Attachment 0001 - Performance Work Statement (Rvsd 04242024).doc

Performance Work Statement (PWS)

Financial Improvement Services

04/24/2024 Version 6.0 Vision Statement 1 General Information

1.1 Introduction

1.2 Background

1.3 Constraints

1.4 Description of Services

1.5 Non-Personal Services

1.6 Period of Performance

1.7 Place of Performance

1.8 Hours of Operation

1.9 Special Qualifications

1.10 Post Award/Kickoff Conference

1.11 Status Meetings

1.12 Reserved

1.13 Transition In

1.14 Transition Out

2 Definitions and Acronyms

2.1 Definitions

2.2 Acronyms

3 Government-Furnished Property and Services

3.1 Government Services

3.2 Facilities

3.3 Equipment

3.4 Materials

3.5 Quality Assurance (QA)

4 Contractor-Furnished Items and Services

4.1 Facilities

4.2 Equipment

4.3 Operating Environment

4.4 Contractor Responsibilities

4.5 Contractor Personnel

4.6 Identification of Contractor Employees

4.7 Quality Control

4.7.1 Quality Control Plan

5 Specific Tasks

5.1 Project Management

5.2 Reconciliation

5.3 Audit

5.4 Training

5.5 Transition Out Services

6 Deliverables

6.1 Quality Control Plan

6.2 Acceptance Criteria

7 Performance Requirements Summary 8 Related Documents

Performance Work Statement (PWS) Financial Improvement Services Vision Statement To assist the Government National Mortgage Association (GNMA, "Ginnie Mae) Finance Division with business process transformation and risk mitigation activities that allows the Finance Division to produce timely, accurate, and reliable financial information to achieve an unqualified opinion on the Annual Financial Statements.

1 General Information

1.1 Introduction

The U.S. Department of Housing and Urban Development (HUD), Office of Chief Financial Officer (OCFO) supports the Ginnie Mae Finance Division with business process transformation and risk mitigation activities that allows the Finance Division to produce timely, accurate, and reliable financial information to achieve an unqualified opinion on the Annual Financial Statements.

1.2 Background

Ginnie Mae is a Government corporation within HUD with a mission to provide America’s housing finance industry with access to global capital. Ginnie Mae focuses on providing a guaranty, backed by the full faith and credit of the United States, for the timely payment of principal and interest on mortgage- backed securities (MBS) secured by pools of government guaranteed or insured single and multifamily housing loans. The MBS supports housing finance by channeling investment capital from global capital markets for use in lending to support neighborhoods across the nation. Ginnie Mae provided financing for approximately one out of every three mortgage loans securitized in America during fiscal year 2020. Ginnie Mae is a Government-owned corporation and is required to report financial statements that adhere to both commercial and federal Generally Accepted Accounting Principles (GAAP).

In response to the Inspector General’s Audit Findings from prior years, Ginnie Mae acknowledged that its accounting operations and financial reporting issues can be quite complex and needs a significant investment in financial improvement activities, including investigation of underlying issues, building strong controls, analytics, and technology solutions to resolve issues and remediate the underlying triggers.

1.3 Constraints

The services identified in this PWS will adhere to the rules, regulations, laws, standards, and conventions identified by HUD as well as within the Federal Government.

1.3.1. Security and Privacy Requirements for Information Technology (IT) Procurements and supporting IT Service Providers

1.3.1.1. Federal Information Technology Security

As defined in U.S. Code, Title 40 (40 USC 11331), a Federal information system is defined as an information system used or operated by an executive agency, by a contractor of an executive agency, or by another organization on behalf of an executive agency. Contractors (including any subordinate organizations/vendors/subcontractors) accessing, managing, or supporting the Ginnie Mae mission, whether within federal or commercial information technology platforms, must do so in accordance with the Federal IT standards and guidelines. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

1.3.2 Information Security

1.3.2.1 Safeguarding Information and Information Systems and Privacy requirements

1.3.2.1.1 Requirements for Safeguarding Information and Information Systems

The contractor shall adopt and implement policies, procedures, controls, and standards required by the Ginnie Mae Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract based on National Institute of Standards and Technology (NIST) “Framework for Improving Critical Infrastructure Cybersecurity.”

1. The Contractor shall maintain compliance with all current and future Federal IT security requirements. The Contractor shall:

A. Federal Information Security Management Act - https://www.dhs.gov/fisma B. The Clinger-Cohen Act - https://www.fismacenter.com/Clinger%20Cohen.pdf C. Government Paper Reduction Act - http://www.hhs.gov/ocio/policy/collection/

D. Office of Management, and Budget Circulars A-130, and A-I23 - https://www.whitehouse.gov/omb/circulars_default E. Department of Housing and Urban Development regulations, Handbooks and Policies - http://www.HUD.gov.

F. All Applicable Ginnie Mae Handbooks and Policies (http://www.ginniemae.gov) including but not limited to:

· Ginnie Mae Policy #4060.02.2001, IT Security Policy (or current revision)

· Ginnie Mae Policy #4060.02.2001, Data Privacy Policy (or current revision)

· Ginnie Mae Policy #4060.02.3001, Vulnerability Management Policy (or current version)

G. GAO directives

H. Federal Financial Manager Integrity Act (FFMIA)

I. FedRAMP Authorization Act – https://www.fedramp.gov

J. Applicable Executive Orders and Office and Management and Budget (OMB) Memorandums for Federal Information Systems

Performance Standards

a) Standard: 100% compliance with all security requirements.

AQL: Zero deviation from standard.

1.3.2.2 Privacy Requirements

The Contractor shall comply with the Privacy Act of 1974 requirements, NIST SP 800-122, Guide to Protecting the Confidentiality of PII, with the Federal Information Security Modernization Act (FISMA) and with the OMB Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, and with all HUD and/or Ginnie Mae privacy publications. Per Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII) is “information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother’s maiden name, biometric records, etc. Sensitive PII is PII that if released improperly could result in harm, embarrassment, inconvenience, or unfairness to the individual whose name or identity is linked to the information.

The contactor shall report any loss, mishandling or exposure of PII, immediately (within 60 minutes) upon discovery to the Privacy Liaison Officer (PLO).

1.3.2.2.1 Assessment & Authorization (A&A)

The Contractor shall comply with all IT-enabled systems and major applications (as defined in NIST SP 800-18 Rev 1) introduced, developed, modified, managed or maintained by the contractor will follow the Department of Housing and Urban Development's (HUD's) Project Planning and Management (PPM) Life Cycle. A favorable Authority to Operate (ATO) must be obtained from the Ginnie Mae Authorizing Official prior to operational use. The Contractor shall maintain compliance with all Federal IT security requirements throughout the term of the contract with respect to all data, privacy, and information technology requirements to maintain authorization.

The Contractor shall maintain standards in accordance with NIST SP 800-37, The Risk Management Framework for Information Systems and Organizations. An independent A&A will be performed at the direction of Ginnie Mae during the period of performance of this contract. The Contractor must provide necessary A&A artifacts (section 1.3.4, b) in accordance with contract terms (not to exceed six (6) months) to obtain a favorable ATO.

The Contractor shall prepare its system security plan to demonstrate that it meets the requirements for A&A, per the applicable requirements from HUD, OMB, NIST, etc., which will require the preparation of several related documents, including but not limited to:

(1) FIPS 199/200 Security Categorization Analysis;

(2) NIST 800-53, Rev 5, Security and Privacy Controls for information Systems and Organizations;

(3) Application and network vulnerability scans;

(4) Business Impact Assessment;

(5) Privacy Impact Assessment;

(6) System Security Plan, Risk Assessment, Technical Architecture, Disaster Recovery/COOP and Contingency Plans, Incident Response Plan, Quality Control Plan, and other relevant A&A supporting documentation for each new application;

(7) E-authentication assessment; and

(8) Plan of Action & Milestones (POA&M)

1.3.3.2 Financial Systems

The Contractor shall comply with all financial management systems including both financial and financially related (or mixed) systems. Each financial or mixed system that the contractor manages, develops, modifies, enhances, releases and/or upgrades will additionally be assessed under the Federal Information System Controls Audit Manual (FISCAM) methodology that include control families for both General Computer and Business Process Application controls:

General Controls:

A. Security Management

B. Access Controls

C. Configuration Management

D. Segregation of Duties

E. Contingency Planning

F. Business Process Application Controls:

· Application Security

· Business Process Controls

· Interfaces

· Data Management

1.3.3.3 Continuous Monitoring Program

For the duration of the contract, the contractor shall support and participate in the following activities to support continuous monitoring and validate the state of readiness and compliance:

1. Information security monitoring:

a. Annual or emergent security audits and security scans that may be performed by the Office of Inspector General (OIG), the General Accountability Office (GAO), or the Department of Homeland Security (DHS).

b. Provide system and/or vulnerability-related information to the Information Security Team (or their delegate/designee) in order to: 1) Review audit findings; 2) Determine if corrective actions were properly implemented and the associated audit findings were properly closed; 3) respond to audits; 4.) Support cybersecurity incident analysis and forensics activities.

c. Produce scheduled Monthly/Quarterly/Annual security performance measure reports that align to Ginnie Mae’s reporting requirements specified by OMB for FISMA, the President’s cybersecurity Cross Agency Priority (CAP) goals and targets, and CyberScope reporting.

d. Identify, perform, track, and report vulnerability and security weakness remediation and mitigation activities through the Plan of Action and Milestones (POA&M) process.

2. Documentation revalidation:

a. Prepare and present an annual Security Self-Assessment Report to the Information Security (INFOSEC) Office team.

b. Review and update of all security authorization documentation on a quarterly basis to reflect system or administrative changes (reference 1.3.4, section b)

1.3.3.4 Encryption and Protection Standards

The Contractor shall:

1. Comply with Executive Order (EO) 14028, Improving the Nation’s Cybersecurity (May 12, 2021), Section 3(d)(iii) requirements for encrypting data at rest and data in transit as well as Ginnie Mae Information Technology (IT) Security Policies to prevent unauthorized access to government information.

2. Encrypt all sensitive federal data and information (i.e., PII, proprietary information, Controlled Unclassified Information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

3. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process federally owned or federally managed information and ensure devices meet Ginnie Mae encryption standard requirements.

4. Maintain a complete and current inventory of all assets that store or process sensitive government information (including PII).

5. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-3. The contractor shall provide a written copy of the validation documentation to the COR when required by the Program Office.

6. All deliverables shall be labeled [appropriate label such as “Controlled Unclassified Information” (CUI) or “Privacy Identifiable Information (PII) enclosed or other labeling provided by Ginnie Mae COR, as required.

1.3.3.5 Multi Factor Authentication for Platform Access

In accordance with OMB Memorandum M-22-09, the contractor shall provide a system that implements or integrates with Ginnie Mae’s Identity and Access Management Solution to support Phishing Resistant Multi-Factor Authentication (MFA) that provides for origin authentication, data integrity, and signer non-repudiation.

OR

{Contracts involving IT Support Services]

The contractor shall support a secure, multi-factor method of remote authentication and authorization to identify Government Administrators that will allow Government designated personnel the ability to perform management duties on the system.

1.3.3.6 Leveraging Cloud-based solutions (where applicable)

In accordance with the FedRamp Authorization Act, the contractor shall ensure that any cloud-based applications or solutions developed or leveraged to support Ginnie Mae requirements be aligned with the Federal Risk and Authorization Management Program (FedRamp) guidelines.

1.3.3.7 Personnel Screening

The contractor shall comply with Department of Housing and Urban Development (HUD) HUD and Ginnie Mae onboarding and personnel background check screening requirements and process. The HUD Personnel Security Division (PSD) adheres to suitability and fitness criteria in accordance with 5 CFR 731 and applies investigative and adjudicative standards accordingly. The contractor will be required to follow all HUD and Ginnie Mae process and procedures in regards to obtaining access to HUD and/or Ginnie Mae systems or facilities and ultimately obtain a favorable adjudication for the level of clearance required to perform work.

1.3.3.8 Incident handling and reporting (applicable for GSS/Major System acquisitions) The contractor shall provide a list of their personnel, identified by name and role, with system administration, monitoring, and/or security responsibilities that are to receive security alerts, advisories, and directives. Incident Response Plans must be integrated with Ginnie Mae operations and reporting.

If any new cybersecurity incidents, breaches or hazards are discovered by the contractor; or if existing safeguards have ceased to function; or if any intrusion, exfiltration, or Ginnie Mae data loss has been detected or suspected, the contractor shall report incident or event immediately (upon discovery, not to exceed 60 minutes) to the Ginnie Mae Security Operations Center (SOC).

1.3.3.9 Data Jurisdiction (e.g., “Offshoring of data”)

The contractor shall identify all data centers that data at rest or data backups will reside. The contractor (including any subcontractors) shall not transfer, store or distribute any Ginnie Mae operational or proprietary data outside of the continental United States (CONUS) without notification and written consent.

1.4 Description of Services

Ginnie Mae seeks a Contractor who shall provide financial improvement services required to transform and improve support activities within Ginnie Mae's Finance Division. The support services will assist Ginnie Mae in achieving financial management improvement strategies including understanding financial management operations and information (e.g. financial model estimates, monthly close and reporting processes, etc.), recognizing the source of information, ensuring the quality and validity of financial information/results, identifying a path to financial improvement, and communicating and implementing financial improvement strategies.

1.5 Non-Personal Services

The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual Contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services.

If the Contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the Contractor's responsibility to notify the Contracting Officer (CO) immediately. These services shall not be used to perform work of a policy, decision making, or management nature, i.e. inherently Government functions. All decisions relative to programs supported by the Contactor shall be the sole responsibility of the Government.

1.6 Period of Performance

The Period of Performance shall be for one (1) 12-month base year plus four (4) 12-month option years.

1.7 Place of Performance

The primary places of performance for this requirement will be at either the Contractor site, Ginnie Mae’s facility located at 425 3rd St SW, Washington, DC 20024 (contingent on site justification approval), or some other remote location(s) as agreed upon by the COR.

1.8 Hours of Operation

The Contractor is responsible for providing services between the hours 8:00 a.m. to 5:00 p.m. Monday through Friday except for Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closing, or similar Government directed facility closings. Weekly hours shall not exceed a forty (40) hour work week and a typical work day will be 8 hours each day Monday through Friday. The Government reserves the right to change hours of operation or restrict contractor access. Work outside of these daily hours is prohibited without Contracting Officer approval. Government agencies will not be available during scheduled holidays, inclement weather, weekends, and after duty hours.

The Contractor shall at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within the contract when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce is essential.

1.9 Special Qualifications

N/A

1.10 Post Award/Kickoff Conference

The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The Government intends to convene a Post Award Conference with the Contractor within ten business days after contract award. The Contracting Officer will notify the Contractor of the specific date, location, and agenda within five business days after contract award.

1.11 Status Meetings

The Contracting Officer, Contracting Officers Representative (COR) and other Government personnel, as appropriate may meet periodically with the Contractor to also review Contractor performance, requirement status, etc. At these meetings, the Contracting Officer will apprise the Contractor of how the Government views the Contractor's performance or progress of the requirement. The Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government. Post Award Conference and subsequent meetings may be held via teleconference.

1.12 Reserved

N/A.

1.13 Transition In

The contractor shall complete transition of the services from the incumbent contractor within 2 months of the contract start date:

· The contractor will develop and document a detailed plan describing how it will transition all services to be provided under the Financial Improvement Services contract from current contractor. This draft plan is required with the proposal and the final plan is required no later than 5 (five) calendar days after award.

· The new contractor will shadow the incumbent contractor during the first month of the two (2) month Transition-in period to observe and gain experience and familiarization with the tasks. The incumbent contractor will then shadow the new contractor the last month of the transition period to observe and ensure the new contractor has gained the experience and familiarization with completing the tasks to ensure an understanding of the technical and functional procedures involved for successful day to day operations of the contract.

· The transition will be performed without any interruption or degradation in any services. This process is meant to facilitate adequate knowledge transfer and handoff of support tasks from the incumbent to the new contractor.

· The incoming contractor will utilize and leverage the infrastructure and technology platforms provided and maintained by GNMA’s Infrastructure Support Provider.

· The incoming contractor will provide a certification of readiness and documentation to support and demonstrate a complete and accurate transition-in.

· The Transition-In contractor will participate in weekly transition meetings with the GNMA sponsor and project staff, and representatives of the Transition-Out contractor. The purpose of these meetings is to review project materials and take preparatory steps to ensure continued system operations and maintenance.

Performance Standards Standard: The contractor shall provide a draft Transition Plan with their proposal. AQL: No deviation.

Standard: The contractor shall provide final Transition Plan 5 days after award.

AQL: 10 calendar days after the standard Deliverables

A001: Reserved A002: Final Transition Plan

1.14 Transition Out

To minimize any decrease in productivity and to prevent possible negative impacts on additional services, the Contractor shall have sufficient personnel on board during the six-month Transition-Out period. The incumbent Contractor shall ensure a smooth transition with the successor Contractor during the Transition-Out period, prior to completion of contractual performance. The incumbent Contractor shall aid the successor in the development of plans, procedures, and methods for the assumption of all on going work. The Contractor shall provide an orderly transition of work acceptance and accomplishment, such that full control by the successor Contractor is achieved by the end of the new contract Transition-In period.

2 Definitions and Acronyms

2.1 Definitions

Business/Work Days - Every official work day of the week which are days between and including Monday to Friday. This does not include public holidays and weekends.

Calendar Day - Any day of the week.

Contractor - A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Contracting Officer (CO) - A person with authority to enter into, administer, and/or terminate contracts and make related determinations and findings on behalf of the Government. Note: the only individual who can legally bind the Government.

Contracting Officer's Representative (COR) - An employee of the U.S. Government appointed by the Contracting Officer to perform contract administration activities in regard to technical issues. This individual has authority to provide technical direction to the Contractor as long as direction is within the scope of the contract, does not constitute a change and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

Defective Service - A service output that does not meet the standard of performance associated with the Performance Work Statement.

Deliverable Anything that can be physically or electronically delivered but may include non-manufactured things such as meeting minutes or reports.

Government Furnished Property (GFP) - Government-furnished property means property in the possession of, or directly acquired by, the Government and subsequently furnished to the Contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification. Government-furnished property also includes contractor-acquired property if the contractor-acquired property is a deliverable under a cost contract when accepted by the Government for continued use under the contract.

Major Application: An application that requires special attention to security due to the risk and magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of the information in the application. Note: All federal applications require some level of protection. Certain applications, because of the information in them, however, require special management oversight and should be treated as major. Adequate security for other applications should be provided by security of the systems in which they operate. Major applications will be evaluated and assessed for a unique Authority to Operate (ATO). Source: CNSSI 4009-2015, NIST SP 800-18 Rev. 1

Minor Application: An application, other than a major application, that requires attention to security due to the risk and magnitude of harm resulting from the loss, misuse, or unauthorized access to or modification of the information in the application. Minor applications are typically included as part of a general support system and will be evaluated in conjunction with the major application. The ATO for the major application (and all supporting documentation) will be updated to account for the minor application and require a new ATO to be generated. Source: CNSSI 4009-2015, NIST SP 800-18 Rev. 1 Performance Requirements Summary (PRS) - A listing of the performance requirements under the contract that are to be evaluated by the Government on a regular basis, performance indicators for these requirements, performance standards for these requirement and surveillance methods to be used to determine if performance standards are met.

Performance Standard - The Contractor's performance level required by the Government.

Performance Work Statement (PWS) - A statement of work for performance-based acquisitions that describe the required results in clear, specific, and objective terms with measurable outcomes.

Physical Security - Actions that prevent the loss or damage of Government property.

Quality Assurance (QA) - Policies and procedures adopted by the Government to ensure that supplies and services acquired under Government contracts conform to the contracts quality requirements.

Quality Assurance Surveillance Plan (QASP) - A plan describing how the agency will survey, observe, test, sample, evaluate and document the Contractor's performance in meeting critical performance standards identified in the contract.

Quality Control (QC) - All necessary measures taken by the Contractor to assure that the quality of an end product of service shall meet contract requirements.

Service Contract - A contract that directly engages the time and effort of a Contractor whose primary purpose is to perform an identifiable task rather than to furnish an end item of supply.

Subcontractor - Any person, other than the prime Contractor, who offers to furnish or furnishes any supplies, material, equipment, or services of any kind under a prime contract or a subcontract entered into in connection with such prime contract, and any person who offers to furnish or furnishes general supplies to the prime contractor or a higher tier subcontractor. The Government does not have privity of contract with a subcontractor.

Work Week - Monday through Friday, unless specified otherwise.

2.2 Acronyms

AQL - Acceptable Quality Level CFO or OCFO - Office of the Chief Financial Officer of HUD

CO - Contracting Officer

COR - Contracting Officer's Representative

HUD - U.S. Department of Housing and Urban Development

HUDAR - HUD Acquisition Regulation

IT - Information Technology

OMB - Office of Management and Budget

PM - Project Manager

POC - Point of Contact

QA - Quality Assurance

QASP - Quality Assurance Surveillance Plan

QCP - Quality Control Plan 3 Government-Furnished Property and Services The Contractor shall ensure accurate control and accountability of all Government-Furnished Property in accordance with the terms and conditions of this contract. The Government will furnish, at no cost to the Contractor, the GFP shown below.

3.1 Government Services

No Government services will be provided.

3.2 Facilities

The Government will provide a working space to all assigned Contractor staff when required to visit Ginnie Mae offices.

3.2.1 Operating Environment

Ginnie Mae will grant the Contractor authorized access to the following business processes, as needed, IAW Ginnie Mae’s internal control procedures:

A. Administrative Expenses- Supplies and other services. Ginnie Mae divides operating procedures into the budget process, non-personnel services, personnel services, and Salaries and Expenses (S&E) payments.

B. Asset Management - Mortgage-Backed Security (MBS) portfolios become Ginnie Mae’s assets when an Issuer defaults and the portfolio is transferred to one of Ginnie Mae’s Master Sub-servicers (MSSs). Currently, there are two Single Family Master Sub-servicers that provide defaulted Issuer portfolio services to Ginnie Mae, which are responsible for collecting, monitoring, and reporting loan payments.

C. Accounts Payable - Ginnie Mae processes accounts payable (A/P) and cash disbursements for program services which includes contract services, Service members Civil Relief Act expenses, Multifamily 1% reimbursements, advances to the Master Sub-servicer (MSS), miscellaneous expenses, and payments to unclaimed funds. Ginnie Mae has the ability to pay vendors using Treasurys Secure Payment System (SPS) or the Intra-Governmental Payment and Collection System (IPAC) and via checks.

D. Cash Receipts - Ginnie Mae receives funds from fees including, but not limited to, guaranty, multiclass income, commitment, and pool transfer. The agency collects cash receipts by checks, Pay.gov Receipts, Federal Reserve Wire Network (FedWire) transfers, and the Intra-Governmental Payment and Collection (IPAC) system. Ginnie Mae deposits all receipts into agency specific United States Department of Treasury (Treasury) accounts. Ginnie Mae’s policy is that money is only considered received once it is identified on the Collections Information Repository (CIR).

E. Fixed Assets - Ginnie Mae’s fixed assets consist of software used for Mortgage-Backed Security (MBS) programs. All other fixed assets including computers, furniture, and buildings are procured under the provisions of the Salaries and Expenses fund, maintained by the HUD. Ginnie Mae’s fixed assets are classified as those with a cost basis equal to or exceeding the capitalization threshold of $100,000 and a useful life of two or more years. These assets are recorded and depreciated in HUDs financial records.

F. Fund Balance with Treasury - FBWT is an asset account similar to cash, that represents the future economic benefit of funds that can be spent for authorized Ginnie Mae transactions. On a monthly basis, Ginnie Mae is required to report collections and disbursements to the Bureau of the Fiscal Services Financial Management Service (FMS) of Treasury.

G. Financial Reporting - The operating procedures related to the Financial Reporting Cycle are Journal Entries; Ginnie Mae Financial Statements; HUD Financial Statements. HUD combines Ginnie Mae’s financial statement with its other programs and submits the consolidated report to Treasury; and two reports Governmentwide Treasury Account Symbol and Treasury Report on Receivables (GTAS and TROR).

H. Issuer Default - Ginnie Mae conducts ongoing performance monitoring of all approved Issuers. An Issuer Watch List, which identifies Issuers that exceed watch list threshold matrices, is used to track Issuers that require additional and continuous monitoring.

I. Issuance and Monitoring - The Issuance and Monitoring Process embroils multiple offices. from start to finish. The Office of Enterprise Risk (OER), Office of Chief Financial Officer (OCFO), Office of Issuer and Portfolio Management (OIPM), and Office of Securities Operations (OSO) are each involved in the processes.

J. Investments - In accordance with government requirements, Ginnie Mae invests excess cash funds in special market-based book-entry Treasury securities. Ginnie Mae’s Investment Committee establishes investment policy and strategy.

K. Information Technology (IT) - Ginnie Mae’s mission is to facilitate the securitization of pooled mortgages insured by government agencies as Mortgage-Backed Securities (MBS) and guarantees the timely payment of principal and interest to those who invest in these securities.

L. Mortgage-Backed Securities Program Income - Ginnie Mae’s MBS is divided into two programs, Single Class, and Multiclass Securities Programs. The Single Class Securities Program is handled by the Office of Securities Operations (OSO) and Multiclass Securities Program is handled by the Office of Capital Markets (OCM).

M. Procurement - Requests for contract services are usually related to increasing operational efficiencies or support services for Ginnie Mae’s program offices. Through a competitive bidding process, Ginnie Mae selects vendors for specific contracted tasks in accordance with the Federal Acquisition Regulation and HUDs acquisition policies and procedures. These vendors perform tasks within the defined scope and length of a written contract agreement, including any option years and/or contract extensions.

3.2.2 Systems Access

Ginnie Mae will provide the Contractor authorized read access to the following systems, as needed, IAW Ginnie Mae’s IT Security policies and protocols:

A. Ginnie Mae Financial Accounting System (GFAS) - a PeopleSoft system that tracks, records and reports on the agency’s accounting information. GFAS supports the financial functions required to process payments and receipts, track financial events, provide financial information significant to the financial management of the agency, and/or required for the preparation of requirements such as Office of Management and Budget (OMB) and Government Accounting Office (GAO) reporting.

B. Integrated Pool Management System (IPMS) - Proprietary mainframe application that has three major component subsystems: New Pool Processing, Pool Reporting and Generalized Mortgage-Backed Securities.

C. Reporting and Feedback System (RFS) - Supports the centralized data collection and feedback for all MBS post settlement accounting and reporting. Ginnie Mae Issuers upload reported data using sFTP to RFS for data collection, quality checking, data reconciliation, exception reporting to Issuers, and final storage in a central data store. RFS provides immediate feedback to Issuers regarding the status of reported data.

D. Ginnie Net - Internet application that is used by Issuers to electronically submit MBS pools, final certifications and recertification information, forms HUD 11708 and HUD 11710D, Quarterly Certifications, Remaining Principal Balances (RPB), monthly Remittance Advice information (forms 11714 and 11714SN), Transfers of Document Custodian responsibility, Certification and Agreement (form HUD 11711B), and ACH Debit Authorizations (form 11709A). Ginnie Net is used by Document Custodians to certify or reject submissions.

E. Ginnie Mae’s Production Portal Platforms - Provide browser-based read access to Ginnie Mae’s applications and modules via a common presentation layer.

F. Unclaimed Funds System.

G. Operational Data Store and Master Sub-Servicer Operational Reporting (ODS/MOR) This data and application development initiative will provide a unified mapping, reporting, and manage information system for asset management functions.

3.3 Equipment

The Government will provide access to scanners, fax machines, and printers, when the Contractor staff is at Ginnie Mae facilities. Each office or workspace provided by the Government may have a phone, desk, and chair. Internet access and additional furniture may be provided upon determination of need by the Government.

The government will provide eight (8) laptops and one (1) printer (See Attachment 7 – List of Government Furnished Property (GFP).

3.4 Materials

Copies of required materials may be provided to the Contractor in hard copy or soft copy. All materials will remain the property of the Government and will be returned to the COR upon request or at the end of the contract period.

3.5 Quality Assurance (QA)

The Government shall evaluate the Contractor's performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable quality level.

4 Contractor-Furnished Items and Services

The Contractor shall furnish, all facilities, equipment, and supplies required to perform the work under this contract that are not listed under Government-Furnished Property and Services.

4.1 Facilities

The Contractor shall provide facilities for services performed on the Contractor site.

4.2 Equipment

N/A

4.3 Material

The Contractor shall furnish all materials required to perform the work under this contract.

4.4 Contractor Responsibilities

The Contractor shall only conduct business with designated Government personnel listed as points of contact (POCs). Names of authorized personnel shall be provided to the Contractor by the Government, in writing, and updated as necessary throughout the contract period.

U.S. Government records, copies of original results and reports, verified original data, corrected data, and corrected supporting final reports which are maintained by the Contractor remain the property of the U.S. Government. These files/results must be surrendered to the COR.

4.5 Contractor Personnel

The Contractor shall provide a Contract/Project Manager who shall be responsible for the performance of work. An alternate shall also be designated to act in the absence of the Contract/Project Manager. These Contractor personnel (main point of contact and alternate point of contact) are considered Key Personnel by the Government and shall be listed as such in accordance with HUDAR 2452.237-70, "Key Personnel.

The Contract/Project Manager and alternate shall have full authority to act on all contact matters relating to daily operations of this contract. Accordingly, at a minimum, the points of contact shall have the technical knowledge of the requirement and be in the position to actually receive assignment, guidance, and direction from the COR, PM, and CO per HUDAR 2452.237-73, "Conduct of Work and Technical Guidance" and shall be allocated enough hours to the requirement to ensure successful performance.

These points of points of contact shall each be an employee of the Contractor. An employee of a subcontractor is not acceptable for either of these positions. The Contract/Project Manager or alternate shall be available between the hours of 8:00am to 5:00pm Monday through Friday EST, except Federal Holidays or when the Government facility is closed for administrative reasons.

4.6 Identification of Contractor Employees

All Contractor/subcontractor personnel shall wear company picture identification badges as to distinguish themselves from Government employees. When conversing with Government personnel during business meetings, over the telephone, or via electronic mail, Contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees.

Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation. Where practicable, Contractor/subcontractors occupying collocated space with their Government program customer shall identify their workspace area with their name and company affiliation, or at a minimum, "Contractor" after name.

4.7 Quality Control

The Contractor shall establish and maintain a complete quality control program that shall ensure services are performed in accordance with this contract. The Contractor shall develop and implement procedures to identify, prevent, and ensure non reoccurrence of defective services. The Contractor's quality control program is the means by which he assures himself that his work complies with the requirements of the contract. The Contractor shall provide the associated Quality Control Plan to the Government as directed.

4.7.1 Quality Control Plan

The Contractor shall develop, maintain, enforce, and document a Quality Control Plan (QCP). The QCP shall ensure the Government receives the level of quality that is consistent with the requirements specified in this contract. The QCP shall be sufficiently detailed to provide the Contractor's methodology for identifying and recruiting qualified personnel. The QCP shall also provide the Contractor's methodology for resolving problems identified by the Government during reviews conducted in accordance with its Quality Assurance Surveillance Plan (QASP). The QCP shall also provide the Contractor's methodology for establishing an internal feedback system for support personnel, and for resolving problems identified by that feedback system. The QCP shall demonstrate and validate that the services or deliverables to be provided under the contract are completed with a level of quality that meets the minimum performance threshold established in the Government's QASP. The QCP shall address Quality Management Approach, Quality Assurance, Quality Control and Quality Standards.

5 Specific Tasks The purpose of the contract is to ensure and mitigate any Inspector General’s Audit Findings therefore, Ginnie Mae acknowledged that contractor support for its complex accounting operations and financial reporting issues needs a significant investment in financial improvement activities, including investigation of underlying issues, building strong controls, analytics, and technology solutions to resolve issues and remediate the underlying triggers.

5.1 Project Management

The Contractor shall provide program management support under this contract. This includes the management and oversight of all activities performed by Contractor personnel, including subcontractors, to satisfy the requirements identified in this Performance Work Statement (PWS). The Contractor shall identify a Project Manager (PM) and alternate project manager (APM) by name that shall provide management, direction, administration, quality assurance, and leadership of the execution of this contract.

The Contractor shall facilitate Government and contractor communications; use industry best-standards and proven methodologies to track and document contract requirements and activities to allow for continuous monitoring and evaluation by the Government; and ensure all support and requirements performed are accomplished in accordance with the contract. The contractor shall notify the Contracting Officer Representative (COR) of any technical, financial, personnel, or general managerial problems encountered throughout the contract period of performance (PoP).

The Contractor shall provide strategic enterprise-level guidance that: integrates support across all task areas; ensures support is in accordance with contract requirements; schedules meetings and provides deliverables in accordance with Section 6. The Contractor shall submit a draft Project Management Plan (PMP) for the contracted services within five business days after contract award to the COR for review. A final PMP shall then be provided within 7 business days after receipt of approval. It shall evolve as the project progresses and shall be updated with the latest relevant information as required.

Performance Standards

a) Standard: Submit Final PMP within 7 business days after approval

AQL: 5 calendar days beyond the standard

Deliverables A003 Project Management Plan Draft A004 Project Management Plan Final

5.1.1 Monthly Status Report (MSR)

The MSR shall provide a detailed status for each project within the PMP as well as capture an overall status of the task(s). The Contractor shall deliver the MSR on a date mutually agreed upon by the Contractor and the COR. Specific MSR format, and any additional content not specified in this section, shall be submitted on the 10th business day of each month. The MSR reports cost, schedule, and performance against the PMP baseline and identifies planned versus actual expenditures per project; with the total monthly and cumulative Other Direct Costs expenditures; the status of known risks and risk mitigation efforts; deliverables funded, technical progress made, and schedule status per deliverable; the titles, dates, and the number(s) of each deliverables completed; and the deliverables scheduled to be delivered during the upcoming month. The MSR shall report all funding received and shall detail the projects supported by such funding.

Performance Standards

a) Standard: Submit Final PMP within 7 business days after approval AQL: 5 calendar days beyond the standard Deliverables A005 Monthly Status Report (MSR)

5.2 Reconciliation

The Contractor shall analyze and utilize the various financial systems of the Finance Division, including transaction-level processing, to assess their impact on the comprehensive execution, monitoring, and reporting of financial statements. The Contractor shall ensure that systems and processes are compliant with accounting policies and operating procedures, with consideration to financial implications. It must substantiate that balances obtained within the Finance Division and other program offices are according to process flows, standard operating procedures, and/or accounting policies recently agreed upon with HUD. This requires knowledge of the mortgage industry and related accounting standards regulations, Financial Division policies and procedures, and accounting systems (PeopleSoft) to execute the reconciliation process. The Contractor shall provide an analysis of financial statements and supporting schedules for compliance with US GAAP monthly.

Performance Standards

a) Standard: Submit analysis by the 5th business day after receipt of the monthly financial statements and supporting schedules or ad hoc requests for compliance with US GAAP

AQL: Zero Deviation

A006 Analysis of financial statements and supporting schedules or ad hoc requests for compliance with US GAAP

5.3 Audit

The contractor shall support the internal audits of financial business processes (e.g., MSS oversight, financial model review – Note: model is used to derive mortgage loan accounting estimates e.g., Allowance for Loan Loss (ALLL), internal controls over financial reporting, audit readiness, etc.) to ensure processes associated with transactions meet the terms and conditions of applicable policies/guidelines. This would include an analysis of business processes, identification, and remediation of process gaps, enhancing controls over current processes, and assistance with the development of tools and related procedures to improve on-going financial functions. This effort requires an understanding of accounting systems (Peoplesoft), financial models used for mortgage loan estimates, and an understanding of the appropriate policies and procedures, particularly loan accounting policies. The Contactor shall provide assistance in the development and implementation of Corrective Action Plans (CAP) to remediate any inquiries, material weaknesses, significant deficiencies, and non-conformances resulting from internal audit of modeling results.

Performance Standards

a) Standard: Submit a Corrective Action Plan by the 5th business day after receipt of quarterly modeling deliverable AQL: Zero Deviation

A007 Corrective Action Plan

5.4 Training

As Ginnie Mae goes through improving its financial management structure, extensive training throughout all levels of the OCFO will need to be conducted to ensure consistent understanding and knowledge gaps are mitigated. The contractor may be required to develop and deliver training of strategies and ‘good’ practices via instructional job aids, and procedural handbooks on internal controls and compliance and financial reporting as it relates the results of:

· Audit findings and corrective action remediation efforts to include updates and improvements to business procedures;

· Internal financial analysis on various modeling report; and

· Providing instruction on how to identify potential issues Anytime the contractor conducts training with five (5) or more attendees a survey will be required.