M/LH task orders by completing Attachment R – Price Proposal Template (Tab 3 – T&M/LH Rates). However, the third tab of Attachment R is labelled “LH Pricing Schedule.” Please confirm that the “LH Pricing Schedule” tab is the tab that Offerors are to use to provide T&M/LH task order ceiling rates. |
| Offerors shall use the third tab of Attachment R to provide T&M/LH task order ceiling rates. The third tab has been re-labelled to read ‘T&M_LH Rates’. |
| 3 |
| C3.5(A) |
| C3.5(A) |
| 25 |
| Is the MBSIBA Contractor required to purchase a license for the TransformX tool? If so, for how long? |
| Yes, the MBSIBA Contractor will be required to purchase a license for TransformX. At this time, we anticipate a one-year license to aid Issuers in their transition from flat files to MISMO compliant files. |
| 4 |
| C.4.3.1 |
| (b)1 |
| 46 |
| For onboarding, will Ginnie Mae consider electronic ID proofing in place of in-person visits? |
| Yes, in the future Ginnie Mae will consider electronic ID proofing in place of in-person visits. However, in the short-term, we will continue to use in-person visits until Ginnie Mae acquires ID proofing services and implements the change. |
| 5 |
| C.4.3.1 |
| (c) |
| 47 |
| For onsite training, will Ginnie Mae consider virtual trainings in place of onsite trainings? |
| Yes, Ginnie Mae will consider and is currently working on the development of virtual training in place of onsite training. This will be reviewed annually. |
| 6 |
| C.4.3.2 |
| (f) |
| 54 |
| Where in the processing timeline will Ginnie Mae’s approval be provided, would this be prior to pool submission and to be obtained by the Issuer? |
| Issuers are required to submit single family and HMBS pools electronically. In the rare event of a paper single family pool, the MBSIBA Contractor shall obtain Ginnie Mae’s approval prior to processing. Some multifamily pools are submitted on paper and manually processed. Ginnie Mae will provide prior “blanket approval” for processing paper MF pools |
| 7 |
| C.4.4.6 |
| All |
| 77 |
| Will there be an established agreement form executed between Ginnie Mae and the contractor for these escrow accounts? |
| It is anticipated that each agreement will be negotiated and determined on a case-by-case basis between Ginnie Mae, the Contractor and the Issuer. |
| 8 |
| C.4.6.2 |
| C.4.6.2 |
| 84 |
| Until the data center migration completed, is the expectation is to support the environments at on-prim data center as well as AWS environments as part of O&M? The section C.4.6.2 O&M for Applications Used to Provide and Support MBSIBA Services talks about mainframe at MBSIBA location and remaining apps at AWS. Would the additional resources be part of O&M? |
| Please refer to C.4.1 Task One, Transition-In Services for transition information. The offeror may have a role in the transition of distributed applications to AWS. The incumbent will provide O&M Support for applications deployed on-prem at the current provider as well as distributed applications deployed in AWS during the transition-in period. The Offeror should account for all O&M of transitioned platforms and operations, post transition. |
| 9 |
| C.4.6.3 |
| (a) |
| 88 |
| Re: Help Desk number associated to this Centralized Help Desk number- Can this be an unpublished toll-free number? Must it be a local number? |
| The vendor must provide a local number. In regard to the Centralized Help Desk number, all toll-free numbers must point to (or ring to) a local number. Call forwarding from a toll-free number (TFN) to another toll-free number often does not work due to the cost structure of the toll-free numbering system. |
| 10 |
| B / D / I |
| B.4 / D.3 |
| 106 / 146 / 184 |
| Please confirm whether the proposed contract will involve access to classified information. We note that paragraph B.4 permits exceeding proposed ceiling rates in the event “special security clearance” is required; paragraph D.3 refers to shipping requirements for classified reports, data, and documentation; and FAR Clause 52.204-2, Security Requirements, which is applicable to the extent the contract involves access to classified information, is incorporated by reference in Section I. |
| No, the proposed contract will not involve access to classified information. RFP Sections B.2, D.3, and Section I FAR clause 52.204-2 have been amended accordingly. |
| 11 |
| C |
| C.4.7.1(i) |
| 120 |
| In section C.4.7.1 paragraph (i), it states “The Contractor must maintain multi-factor authentication for accessing the Ginnie Mae Enterprise Portal and systems.” Does this apply to the platform level and if so, is a risk acceptance allowed for platforms that cannot support two-factor authentication? |
| Yes, multi-factor authentication applies to the platform level. No, a risk acceptance is NOT allowed for platforms that cannot support multi-factor authentication. Two-factor authentication is NOT a consideration. |
NOTE = The implementation of multi-factor authentication was in response to a HUDOIG finding dating to 2009 and increased frequency of malicious attacks within industry. Ginnie Mae cannot revert from multi-factor to a lesser authentication method.
| 12 |
| C |
| C.4.7.1(m) |
| 121 |
| In Section C.4.7.1 paragraph (m), it states that “all” vulnerabilities must be resolved within 30 days. Should this state that critical and high vulnerabilities must be resolved within 30 days and medium vulnerabilities within 90 days, rather than “all.” |
| All vulnerabilities that are discovered during the vulnerability scans shall be remediated within 30 calendar days, or a remediation plan shall be presented to the Ginnie Mae CISO for approval. |
| 13 |
| C |
| C.4.7.3 |
| 121 |
| Which Infrastructure Security requirements in C.4.7.3 are applicable to the cloud datacenter environment versus the legacy datacenter environment? When are these requirements expected to be implemented? |
| The Offeror must meet all security requirements and provide all security services prior to receiving an ATO (Authority to Operate) for all offeror hosted applications and infrastructure. |
The Cloud Services Provider GSS controls will be provided by the Cloud Service Provider for all infrastructure hosted by/in the cloud environment and inherited by the MBSIBA provider. C.4.7.3 (e) provides information regarding services provided by the cloud provider.
The following items under C.4.7.3 will be provided by the cloud services provider for all infrastructure provided by the cloud provider: a, f, g, k, u, v, z.
The offeror must meet all application level controls/ requirements for applications deployed on the cloud services provider infrastructure prior to receiving an ATO for applications.
| 14 |
| I |
| N/A |
| 184 |
| Pursuant to FAR 4.1705(a), the clause at FAR 52.204-14 is not required to be included in indefinite delivery indefinite quantity type contracts. We ask that this clause be removed from the proposed contract. |
| The RFP has been amended to remove FAR clause 52.204-14 from Section I. |
| 15 |
| I |
| N/A |
| 185 |
| FAR clause 52.212-5 has been incorporated by reference. Please provide the clause in full text and indicate which clauses listed in paragraph (b) are applicable to this solicitation and proposed contract. |
| The RFP has been amended to provide FAR clause 52.212-5 in full text with the applicable paragraph (b) |
| 16 |
| I |
| N/A |
| 185 |
| Paragraph B.5 of the solicitation acknowledges that the basic labor categories contemplated for the proposed contract are considered bona fide executive, administrative, professional labor of the type generally exempt from the Service Labor Contract Standards and that no wage determinations are included in the solicitation. As such, the clauses at FAR 52.222-41, Service Contract Labor Standards, and 52.222-43, Fair Labor Standards Act and Service Contract Labor Standards – Price Adjustment (Multiple Year and Option Contracts), are inapplicable and should be removed from the proposed contract. |
| The RFP has been amended to remove FAR clauses 52.222-41 and 52.222-43 from Section I. |
| 17 |
| I |
| N/A |
| 185 |
| FAR clause 52.222-60, Paycheck Transparency (Executive Order 13673), has been removed from the FAR. We request that this clause be deleted from the solicitation and not included in the proposed contract. |
| The RFP has been amended to remove FAR clause 52.222-60 from Section I and the clause will not be included in the proposed contract. |
| 18 |
| I |
| N/A |
| 186 |
| The solicitation includes FAR clause 52.227-14, Rights in Data – General (Alt II), and FAR clause 52.227-17, Rights in Data Special Works. Pursuant to FAR 27.409(b)(1)(i), indicate which data is subject to FAR 52.227-14 and which data is subject to FAR 52.227-17. |
| Reference RFP Section H.12 for data that is subject to FAR clause 52.227-14. The RFP has been amended to delete FAR clause 52.227-17. |
| 19 |
| I |
| N/A |
| 186 |
| We ask that FAR clause 52.230-6 be deleted from the solicitation and not included in the proposed contract. Pursuant to FAR 9903.201-1(b)(6) and (b)(13), the Cost Accounting Standards are not applicable to acquisitions for commercial items or firm fixed price contracts awarded on the basis of adequate price competition. |
| The RFP has been amended to delete FAR clause 52.230-6 from Section I and the clause will not be included in the proposed contract. |
| 20 |
| I |
| N/A |
| 187 |
| The cover page of the solicitation indicates that the competition is for the procurement of a commercial item pursuant to FAR Part 12. FAR 52.244-6 is inapplicable to commercial item contracts and should be removed from the proposed contract. |
| The RFP has been amended to delete FAR clause 52.244-6 from Section I and the clause will not be included in the proposed contract. |
| 21 |
| I. |
| I.7 |
| 191 |
| HUDAR 2452.239-75, Access to HUD Facilities, has been included in the solicitation, however, it is not apparent from the PWS whether contractor personnel will require physical access to HUD facilities. Please confirm whether such physical access will be required. If not, we recommend removing this requirement from the solicitation and proposed contract. |
| Access to HUD Facilities is a required clause. |
| 22 |
| L |
| L.9.1.b |
| 206 |
| Are 11x17 foldout pages permitted? |
| 11x17 sheets can be used for fold outs such as charts that are not conducive to 8-1/2 x 11 sheets. Each 11x17 sheet will count as two (2) pages towards the various page counts. |
| 23 |
| L.9.1 |
| L.9.1.b |
| 206 |
| Should Offerors customize Orals Presentation PowerPoint slides for 8.5 x 11 Landscape Letter size? |
| Yes. |
| 24 |
| L |
| L.11.3 |
| 212 |
| Confirm whether any page limits are intended to apply when CPARS information is available and must be used for a selected past performance relevant experience project. That is, is the required CPARS information included in the 30-double-sided / 60 single-sided page limit for the Written Technical Proposal? |
| CPARS information is included in the Written Technical Proposal page limit and must not exceed 3 double sided pages or 6 pages total per task/project. |
| 25 |
| L |
| L.12.3 |
| 214 |
| The RFP states “Attendance at the presentation and the subsequent oral Q&A session shall be limited to the Offeror’s Key Personnel. . . ” and then goes on the define Key Personnel by stating “An Offeror’s Key Personnel includes only those persons who will be assigned to the contract as Key Personnel as described in Section H.5 and including additional proposed Key Personnel.” Section H.5 describes six specific Key Personnel roles and does not mention “additional proposed Key Personnel.” May an Offeror propose Key Personnel in addition to the six specified roles? |
| The RFP has been amended to allow additional Key Personnel to be proposed to augment the Key Personnel specified in H.5. Any additional Key Personnel proposed will not be evaluated favorably or unfavorably or impact the rating. |
| 26 |
| M |
| M.5 |
| 221-225 |
| The Solicitation indicates that Factor 1 will be evaluated on a Pass/Fail basis. No other clear evaluation criteria are specified for Factors 2-5. Will the government apply adjectival factors (i.e., outstanding, good, acceptable, unacceptable) or other rating scale to the criteria specified in Evaluation Factors 2-5? |
| Adjectival ratings (excellent, good, acceptable, unacceptable) will be applied to the criteria for Factors 2 – 5. |
| 27 |
| M |
| M.5.5 |
| 224 |
| Will subparagraph (a) and (b) be separately evaluated? If so, based on what factors or rating scale? |
| Subparagraphs (a) and (b) are not subfactors and will not be individually rated but will be evaluated as a whole to arrive at the factor-level rating. |
| 28 |
| ATTACH-MENT E |
| n/a |
| 264 |
| Regarding PERFORMANCE MEASURES AND SLAS FOR TASK #7: SYSTEM SECURITY REQUIREMENTS: |
1. In general, is the Description text referring to the time to resolve issues where the named Service is not operating?
1. Are the SLO meant to track the time to resolve an incident detected by the named Service?
The “Expected Service Level (SLO)” is the amount of time that the vendor has to resolve an incident when the named "Service" is not operating. The “Description” text explains the "Maximum Time before resolving" and what type of incident must be resolved in that amount of time. For example, an intrusion protection incident must be resolved within 1 hour.
| 29 |
| C4.8 |
| Task 8 |
| 129-130 |
| We note that the SOC 2 “shall be conducted by issuance of a separate delivery order under this contract when the date, scope and periods of the test can be determined.” In order to determine a price for the SOC 2, we will need to make a number of assumptions concerning the timing and scope. Once final date, scope, and periods are ultimately determined, if they vary from assumptions, will the Contractor be given the opportunity to adjust the price? |
| The SOC 2 scope will cover all of the business applications, data bases, mainframe and other IT environments described in the RFP. The period will run from Oct 1 which is beginning of Government FY through June 30. Vendor should plan for and include a readiness assessment to drive scoping decisions, including the Trust Services Criteria categories to be included other than Security (which is required for all SOC 2 engagements), reporting period, timing, etc. Upon completion of the review, any changes in price may be made by mutual written agreement of the parties in accordance with the terms and conditions of the contract. |
| 30 |
| Attachment R, Price Proposal Template |
| The number of hours shown on tab 'LH Pricing Schedule' of Attachment R is the same for each period whether it’s the 18-month Base, 12-month Options, or 6-month transition period. Please confirm that these hours are correct for pricing evaluation purposes. |
| Yes, the numbers of hours are correct for price evaluation purposes. |
| 11 |
| What is the headcount of the technology team at BNYM currently supporting this product? |
| Information regarding the current project staffing plan is not available for release. |
| 11 |
| Approximately how many scripts are part of the mainframe environment? |
| With the mainframe there is a high level of automation. There are numerous Java, ETLs and Linux scripts. Job Control Language is transferable and will be provided. |
| 11 |
| How many external parties will need access to Ginnie Mae mainframe environment? |
| Ginnie Mae and the MBSIBA are the only parties that currently require mainframe access. The approximate number of Ginnie Mae users is 45, a combination of Account Executives and Operations team. |
| 12 |
| Would it be possible to obtain additional documentation relating to the MBSIBA Mainframe systems? The Reading Room documentation was limited on this topic. |
| This will be provided during fit gap analysis and the discovery phase during transition-in. |
| 16 |
| What is the technology stack of the applications that will run in AWS? |
| RFP Section C.3.5 provides a description and breakdown of applications that will run in AWS. |
| 16 |
| Are there any applications in the environment whose technology stack has been deprecated or a portion of it deprecated? |
| No. The current applications as annotated in Section C.3.5 have not be deprecated or a portion of the applications deprecated. Ginnie Mae is in the process of application modernization. |
| 16 |
| Please provide the mainframe LPAR size. |
| Ginnie Mae has a segregated LPAR that runs on a larger IBM system complex (IBM z10). Mainframe size is usually measured in MIPS. We currently run at an average of 229 MIPS. |
| 16 |
| Please provide estimated transaction volume per mainframe application. / Average daily number of online (not batch) queries to and replies from the mainframe. |
| For the transaction counts, we average 37,678 CICS transactions executed each day in our LPAR. Additional information will be provided during fit gap analysis and the discovery phase during transition-in. |
| 16 |
| Which of the following common mainframe applications are in active use in the environment: z/OS, MVS, VSE, CICS, IMS, Assembler, JCL, COBOL, Natural, FORTRAN, PL/I, and REXX. Are there also other, more proprietary applications in use? |
| Active applications include z/OS, MVS, CICS, IMS, Assembler, JCL, COBOL, FORTRAN, NDM, Informatica and PL/I. |
| 16 |
| Please provide detailed design information on the IPMS DB2 installation, including Table descriptions, record counts, configuration parameters and all monthly, quarterly and annual procedures used to maintain and archive the data for IPMS. |
| See answer in #34. |
| 16 |
| Please provide all security documentation for IPMS, including system security plans, security assessments, IT contingency plans and privacy impact assessments. |
| Please see the reading room document IPMS ATO Sanitized, in folder 08 – ATO Packages CL, subfolder PPA, subfolder IMPS. The following plans are available in this document: |
1. Incident Response Plan (page 1)
1. Configuration Management Plan (page 32)
1. Continuous Monitoring Program Plan (page 45)
1. Business Impact Analysis (page 56)
1. E Authentication Risk Assessment (page 64)
1. Federal Information Processing Publication 199 System Categorization (page 72)
1. Information System Contingency Plan (page 80)
1. Privacy and Civil Liberties Impact Assessment (page 127)
1. Privacy Threshold Analysis (page 168)
1. Systems Security Plan (page 180)
| 16 |
| Please provide a complete hardware inventory for IPMS including CPU speed, MIPS, DASD sizes, amount of memory, operating system and version and all patch information. |
| IPMS runs on IBM’s z/OS 2.1 Operating System, CICS 5.3, and DB2 v11. We currently run at an average of 229 MIPS. Additional information will be provided during fit gap analysis and the discovery phase during transition-in. |
| 16 |
| Please provide an inventory and architecture diagram of all networking components used to support IPMS, including routers, switches, hubs, firewalls, CSU/DSU that are directly or indirectly used to support IPMS and the related operational functions performed on Ginnie Mae's behalf for the functions described in the RFP. |
| This information is available in the ATO documentation for what we have on inventory for IPMS. High level network diagrams are available in the reading room. Please see folder 08 – ATO Packages CL, subfolder PPA, subfolder IMPS, file IPMS ATO Sanitized. |
We will not provide a complete inventory of all networking components until transition-in.
| 16 |
| What communication links will the contractor be responsible for procuring and establishing? / How many dedicated WAN links are required between the mainframe data center and Ginnie Mae’s cloud data center(s). What is the bandwidth required for each WAN link? What are the locations of the Ginnie Mae cloud data center WAN termination points? |
| See connectivity requirements outlined in Section C.3.3 Hosting Services for WAN and connectivity information. |
| 16 |
| Please provide the data archival requirements for IPMS, including frequency and data volumes for IPMS. |
| The vendor must follow Ginnie Mae’s data retention policy. See Data Retention information provided in the reading room. Please see folder 08 – ATO Packages CL, subfolder PPA, subfolder IMPS, file IPMS ATO Sanitized. |
The vendor needs to have a backup strategy to be able to retrieve and recover 100 percent of production data.
| 17 |
| Please provide monthly and daily CPU utilization, I/O rates, and storage utilization reports for the current mainframe environment depicting the IPMS usage and operational characteristics. |
| See answer in #34. |
| 17 |
| Please provide all system documentation for the IPMS, including detailed design specifications, architecture diagrams, data flows, Interface descriptions and schedules, report specifications and operational manuals. |
| See answer in #34. |
| 17 |
| Please provide sizing parameters for IPMS-Pool Reporting Module - no. of screens, no. of batches, no. & size of tables/files, etc. Please provide the data storage file types (e.g. DB2, VSAM, Oracle) and number of those tables. |
| Ginnie Mae utilizes DB2, VSAM and Oracle. |
All database information is provided in Folder #10 Database Information CL. Subfolder Database Report, files Batch Jobs and LDM-OLTP Pool.
| 17 |
| Please provide interface details for IPMS-Pool Reporting Module-Pool Reporting Module - no. of interfaces, interface type (file, synchronous calls, asynchronous calls, etc.), data transfer volumes. |
| See answer in #34. |
| 17 |
| Please provide usage parameters (average & peak levels) for IPMS-Pool Reporting Module - transactions per day, concurrent users, response times. |
| See answer in #34. |
| 17 |
| Are there any known performance related issues with IPMS-Pool Reporting Module-Pool Reporting Module - such as online response times, batch processing windows, etc.? |
| Currently, there are no known performance issues. |
| 17 |
| Please provide a list of any known environment/design/architectural issues that make it difficult to extend/enhance IPMS-Pool Reporting Module. |
| Currently, there are no known environment/design/architectural issues. |
| 17 |
| Please provide a list of third-party software licenses that are required for IPMS-Pool Reporting Module. Also mention the estimated annual licensing cost and indicate whether these licenses are transferable. |
| Ginnie Mae will provide third-party software licences for the software listed on page 170 of the RFP. All other third-party software is to be provided by the Contractor. |
| 30 |
| There is a 500-hour threshold for maintenance/ enhancements. Is there a limit to the number of maintenance items/ enhancements within a given time period or is there a limit of hours within a given period? |
| On average, Ginnie Mae undertakes six Minor Enhancements to applications per month not to exceed 25 per quarter as noted in the RFP. |
| 30 |
| How many new features have been requested within the last two years? What is the average number of development hours required for these annually? |
| Ginnie Mae may introduce new features as part of a minor or major enhancement. The number of enhancements varies from year to year within the averages already provided in the RFP. The average number of development hours varies and must not exceed the established price ceiling. |
| 30 |
| What is the annual run rate for 500 hr maintenance / enhancement items? |
| See answer to #54. |
| 31 |
| Please confirm that Ginnie Mae would like the MBSIBA contractor to provide a Mainframe hosting environment (as opposed to providing Mainframe modernization). |
| Yes, Ginnie Mae requires a mainframe hosting environment. |
| 31 |
| Are there any additional compliance or regulatory requirements/expectations not specifically stated within the RFP? Examples include but are not limited to Regulatory Filings, Reporting, and Regular Federal Agency Examinations/Audits. |
| At this time, we are not aware of any additional regulatory or reporting requirements other than those already specified in the RFP. |
| 31 |
| What are the technical programming languages used in existing mainframe applications? (COBOL, PL/SQL, Others?) |
| See answer to #39. |
| 31 |
| What would be the estimated amount of code in each of these languages, per application? Can Ginnie Mae provide an inventory report of the languages used and details on language, Source Lines of Code (SLOC), comments, database elements, columns and other artifacts such as screens, externals, etc. |
| See answer to #34. |
| 31 |
| Please provide an estimate of the number of lines of code for each of the programming languages used? |
| For the entire mainframe/IPMS there is less than 5,000 lines of code. |
| 31 |
| What kind of database is used to host the existing mainframe applications? Please provide database version number as well and the estimated numbers of DBs, columns, elements, flat files (VSAM, QSAM, ISAM). |
| Ginnie Mae uses Oracle DB2 with VSAM flat files. See the reading room folder 02-MBSIBA Procedures, subfolder MBSIBA Industry Day Presentation, slide #105. |
| 31 |
| Do the mainframe applications have screens (user interface)? (CICS, BMS, MFS, etc.) If yes, please provide the number of screens per application. |
| A typical Ginnie Mae user can access approximately 40 IPMS mainframe “inquiry” screens. The mainframe contains other “processing” screens which Ginnie Mae cannot access. |
| 31 |
| Which of the existing mainframe applications make external data calls? What kinds of interfaces are utilized for these calls? MQ, FTP, other apps? |
| The mainframe pushes SFTP files to MERS. There are various internal file transfers to interfaces with the FedWire system and Automated Clearing House. |
| 31 |
| For application that has external data calls, will these connections/interfaces undergo any change post migration? |
| Ginnie Mae’s modernization strategy will likely require some changes, but the details of these changes have not yet been defined. |
| 31 |
| What kind of transport connectivity is utilized for each of these mainframe applications? (Bandwidth, IP protocols, Storage connectivity) / This is for the LAN. |
| The current LAN connectivity is typically 1Gbps access port from the mainframe to the network and 10Gbps connection for backup and data replication and currently there are no known congestion issues with this network connectivity |
| 31 |
| What technical programming language should be used to migrate the existing mainframe applications to? Java, C#, C++, others? |
| The migration of the mainframe applications should be a done like-for-like. |
| 31 |
| What type/version of database will be utilized as the target environment of the applications after migration? |
| The migration of applications should be a done like-for-like. |
| 31 |
| What is the desired target UI? Like-for-Like web-based screens or modernized? Terminal emulators? New reengineered UI? What changes are expected at the UI level for all the applications upon migration? (do workflows or functionality have to be changed?) |
| The migration of applications should be a done like-for-like. |
| 31 |
| Does Ginnie Mae already have a draft or finalized requirements list for the mainframe application migration module? Or, is the contractor expected to capture these upon award? |
| The mainframe migration requirements will be crafted and implemented during the transition-in period. |
| 31 |
| Does Ginnie Mae have up-to-date documentation on existing mainframe application source code? Or, is the contractor expected to create them prior to migration? |
| See answer to #34. |
| 31 |
| Does Ginnie Mae require the contractor to update/create legacy documentation on the existing mainframe applications upon award? |
Is there any current documentation beyond what is provided in the reading room?
During the transition-in period vendors may be required to update and create additional documentation.
| 31 |
| Will the contractor be responsible for creating an Enterprise Architecture Design for the mainframe migration? Is there a desired target stack or reference architecture? |
| The migration of the mainframe applications should be a done like-for-like. |
| 31 |
| What is Ginnie Mae's plan for mainframe database conversion? What is the desired target? |
| The migration of the mainframe applications should be a done like-for-like. |
| 31 |
| Are refactoring services desired? For example: code-consolidation, externalizing functionality, introduction of RESTful layers, micro-services, containerization. |
| No. |
| 31 |
| Is there any additional support needed over the go-live or post-modernization? |
| Once the transition-in is complete, the vendor will provide ongoing O&M services for both the mainframe and applications hosted at AWS. |
| 31 |
| Is code documentation desired? |
| Ginnie Mae requires all code to be documented for any changes to legacy or existing platforms. |
| 31 |
| As per our understanding, Ginnie Mae would like to migrate all mainframe applications into AWS. Is this correct? |
| No, Ginnie Mae does not intend to migrate mainframe applications to AWS. |
| 31 |
| Which team/contractor will be responsible for testing the migrated applications? |
| The new awardee will be responsible for testing the mainframe migrated applications as part of transition-in. Testing for any work related to AWS will be tasked through Task 11 - Data Center Migration. |
| 31 |
| Which team/contractor will be responsible for integration of the migrated applications? |
| See answer to #79. |
| 31 |
| Which team/contractor will be responsible for fielding of the migrated applications? / Which contractor will the MBSIBA contractor be interfacing with for testing, integration, and on-going operations of the non-mainframe-based applications. |
| See the roles and responsibilities as outlined in the RACI documents in the reading room folder 11 – |
Infrastructure Information subfolder Infrastructure RACI CL.
(3)(d)
| 32 |
| In the event that system documentation and operational manuals exist but it is determined that they do not meet leading standards and guidelines (i.e., securities controls do not align with NIST and SANS), what is the responsibility of the contractor for the deficient documentations and manuals? |
| Ginnie Mae would want the awardee to update the documentation and manuals. |
(3)(i)
| 32 |
| What type of DR test is expected to be performed and passed? (i.e., parallel, simulated). |
| The DR test consists of the following activities: |
1. Automated disaster recovery fail over processes.
2. Live Production Site Failover Test every six months for each system. (If the primary site goes down, the failover site to the DR site must maintain operations and conform to establish SLA’s).
3. Supporting asynchronous mirroring of the production environment as specified in established SLA’s.
4. Be capable of synchronizing the data back to the primary site to make sure data integrity is preserved.
5. Application failover testing and validation for each application and DR environment for all sites.
6. Disaster recovery testing is performed semi-annual. If a pass is not received, additional testing will be required until a pass is received.
7. Support a committed or non-committed failover.
DR testing information was provided in the reading room. Please see folder #10 Disaster Recovery Data CL, subfolder PPA DR.
| 33-34 |
| Please provide an example or expand on the definitions of the following with respect to the Transition-In Plan: |
- management controls;
- risk and mitigation or avoidance strategies; and
- technical security implications.
Management controls could consist of, but are not limited to, any organizational commitment, program discipline, governance or management capability necessary to manage a transition of this magnitude. Risk and mitigation could include, but is not limited to, the ability to identify and anticipate risks to Ginnie Mae and the MBS programs and effectively mitigate or avoid these risks. Technical security implications are intended to relate to the IT environment and infrastructure.
| 34 |
| Please verify that the "transition resource requirements" pertain to transition-in process or on-boarding personnel. |
| Yes, to the extent that personnel are supporting the transition. |
| 35 |
| Is the Contractor expected to produce RMF artifacts such as security and privacy assessment reports that will receive an ATO? |
| Yes, the awardee would be responsible for producing any ATO documents relative to the applications within the scope of the RFP tasks. |
| 35 |
| What will be the RMF assessor-validator structure to receive the ATO? For example, will the Contractor be the assessor and Ginnie Mae (or a different contractor) will be the validator? |
| Ginnie Mae has another third-party assessor that will perform ATO assessments and this would not be the responsibility of the awardee. |
| 35 |
| Is HUD's agency RMF SOP publicly available and does it align with the latest NIST RMF standard (NIST SP 80-37 rev 2)? |
| See the link for HUD’s publicly available documentation HUD Handbook 2400.25 REV4. https://www.hud.gov/sites/documents/240025CIOH.PDF |
HUD’s policy is aligned with the NIST policy 800-37 REV 1/2.
| 35 |
| What are the performance expectations on supporting current and new applications? |
| See Task Six – Operations & Maintenance and Attachment E’s SLAs/SLOs. |
| 36 |
| Please clarify and/or provide an example of "invoicing considerations." |
| “Invoicing considerations” may include payment terms (e.g., 2/10, Net 30); shipping terms (e.g., FOB origin/destination); ACH/wire transfer information; remittance address, etc. |
| 42 |
| Please clarify how and when the Government and Contractor will agree to specific procedures and activities belong to the government. |
| Ginnie Mae will agree to specific procedures (AUPs) once the contract is awarded and scope of the work is defined and understood by the award recipient. This will happen at a minimum 10 business days before any assessment begins. |
| 42 |
| Please specify what tooling is used for performance metrics. Please provide a sample report if possible. |
| Sample reports are provided in the reading room. Reporting tools can be determined during the transition-in period. |
| 43 |
| Can financial overlays leveraging reasonable audit standards be applied during the ATO process to mitigate the volume of internal audit efforts on the system? For example, can account revalidations performed to receive the ATO be leveraged to demonstrate periodic user reviews are performed? |
| All assessment will be considered before examinations take place. It benefits both parties to leverage existing information. This doesn’t exclude some independent validation efforts that may be needed. The scope and the assessment will be discussed with the award recipient prior to any examinations taking place. |
(3)
| 43 |
| Please elaborate on what is meant by "timely notification" (i.e., within 10 business days). |
| Timely notification will depend on the type of change (i.e. complexity and impact to the business, etc.). |
| 48 |
| What is the process when the PPA needs to replenish the Request Pool Numbers application with additional pool numbers? |
| The Request Pool Number and Platinum applications are designed to automatically assign the alpha numeric pool numbers in sequence. |
| 45-82 |
| Please specify the frequency of the batch processing windows for the mainframe environment? |
| See answer in #34. |
| 84 |
| Are external parties allowed access to the GNMA Central Repository? If so, how? |
| Access to the IPMS Central Registry is controlled by IPMS mainframe security and has historically been restricted to Ginnie Mae and the PPA/CPTA contractor. |
| 86 |
| Does the current SDLC require that all environments remain within currently supported versions of software/ hardware? If not, what software/ hardware is outside of regular support? |
| The SDLC does require that Ginnie Mae stay within supported versions of software/hardware. |
| 109 |
| What are the security authentication and authorization tools that are currently in house? |
| Ginnie Mae uses several tools including, Oracle Identity and Access Management, Oracle Unified Directory, RSA SecurID token and mobile authenticator (one-time password). |
| 205 |
| Would the Government consider a 3-week extension of the due date for proposal submission? |
| The due date for proposal submission is extended by 1-week to October 1, 2020, 2pm EST. |
| 206 |
| The Price Proposal is asked for in Excel format, but the various administrative requirements for the Price volume will be difficult to provide in Excel format. Would it be acceptable to submit a Price volume in Word format, as long as the actual pricing is submitted in the Attachment R Excel file? |
| Yes. |
| 209 |
| Please provide the number of Principal and Income transactions processed by month from 8/2019 through 7/2020. |
| Per the Industry Day deck, slide #14, annual ACH (P&I/G-fees) are approximately 1,036 per month based on a 12-month average. See Reading Room folder 02-MBSIBA Procedures, subfolder MBSIBA Industry Day Presentation. The number consists of a single ACH for each of GN1 guaranty fee, GN2 guaranty fee, GN1 P&I and GN2 P&I. The figure is fairly consistent each month but could vary as the number of issuers with GN I and GN II pools may increase or decrease. |
| 209 |
| Please provide the number of new pools issued by month from 8/2019 through 7/2020, including GNMA 1, GNMA2, and Platinum pools. |
| Per the Ginnie Mae MBSIBA Industry Day Presentation, slide #13, monthly volumes are provided for March 2019 to March 2020. These volumes are representative of Ginnie Mae’s business. An updated slide, MBS Volume Aug 2019 – Aug 2020 has been added to the reading room. See reading room folder 02-MBSIBA Procedures, subfolder MBSIBA Industry Day Presentation, file: PPA MBSIBA Overview.pptx and file: MBS volume Aug 2019 - Aug 2020.ptx. |
| 211 |
| Are the mainframe applications compatible with running a COBOL 4.2 compiler environment, CICS 5.4 / 5.5, DB2 v11 / 12 and z/OS 2.3 / 2.4.? |
| Per the reading room document IPMS ATO Sanitized, on page 15 it states that, “IPMS runs on IBM’s z/OS 2.1 Operating System, CICS 5.3, and DB2 v11.” This document can be found in reading room folder 08 – ATO Packages CL, subfolder PPA, subfolder IMPS. |
GSA Federal Acquisition Service