PWS - eVAULT TRACK CHANGES AMENDMENT 1 12.3.2024 doc.doc

Performance Work Statement (PWS)

Digital Collateral (DCOL) eVault

09/13/2024

Version 1.0 4Vision Statement

1 General Information

1.1 Scope of Work

1.2 Background

1.3 Constraints

1.4 Non-Personal Services

1.5 Period of Performance

1.6 Place of Performance

1.7 Hours of Operation

1.8 Special Qualifications

1.9 Post Award/Kickoff Conference

1.10 Status Meetings

1.11 Contractor Travel

1.12 Transition In

1.13 Transition Out

2 Definitions and Acronyms

2.1 Definitions

2.2 Acronyms

3 Government-Furnished Property and Services

3.1 Government Services

3.2 Facilities

3.3 Equipment

3.4 Materials and Information

3.5 Quality Assurance (QA)

4 Contractor-Furnished Items and Services

4.1 Facilities

4.2 Equipment

4.3 Materials

4.4 Contractor Responsibilities

4.5 Contractor Personnel

4.6 Identification of Contractor Employees

5 Specific Tasks

5.1 Project Management

5.2 eVault

5.3 Transition In Service

5.4 Transition Out Services

6 Deliverables

6.1 Quality Control Plan

6.2 Acceptance Criteria

7 Related Documents 8 Performance Requirements Summary

Performance Work Statement (PWS) Digital Collateral (DCOL) eVault Vision Statement

To obtain a robust electronic vault (eVault) solution that is fully integrated with the MERS (Mortgage Electronic Registration System) eRegistry to use as secure storage for eNotes and other Trailing eDocs that serve as collateral for Mortgage-Backed Securities (MBS) carrying the Ginnie Mae Guarantee.

1 General Information

1.1 Scope of Work

An electronic vault ("eVault) is a secure electronic document management system used by participants in the mortgage lending industry for the storage and management of Electronic Loan Documents, as required by Federal law.

Ginnie Mae is seeking to obtain a robust electronic vault ("eVault) solution that is fully integrated with the MERS eRegistry to use as secure storage for eNotes and other Trailing eDocs that serve as collateral for Mortgage-Backed Securities (MBS) carrying the Ginnie Mae Guarantee. Ginnie Mae will use the eVault solution as part of its Digital Collateral program to test the processes, policies, and controls necessary to enable Mortgagees participating as Issuers in its MBS Program to securitize federally insured or guaranteed mortgage loans executed on eNotes. For each eNote securitized, Ginnie Mae will use the eVault to update its status as a rights holder in the MERS eRegistry in accordance with various scenarios, including but not limited to, loan payoff, borrower default, or the transfer of mortgage servicing rights, as well as to execute transfers of control and location for eNotes associated with defaulted Issuer portfolios.

Ginnie Mae has developed and implemented the policies, technology, and operational capabilities necessary to enable Issuers to use eNotes, Trailing eDocs, and other digitized loan files as acceptable collateral for Ginnie Mae MBS.

1.2 Background

An electronic vault ("eVault) is a secure electronic document management system used by participants in the mortgage lending industry for the storage and management of Electronic Loan Documents, as required by Federal law.

Ginnie Mae is seeking to obtain a robust electronic vault ("eVault) solution that is fully integrated with the MERS eRegistry to use as secure storage for eNotes and other Trailing eDocs that serve as collateral for Mortgage Backed Securities (MBS) carrying the Ginnie Mae Guarantee. Ginnie Mae will use the eVault solution as part of its Digital Collateral program to test the processes, policies, and controls necessary to enable Mortgagees participating as Issuers in its MBS Program to securitize federally insured or guaranteed mortgage loans executed on eNotes. For each eNote securitized, Ginnie Mae will use the eVault to update its status as a rights holder in the MERS eRegistry in accordance with various scenarios, including but not limited to, loan payoff, borrower default, or the transfer of mortgage servicing rights, as well as to execute transfers of control and location for eNotes associated with defaulted Issuer portfolios.

Ginnie Mae has developed and implemented the policies, technology, and operational capabilities necessary to enable Issuers to use eNotes, Trailing eDocs, and other digitized loan files as acceptable collateral for Ginnie Mae MBS.

1.3 Constraints

The services identified in this PWS will adhere to the rules, regulations, laws, standards, and conventions identified by HUD as well as within the Federal Government. Constraints include the following:

· The Contractor shall prepare PPM documentation in accordance with the format and content specified in the PPM templates at http://hudatwork.hud.gov/po/i/itm/ppm/ppm.cfm. The HUD PPM guide always takes precedence whenever inconsistencies manifest between the PPM Guide and its corresponding PPM templates and PPM Checklists.

· The Contractor shall manage all projects in accordance with the National Defense Industrial Association (NDIA) American National Standards Institute Electronic Industries Alliance (ANSI/EIA) - 748 standards for Earned Value Management Systems (EVMS) and be subject to periodic compliance reviews.

The Contractor shall prepare analysis reports in accordance with guidance provided within the HUD Analysis Report Guide.

1.3.1 Project Planning and Management

All HUD IT projects, including all information systems acquired, developed, enhanced, or maintained shall follow the policy, procedures, standards, and guidelines set forth within the IT Management Framework using the Project Planning and Management (PPM) Life Cycle located at HUD’s PPM Life Cycle Website:

http://portal.hud.gov/hudportal/HUD?src=/program_offices/cio/ppm/PPMV20HOME PPM was designed based on the best practices from Capability Maturity Model Integration (CMMI) for systems development and PMBok for project management. While at the foundation, PPM is designed as a Waterfall methodology, HUD encourages tailoring the PPM to use the many modern solution development methodologies available to enable the planning, development and delivery of useable functionality within 6-9 month increments.

Contractors are encouraged to propose a preferred methodology whether their solution(s) are for custom development, includes prototypes or pilots, Commercial Off the Shelf (COTS)/ Government Off the Shelf (GOTS) configuration, or Software as a Services. Working with the HUD Project Manager(s), the Contractor will tailor PPM to take advantage of contractor proposed expertise in using other methodologies in a manner that will provide HUD the best value and address all of the work necessary for successful project completion, on time, within budget, and delivering intended functionality.

The decisions of PPM tailoring are captured in the Project Tailoring Agreement (PTA), which documents the specific agreement for creating, combining, referring, or omitting specific artifacts applicable to the project, as well as adjust project control gate reviews to be consistent with the tailoring. All tailoring of PPM must be approved by HUD’s Deputy Chief Information Officer (DCIO) for Business & IT Modernization. As a default, any project without an approved project tailoring agreement is required to follow all PPM phases and artifacts as presented.

1.4 Non-Personal Services

The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual Contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services.

If the Contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the Contractor's responsibility to notify the Contracting Officer (CO) immediately. These services shall not be used to perform work of a policy, decision making, or management nature, i.e., inherently Government functions. All decisions relative to programs supported by the Contactor shall be the sole responsibility of the Government.

1.5 Period of Performance

The period of performance shall be for one initial base period of twelve (12) months followed by up to four (4) option years.

1.6 Place of Performance

The services to be performed under this contract shall be performed at the Contractor's offices.

1.7 Hours of Operation

The Contractor is responsible for providing services between the hours of 9:00am to 5:00pm Monday thru Friday except for Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closing, or similar Government directed facility closings. The Government reserves the right to change hours of operation or restrict contractor access. Government agencies will not be available during scheduled holidays, inclement weather, weekends, and after duty hours.

The Contractor shall maintain an adequate workforce for the uninterrupted performance of all tasks defined within the contract when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce is essential.

1.8 Special Qualifications

N/A

1.9 Post Award/Kickoff Conference

The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5 and HUD Acquisition Regulation (HUDAR) clause 2452.237-79 - Post Award Conference.

1.10 Status Meetings

The Contracting Officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the Contractor to also review Contractor performance, requirement status, etc. At these meetings, the Contracting Officer will apprise the Contractor of how the Government views the Contractor's performance or progress of the requirement. The Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government. Post Award Conference and subsequent meetings may be held via teleconference at the Contracting Officer's discretion.

1.11 Contractor Travel

Prior to travel, the Contractor shall coordinate with and receive Government authorization from the COR for all travel. Reimbursement of travel costs will be in accordance with the Federal Travel Regulation and in accordance with FAR 31.205-46.

1.12 Transition In

The Contractor shall, upon the Contracting Officer's written notice, furnish Transition-In services as required. As a successor, the Contractor shall have sufficient personnel on board during the 60 calendar days Transition-In period to ensure a smooth transition with the incumbent Contractor. The Contractor shall provide an orderly transition of work acceptance and accomplishment such that any impact to the program is minimized. During the Transition-In period, the Contractor shall become familiar with the requirements in order to commence full performance of services by the end of the contract Transition-In period. Transition-In is not required if the successor Contractor is the incumbent Contractor.

1.13 Transition Out

To minimize any decrease in productivity and to prevent possible negative impacts on additional services, the Contractor shall have sufficient personnel on board during the 90 calendar days Transition-Out period. The incumbent Contractor shall ensure a smooth transition with the successor Contractor during the Transition-Out period, prior to completion of contractual performance. The incumbent Contractor shall aid the successor in the development of plans, procedures, and methods for the assumption of all on going work. The Contractor shall provide an orderly transition of work acceptance and accomplishment, such that full control by the successor Contractor is achieved by the end of the new contract Transition-In period.

2 Definitions and Acronyms

2.1 Definitions

Business/Workdays - Every official work day of the week which are days between and including Monday to Friday. This does not include public holidays and weekends.

Calendar Day - Any day of the week.

Contractor - A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Contracting Officer (CO) - A person with authority to enter into, administer, and/or terminate contracts and make related determinations and findings on behalf of the Government. Note: the only individual who can legally bind the Government.

Contracting Officer's Representative (COR) - An employee of the U.S. Government appointed by the Contracting Officer to perform contract administration activities in regard to technical issues. This individual has authority to provide technical direction to the Contractor as long as direction is within the scope of the contract, does not constitute a change and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

Defective Service - A service output that does not meet the standard of performance associated with the Performance Work Statement.

Deliverable - Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

eNote - An electronic promissory note that was signed electronically as part of an eClosing (originated and produced as a SMART Doc).

ESIGN - The ESIGN Act is a federal law passed in 2000. It grants legal recognition to electronic signatures and records if all parties to a contract choose to use electronic documents and to sign them electronically.

eVault - A repository that provides certification, safekeeping and status reporting for electronically created and signed mortgage documents. eVaults are used primarily for eNotes but may also store other loan documents. eVaults must be integrated with MERS eRegistry to update status of the Note on the registry.

Government Furnished Property (GFP ) - Government-furnished property means property in the possession of, or directly acquired by, the Government and subsequently furnished to the Contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification. Government-furnished property also includes contractor-acquired property if the contractor-acquired property is a deliverable under a cost contract when accepted by the Government for continued use under the contract.

MERS - Mortgage Electronic Registration Systems, Inc. (MERS) is an American privately held corporation, which owns and operates an electronic registry known as the MERS system, which is designed to track servicing rights and ownership of mortgages in the United States.

MERS eDelivery - Provides a secure method for distributing documents in any electronic format (SMART Doc, PDF, TIFF, etc.) from one MERS eRegistry user to another, using the existing MERS eRegistry infrastructure and transaction security requirements.

MERS eRegistry - The system of record that identifies the controller (owner with right to enforce) and location (custodian) of the authoritative copy (enforceable version) of an eNote.

MISMO - is the standards development body for the mortgage industry. MISMO developed a common language for exchanging information for the mortgage finance industry.

Performance Requirements Summary (PRS) - A listing of the performance requirements under the contract that are to be evaluated by the Government on a regular basis, performance indicators for these requirements, performance standards for these requirement and surveillance methods to be used to determine if performance standards are met.

Performance Standard - The Contractor's performance level required by the Government.

Performance Work Statement (PWS) - A statement of work for performance based acquisitions that describe the required results in clear, specific and objective terms with measurable outcomes.

Physical Security - Actions that prevent the loss or damage of Government property.

Pilot - A small scale preliminary study conducted in order to evaluate feasibility, time, cost, adverse events, and improve upon the study design prior to performance of a full-scale research project.

Quality Assurance (QA) - Policies and procedures adopted by the Government to ensure that supplies and services acquired under Government contracts conform to the contracts quality requirements.

Quality Assurance Surveillance Plan (QASP) - A plan describing how the agency will survey, observe, test, sample, evaluate and document the Contractor's performance in meeting critical performance standards identified in the contract.

Quality Control (QC) - All necessary measures taken by the Contractor to assure that the quality of an end product of service shall meet contract requirements.

Service Contract - A contract that directly engages the time and effort of a Contractor whose primary purpose is to perform an identifiable task rather than to furnish an end item of supply.

Secured Party Field - Field within MERS eRegistry that identified an entity that has been assigned a right or interest by the Controller.

Subcontractor - Any person, other than the prime Contractor, who offers to furnish or furnishes any supplies, material, equipment, or services of any kind under a prime contract or a subcontract entered into in connection with such prime contract, and any person who offers to furnish or furnishes general supplies to the prime contractor or a higher tier subcontractor. The Government does not have privity of contract with a subcontractor.

Trailing eDoc - An electronic equivalent of the collateral documents currently required by Ginnie Mae for final pool certification.

Work Week - Monday through Friday, unless specified otherwise.

2.2 Acronyms

AQL - Acceptable Quality Level ARAMS - Automated Renewal and Amendment System

ARM Adjustable Rate Mortgage

BAA - Business Area Analysis Study

CBT - Computer-Based Training

CCB - Change Control Board

CCMB - Configuration Change Management Board

CMMI - Capability Maturity Model Integration

CFO or OCFO - Office of the Chief Financial Officer of HUD

CFPB Consumer Financial Protection Bureau

CFR - Code of Federal Regulations

CIO or OCIO - Office of the Chief Information Officer of HUD

CMO Collateralized Mortgage Obligation

CO - Contracting Officer

COR - Contracting Officer's Representative

COR - Contracting Officer Representative

COTS - Commercial Off-the-Shelf

COVID Coronavirus Disease

CPO - Office of the Chief Procurement Officer of HUD

CPR Conditional Prepayment Rate

CRT Credit Risk Transfer

EST - Eastern Standard Time (U.S.)

ETC - Estimate to Completion

ESG Environmental, Social, and Governance

FFIEC Federal Financial Institutions Examination Council

FedRAMP - Federal Risk and Authorization Management Program

FHA Federal Housing Administration

FICO Fair Isaac and Company

FISCAM - Federal Information System Controls Audit

FISMA - Federal Information Security Management Act

FRED Federal Reserve Economic Data

GAO - U.S. General Accounting Office

GFP Government Furnished Property

GNMA - Government National Mortgage Association, or "Ginnie Mae"

GSE Government Sponsored Enterprise

HECM Home Equity Conversion Mortgage

HMDA Home Mortgage Disclosure Act

HUD - U.S. Department of Housing and Urban Development

HUDAR - HUD Acquisition Regulation

HUD/ISG - Internet Services Group within the Telecom Processing Division

HUD Web - HUDs Intranet Web Site and related WEB pages.

IG or OIG - Inspector General (Office of)

IOPP Issuer Operational Performance Profile

IT - Information Technology

IV&V - Independent Validation and Verification

LIBOR - London Inter-Bank Offered Rate

LOCCS - Line of Credit Control System

LTV Loan to Value

MERS - Mortgage Electronic Registration Systems, MBS Mortgage Backed Securities

MIN - Mortgage Identification Number

NSP - Not Separately Priced

OCPO - Office of the Chief Procurement Officer

ODC Other Direct Costs

OIG - Office of Inspector General

OIPM - Office of Issuer and Portfolio Management

OMB - Office of Management and Budget

PIH - Public and Indian Housing program

PL - Public Law

PLF Principal Limit Factor

PM - Project Manager

POC - Point of Contact

PPM - Project Planning and Management

PMP Project Management Plan

QA - Quality Assurance

QASP - Quality Assurance Surveillance Plan

QCP - Quality Control Plan

REMIC - Real Estate Mortgage Investment Conduit

SF - Standard Form

SOP Standard Operating Procedure

TBD - To be determined

TIC - True Interest Cost

UETA - Uniform Electronic Transactions Act (UETA)

U.S.C - United States Code

USDA - United States Department of Agriculture

UAT - User Acceptance Testing

VA Veterans Administration

WALA -Weighted Average Loan Age

3 Government-Furnished Property and Services

The Contractor shall ensure accurate control and accountability of all Government-Furnished Property in accordance with the terms and conditions of this contract. The Government will furnish, at no cost to the Contractor, the GFP shown below.

3.1 Government Services

No Government services will be provided in this contract.

3.2 Facilities

No facilities will be provided by the Government.

3.3 Equipment

The Government will not provide any equipment to the Contractor.

3.4 Materials and Information

See HUDAR 2452.227-70, Government Information The Government shall provide the following materials and information (insert materials and information):

3.5 Quality Assurance (QA)

The Government shall evaluate the Contractor's performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable quality level.

4 Contractor-Furnished Items and Services

The Contractor shall furnish, all facilities, equipment, and supplies required to perform the work under this contract that are not listed under Government-Furnished Property and Services.

4.1 Facilities

The contractor shall furnish their own facilities, sufficient to meet and satisfactorily perform the requirements contained in this PWS.

4.2 Equipment

The Contractor shall furnish all equipment required to perform the duties of this contract.

4.3 Materials

The contractor shall furnish all material and equipment necessary to perform all requirements. Except those mentioned in Section 3.4.

4.4 Contractor Responsibilities

The Contractor shall only conduct business with designated Government personnel listed as points of contact (POCs). Names of authorized personnel shall be provided to the Contractor by the Government, in writing, and updated as necessary throughout the contract period of performance.

U.S. Government records, copies of original results and reports, verified original data, corrected data, and corrected supporting final reports which are maintained by the Contractor remain the property of the U.S. Government. These files/results must be surrendered to the COR.

4.5 Contractor Personnel

See HUDAR clause 2452.237-70 - Key Personnel in the Key Personnel section of the contract.

4.6 Identification of Contractor Employees

All Contractor/subcontractor personnel shall wear company picture identification badges as to distinguish themselves from Government employees. When conversing with Government personnel during business meetings, over the telephone, or via electronic mail, Contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees. Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation. Where practicable, Contractor/subcontractors occupying collocated space with their Government program customer shall identify their workspace area with their name and company affiliation, or at a minimum, "Contractor" after name.

5 Specific Tasks

5.1 Project Management

The Contractor shall perform project management tasks for project planning, status reporting, and production monitoring.

5.1.1 Project Work Plan

The Contractor shall perform project management tasks for project planning, status reporting, and production monitoring.

The Contractor shall create and maintain a Project Work Plan for eVault that adheres to HUD's system development standards for Project Work Plan preparation for accomplishing the tasks of this PWS. The Project Work Plan shall include a detailed description of all tasks, itemized deliverables, schedule, resource estimates, and identification of any risks and risk mitigation strategies for the completion of all tasks. Initial Project Work Plan shall be submitted to the COR at the Kickoff meeting. The government will make comments on the Initial Project Work Plan. The contractor shall incorporate these comments into the final Project Work Plan and return it to the government for approval within five (5) business days. Each Project Work Plan shall include a Work Breakdown Structure (WBS) and Project Schedule in MS Project format. The Contractor shall update the narrative and WBS Project schedules as tasks are assigned by the COR, with updates occurring monthly with submission to the COR within 5 business days after the end of the month. The contractor shall be responsible for recording meeting minutes during the kickoff meeting. The contractor shall provide a copy of the meeting minutes 5 business days from the end of the kickoff meeting.

Performance Standards

a) Standard: The contractor shall submit their Initial Project Work Plan at the Kickoff Meeting.

AQL: Zero Deviation

b) Standard: The contractor shall provide the Final Project Work Plan within 5 business days of receiving government approval AQL: Two business days

c) Standard: Project Work Plans are submitted within 5 business days after the end of the reporting month.

AQL: Two business days Deliverables A001 Initial Project Work Plan A002 Final Project Work Plan A003 Updated Project Work Plan

5.1.2 Monthly Project Status Report

The Contractor shall submit to the COR a Monthly Project Status Report for eVault providing the activities performed and progress of each task supported under the PWS. The Monthly Project Status Report shall be current as of the last business day of the month. The contractor shall provide a Monthly Project Status Report five business days after the end of the month. The report shall:

· Provide a brief, summary of technical progress made for each PWS task during the reporting period.

· Identify significant problems and their impacts, causes, proposed corrective actions, and the effect that such corrective actions will have on the accomplishments of the contract objectives.

· Provide schedule status and degree of completion of tasks/activities by time intervals.

Performance Standards

a) Standard: The contractor shall provide a Monthly Project Status Report five business days after the end of the month.

AQL: Two business days Deliverables A004 Monthly Project Status Report

5.1.3 Coordinate a Kick-Off Meeting

The contractor shall attend an in-person or virtual Project Kick-Off Meeting approved by the Government. The meeting will provide an introduction between the contractor personnel and Government personnel who will be involved with the contract. The meeting will provide the opportunity to discuss technical and management aspects of the contract. At a minimum, the attendees shall include representatives performing the work.

At least three days prior to the Kick-Off Meeting, the contractor shall provide a Kick-Off Meeting Agenda for review and approval by the COR. The agenda shall include, at a minimum, the following topics/deliverables:

i. Points of contact (POCs) for all parties.

ii. Discuss Implementation that includes schedule and tasks, etc.

iii. Security discussion and requirements (i.e., building access, badges, common access cards (CACs).

iv. Personnel discussion (i.e., roles and responsibilities and lines of communication between contractor and Government).

v. Invoicing requirements.

vi. Transition-Out discussion.

vii. Discuss Contractor Quality Control Methods.

The contractor shall be responsible for recording meeting minutes during the kickoff meeting. The contractor shall provide a copy of the meeting minutes 5 business days from the end of the kickoff meeting.

Performance Standards

a) Standard: The contractor shall provide a kickoff meeting agenda at least 3 business days prior to the kickoff meeting.

AQL: Zero Deviation

b) Standard: The contractor shall provide a copy of the meeting minutes 5 business days from the end of the kickoff meeting.

AQL: Zero Deviation

A006 Kickoff Meeting Minutes

5.2 eVault

5.2.1 eVault Production and Operations

The contractor shall provide an eVault system accessible to Ginnie Mae and its agents to use as secure storage for eNotes and other electronic loan files, including Title Insurance Policies, HUD prescribed forms, and security instruments ("Trailing eDocs) that meets the following specifications:

· Be fully integrated with the MERS eRegistry.

· Interface with MERS eRegistry seamlessly and enable Ginnie Mae to update the MERS eRegistry as needed to reflect Ginnie Maes status as a rights holder to the eNote for the life the corresponding loan, or for any other time period prescribed by Ginnie Mae.

· Have the capability to transfer eNotes and any other eDocs in eVault System to another eVault using MERS eDelivery.

· Be capable of establishing a relationship between an eNote and other eDocs related to the same loan such that end users are capable of accessing all documents stored within an eVault that relate to the same loan.

· Support eNote paper out process and deactivation.

· Support inquiries regarding the status of, or to obtain summary information for, eNote Records on the MERS eRegistry

· Display the current Rightsholder positions for eNote Records on the MERS eRegistry

· Be a web-based turnkey solution offered as a web-service.

· Provide true electronic vaulting capabilities with a minimum of effort.

· Cloud Platform must meet and comply with federal requirements. Contractor must comply with information technology security requirements as stated in contract terms.

· Enable document accessibility through a centralized and privileged platform.

· This platform shall be installed behind a firewall and tightly integrated to existing processes, while allowing authorized, third-party access.

· Support the Mortgage Industry Standards Maintenance Organization (MISMO) industry standard document version in which the eNote or other eDocs were originally created for the life of loan.

· Allow for the encryption of documents and wrapping them in a Tamper-Evident Seal to instantly identify and reject unauthorized document modifications. This shall, at a minimum, include detailed audit trails that establish both compliance and veracity of electronically signed documents.

· Verify document integrity including, but not limited to, compliance with eNote Document Type Definition ("DTD) or schema and eNote Tamper Evident Seal before accepting documents.

· Log the validations of eNotes and any other SMART Documents Tamper Seals in a manner that allows Ginnie Mae to validate the same.

· Support one or more authentication methods to authenticate user access.

· Be capable of identifying whether an eNote being stored is the Authoritative Copy or a copy of the Authoritative Copy.

Performance Standards

a) Standard: The contractor shall provide an eVault system that can meet the performance specifications listed in this section of the PWS.

AQL: Zero Deviation

5.2.2 eNote Transaction Volume Requirements

The contractor shall execute transactions that update the rights holder filed in the MERS eRegistry for a minimum of 50,000 eNotes per year, including for example, transactions that execute transfers of control and/or location. The various fields in the eRegistry for each eNote may be updated several times each year.

Performance Standards

a) Standard: The contractor shall execute transactions that update the rights holder filed in the MERS eRegistry for a minimum of 50,000 eNotes per year, including for example, transactions that execute transfers of control and/or location.

AQL: Zero Deviation

5.2.3 eNote Storage Volume Requirements

The contractor shall have the capacity over the life of the awarded contract to store a minimum of 150,000 copies of the Authoritative Copy of the eNotes for which Ginnie Mae is identified as a rights holder as well as other related eDocs for each such note, including but not limited to copies of title insurance policies or other digitized loan closing files or pool/loan package files.

Performance Standards

a) Standard: The contractor shall have the capacity over the life of the awarded contract to store a minimum of 150,000 copies of the Authoritative Copy of the eNotes for which Ginnie Mae is identified as a rights holder as well as other related eDocs for each such note, including but not limited to copies of title insurance policies or other digitized loan closing files or pool/loan package files.

AQL: Zero Deviation

5.2.4 Batch/Bulk Processing Requirements

The contractor shall provide end users with the ability to initiate MERS eRegistry transactions in batch or bulk to change the current Controller, Location, Secured Party, Master Servicer, and/or Subservicer for multiple eNotes at a time (Ginnie Mae understands that the eRegistry will accept/perform each such transaction sequentially when submitted via a bulk transaction) even in cases when the Authoritative Copy of the eNote is not changing location. The eVault must also be able to execute batch or bulk transfers of location and control of the Authoritative Copy such that the Ginnie Mae acquired eVault becomes the location of the Authoritative Copy.

Performance Standards

a) Standard: The contractor shall provide an eVault system can meet the batch/bulk processing requirements of this section in the PWS.

AQL: Zero Deviation

5.2.5 eVault Licensing and User Credentials

The contractor shall provide Ginnie Mae with any and all necessary user and/or software licenses or credentials necessary for Ginnie Mae employees or third-party agents to access the documents stored in the eVault and execute the transactions described in Section 5.2.2 Licenses must be fully transferrable to Ginnie Mae.

Performance Standards

a) Standard: The contractor shall provide licensing and user credentials within 5 business days from contract award AQL: Zero Deviation

A007 eVault Licensing and User Credentials

5.2.6 Production Monitoring

Production monitoring shall include:

· Monitoring production processes which include both overnight batch processes and daytime system operations.

· Designating "on call" technical support personnel to be contacted by production personnel in event of a problem. The Contractor shall provide via email within five (5) business days of contract award the contact information for the "on call technical support personnel. The Contractor shall inform the COR via email of any changes to "on call" technical support contact information two (2) business days prior to change.

· Notifying the COR within one hour of detection via email in the event of a failed process or system component. The Contractor shall conduct an analysis of the problem, propose a solution, and provide periodic updates at an established interval via email to the COR until problem is resolved.

Performance Standards

a) Standard: The Contractor shall provide via email within five (5) business days of contract award the contact information for the "on call technical support personnel.

AQL: Zero Deviation

b) Standard: The Contractor shall inform the COR via email of any changes to "on call" technical support contact information two (2) business days prior to change.

AQL: Zero Deviation

c) Standard: 100% of notification emails are submitted within one hour of problem detection.

AQL: 5% deviation from standard.

Deliverables A008 On-Call Technical Support Email A009 Failed Process Notification Email A010 Solution Recommendation Report A011 Periodic Problem Update Email

5.2.7 eVault Maintenance

The Contractor shall fix application problems caused by design, logic, or coding errors, and implement that solution into production. This type of maintenance is usually triggered by an explicit service desk system item and involves errors that shall be investigated immediately. Maintenance includes data quality management and correction of software application errors. Examples of maintenance include:

· Calculations that generate incorrect totals.

· Data screens that omit a required entry or store an entry in the improper location.

· Aborted programs.

· Incorrect Reporting Results

Performance Standards

a) Standard: The contractor shall conduct continuous maintenance of the eVault system to ensure the system is functioning properly.

AQL: Zero Deviation

5.2.8 Post-Implementation Help-Desk Technical Support

The contractor shall provide live technical support services for Ginnie Mae eVault users between the hours of 9:00 am EST and 5 pm EST, excluding federal holidays and weekends. For each technical support request, the vendors technical support staff shall be reachable within 2 hours from Ginnie Maes initial contact. A log of all inquiries should be maintained. A monthly report on the disposition of all tickets shall be submitted to the Government at the end of the month. The Government anticipates no more than 5-10 calls per week.

Performance Standards

a) Standard: The contractor shall be reachable within 2 hours from Ginnie Maes initial contact.

AQL: Zero Deviation

b) Standard: The contractor shall provide a monthly report on the disposition of all tickets at end of the month.

AQL: Zero Deviation

A012 Monthly Help Desk Ticket Report

5.2.9 The Contractor shall correct application software errors.

The Contractor shall perform the analysis, design, software modifications, testing and documentation activities required in implementing software corrections to application errors caused by design, logic, or coding errors.

At the request of the COR, the Contractor shall perform analysis and develop an Analysis Report to identify impacts to system and interfaces due to software errors.

Upon receipt of approval from the COR, the Contractor shall modify affected programs and data structures, conduct testing, create test report, and review and update supporting system documentation to reflect the corrections. The Contractor shall migrate software files to designated repositories and update the associated service desk ticket.

Each correction shall require a software release which shall provide the government with information about the change.

Performance Standards

a) Standard: 95% of application software corrections require no further software releases.

AQL: 5% deviation from standard.

5.2.10 API Integrations

The contractors eVaults Application Programming Interface (API) shall:

· Allow for a seamless integration with Ginnie Mae systems or have the capability to buildout integrations to enable potential auto-certification solutions and/or external interfaces.

· The contractor shall ensure that no data/functionality is exposed.

Performance Standards

a) Standard: The contractors eVault Application Programming Interface shall posse integration requirements outlined in section 5.4 of the PWS.

AQL: Zero Deviation

5.2.11 System Integration

The Contractor shall provide System Integration Services to manage the complexity associated with technological changes from Planning and Execution of the solution. Integration services include but are not limited to, functional and testing services, program management functions, solution and platform integration and systems development solutions.

The Contractor shall configure the necessary interfaces. Necessary interfaces requiring configuration will be determined during the design of the application. Once changes have been made to the integrated components and systems, the Contractor shall validate the configurations by conducting testing. The Contractor shall perform all integrator roles throughout the period of performance.

The Contractor shall execute internal and integrate functional unit testing on the eVault solution to verify each component has been installed and configured successfully. The Contractor shall support QA Testing in System Integration Testing, as well as Operations testing and IV&V testing in the UAT environment. The Contractor shall resolve or mitigate findings related to security and performance scans as required by Ginnie Mae. The Contractor shall package and provide instructions for deploying the packages to the Production environments.

The Contractor shall perform activities, as directed by the COR, to any of Ginnie Maes existing applications, systems, databases and Application Infrastructure as well as any new applications. The Contractor shall assist in testing to ensure that the applications and/or changes to work properly. This shall be subject to further testing and approval by Ginnie Mae.

Performance Standards

a) Standard: The Contractor shall provide System Integration Services to ensure eVault system properly interfaces with other applications.

AQL: Zero Deviation

5.2.12 Disaster Recovery Requirements

The contractor shall have:

A Disaster Recovery (DR) Plan and procedures that enable institutions to rapidly recover mission-critical data stored in the eVault. The contractor shall provide their DR Plan 5 business days after contract award. The contractor shall conduct a DR Test on an annual basis and provide the results to Ginnie Mae.

Performance Standards

a) Standard: The contractor shall conduct a DR Test on an annual basis and provide the results to Ginnie Mae.

AQL: Zero Deviation

b) Standard: The contractor shall provide their DR Plan 5 business days after contract award.

AQL: Zero Deviation

AQL: Zero Deviation Deliverables A013 DR Plan A014 DR Test

5.2.13 Support Compliance with eCommerce Laws

The contractor shall support the storage of eNotes and Trailing eDocs in a manner that is consistent with the provisions of UETA and ESIGN as applicable by safeguarding the reliability of the documents, supporting paper-out procedures, as well as de-registration and deactivation of eNotes from MERS eRegistry.

Performance Standards

a) Standard: The contractor shall ensure the storage of eNotes and Trailing eDocs in a manner that is consistent with the provisions of UETA and ESIGN AQL: Zero Deviation

5.2.14 eVault Environment for Testing Upcoming Code Releases and Patches

The contractor shall provide a test environment, other than the UAT environment identified in Section 5.9, that supports test execution with hardware, software and network that is configured as per the need of the development and testing users for unit testing, system testing and/or integration testing of programming that has not been incorporated or deployed in the production environment. The contractor shall provide this testing environment within 5 business days of contract award. The Contractor shall provide patches as they become available for Ginnie Mae testing in the test environment.

Performance Standards

a) Standard: The Contractor shall provide a test environment, other than the UAT environment identified in Section 5.9, that supports test execution with hardware, software and network within 5 business days of contract award.

AQL: Zero Deviation

A015 eVault Testing Environment

5.2.15 eVault Environment for User Acceptance Testing

In addition to the production eVault identified in Section 5.2, the contractor shall also provide an eVault/eVault environment that replicates the production environment in a manner that is sufficient to conduct user acceptance testing ("UAT). During UAT, software users will test the software to make sure it can handle required tasks in real-world scenarios, according to specifications, and to identify issues. The contractor shall provide the UAT Testing environment within 5 business days of contract award.

Performance Standards

a) Standard: The contractor shall provide the UAT Testing environment within 5 business days of contract award.

AQL: Zero Deviation

5.2.16 Reporting

The contractor shall provide summary reports for event logs as specified under Standard/Audit Reporting, as well as ad hoc reports under Post-Implementation Custom Reporting as specified under Section 5.2.16 of this solicitation.

Performance Standards

a) Standard: The contractors eVault system shall be able to generate the reporting requirements of Sections 5.2.16, 5,2.16.1 and 5.2.16.2 of the PWS.

AQL: Zero Deviation

5.2.16.1 Standard Audit/Reporting

The eVault solution shall provide a suite of standard system audit and use reports including event detail and summary reports relating to event logs, document inventories, eNote registration, eNote transfers, eDelivery events, eNote validations, and Ginnie Mae rights holder status by MERS Mortgage Identification Number (MIN).

5.2.16.2 Post-Implementation Custom Reporting

The contractor shall have technical staff available to perform ad hoc functions required by Ginnie Mae after the initial implementation, consisting of custom reports that are requested by the Government. The custom reports shall include any combination of fields reflected or captured by the eVault system. Once developed, the government must be able to reproduce and retrieve the report at any time without contractor intervention. The government estimates a need for up to six custom reports in the base year and approximately up to three custom reports in the option years.

5.2.17 Data Security and System Availability Standards

The contractors eVault shall:

· Be a Federal Information System Controls Audit Manual (FISCAM)/ Federal Information Security Management Act (FISMA)-Certified Platform and shall implement security operations that ensure compliance with these standards.

· Be available 99.99% of the time and only considered unavailable when the servicer goes offline.

· Support operability in accordance with the required service levels. Automated and/or manual component testing shall be in place and performed to prevent threats and ensure recoverability.

· Prevent unauthorized viewing of the most sensitive data and documents through restricted access.

Performance Standards

a) Standard: The contractor shall maintain security and availability standards in accordance with requirements in 5.3 of the PWS.

AQL: Zero Deviation

5.2.17.1 Federal Information Technology Security

A Contractor/employee will operate a federal system and information technology containing data that supports the Ginnie Mae mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

5.2.17.2 Requirements for Safeguarding Information and Information Systems

Adopt and implement policies, procedures, controls, and standards required by the Ginnie Mae Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract based on National Institute of Standards and Technology (NIST) "Framework for Improving Critical Infrastructure Cybersecurity. The framework contains the five (5) core functions to "Identify, "Protect, "Detect, "Respond (to), and "Recover (from) any cybersecurity event.

The contractor will use, maintain, enhance, and develop all information technology software and systems under this contract in accordance with Federal Laws, best practices, and regulations. This includes, but is not limited to:

· Federal Information Security Management Act - https://www.dhs.gov/fisma

· The Clinger-Cohen Act - https://www.fismacenter.com/Clinger%20Cohen.pdf

· Government Paper Reduction Act - http://www.hhs.gov/ocio/policy/collection/

· Office of Management, and Budget Circulars A-130, and A-I23 - https://www.whitehouse.gov/omb/circulars_default

· Department of Housing and Urban Development regulations, Handbooks and Policies - http://www.HUD.gov.

· All Applicable Ginnie Mae Handbooks and Policies http://www.ginniemae.gov

· GAO directives

· Federal Financial Manager Integrity Act (FFMIA)

· FedRAMP Authorization Act https://www.fedramp.gov

· Applicable Executive Orders and Office and Management and Budget (OMB) Memorandums for Federal Information Systems

5.2.17.3 Privacy Requirements

Comply with the Privacy Act of 1974 requirements, NIST SP 800-122, Guide to Protecting the Confidentiality of PII, with the Federal Information Security Modernization Act (FISMA) and with the OMB Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, and with all HUD and/or Ginnie Mae privacy publications. Per Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII) is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual. Examples of PII include, but are not limited to the following: social security number, date and place of birth, mothers maiden name, biometric records, etc.