PWS DRAFT - VRM.docx

Performance Work Statement (PWS) Third Party / Vendor Risk Management (VRM) Program

Version 2.0

Performance Work Statement (PWS) Third Party / Vendor Risk Management (VRM) Program Vision Statement

To strengthen the Vendor Risk Management Program (VRM) to enable an optimized approach to the identification and remediation of third party / vendor compliance issues as well as implementation of effective risk mitigation strategies through consistent reporting and monitoring of Ginnie Mae's vendors.

1 General Information

1.1 Scope of Work

The U.S. Department of Housing and Urban Development (HUD), Government National Mortgage Association (Ginnie Mae) Office of Enterprise Risk (OER) requires contractor support to strengthen for the continued enhancement, administration, and execution of its Third Party / Vendor Risk Management (VRM) Program, service organization monitoring, and risk mitigation and Information Technology (IT) governance support.

The Contractor shall assist the Ginnie Mae OER, Operational Risk Analysis Division (ORAD) with the continued administration, execution, and enhancement of its VRM Program. The VRM Program will provide oversight of Ginnie Mae vendors and related staff to ensure their activities are conducted in compliance with vendor contract requirements and stated applicable laws and regulations.

The Contractor will perform annual VRM assessments for Ginnie Mae’s vendors using Ginnie Mae’s VRM Framework. The Contractor will also provide service organization monitoring and risk mitigation and Information Technology Governance support. The Contractor will provide the following services which shall include:

· Program Management

· Updates to VRM Framework

· Vendor Assessments

· Service Organization Monitoring and Risk Mitigation

· Information Technology Governance

· Governance Document Updates

· Training Services

· Special Projects

· Transition Services (if needed) Detailed descriptions of specific tasks are provided in Section 5 Specific Tasks and Deliverables.

Once contract is awarded, if the awardee is viewed as a competitor by a Ginnie Mae vendor subject to review, the awardee will be required to sign a mutually agreeable Non-disclosure Agreement (NDA) with the Ginnie Mae vendor before conducting the applicable VRM Assessment.

1.2 Background

The U.S. Department of Housing and Urban Development (HUD) Government National Mortgage Association (Ginnie Mae) is seeking Contractor support to execute the VRM Program, an internal assessment of third-party vendors with a primary focus on mission critical vendors that support our essential functions. Ginnie Mae defines VRM as the programmatic approach to identifying, assessing and managing risks associated with engaging third parties to provide goods and services or act as an agent on behalf of the organization to support the organization’s business goals.

Ginnie Mae’s vision for the VRM program is to facilitate improved decision-making through a structured understanding of opportunities and threats as well as implementing strategies to ensure effective use of resources, enable an optimized approach to the identification and remediation of compliance issues, and promote consistent reporting and monitoring of vendors across business units. Full ownership of VRM must occur at all levels of the organization to promote effective and efficient operations in order to reduce risks to acceptable tolerance levels.

Ginnie Mae’s VRM Framework objectives are to:

· Update Vendor Segmentation Workbook of existing or potential vendor relationships.

· Obtain relevant vendor related background information to assist Ginnie Mae in our assessment of selected vendors.

· Evaluate vendor effectiveness to determine whether vendor or third-party performance is in line with procurement specifications and business needs.

· Identify residual risks to services / products purchased by Ginnie Mae and identify deficiencies resulting from assessments.

· Report and present to executive management and other stakeholders’ risks of adverse events caused by or affecting Ginnie Mae’s vendors and/or material third parties as it pertains to Ginnie Mae’s operations.

· Engage and work collaboratively with business owners to create plans of action to address and resolve identified gaps.

Ginnie Mae’s VRM Framework is a six-part dynamic and iterative-phased methodology which includes: (1) Plan, Define Risks, and Scope Assessment; (2) Information Gathering; (3) Assess Documentation and Management of Vendors; (4) Identify Gaps, Analyze Risks, and Rate Vendors; (5) Report and Communicate Assessment Status and Results; and (6) Implement Mitigation Strategies and Recommendations.

This approach to managing third-party risks assists Ginnie Mae in providing comprehensive internal controls and ongoing management of major vendor risks inherent in Ginnie Mae’s business activities.

1.3 Constraints

The services identified in this requirement will adhere to the rules, regulations, laws, standards, and conventions identified by HUD as well as within the Federal Government. Constraints include the following and any subsequent updates:

SSAE No. 18, Attestation Standards: Clarification and Recodification, (April 2016) https://ssae-18.org/wp-content/uploads/2017/04/SSAE_No_18.pdf AT-C Section 320 Reporting on an Examination of Controls at a Service Organization Relevant to User Entities Internal Control Over Financial Reporting https://assets.ctfassets.net/rb9cdnjh59cm/49M1391nsNvsSx6gou3EKW/d0e0475caf4596239d342b35acfabe4d/at-c-sections-100-300.pdf Committee of Sponsoring Organizations’ (COSO), Enterprise Risk Management Framework https://www.coso.org/erm-framework The Green Book, Standards for Internal Controls in the Federal Government https://www.gao.gov/assets/gao-25-107721.pdf

U.S. Department of Housing and Urban Development Acquisition Regulation (HUDAR) https://www.acquisition.gov/hudar Federal Acquisition Regulation https://www.acquisition.gov/browse/index/far Interagency Guidance on Third-Party Relationships: Risk Management https://www.govinfo.gov/content/pkg/FR-2023-06-09/pdf/2023-12340.pdf Federal Information Security Modernization Act of 2014 https://www.congress.gov/113/plaws/publ283/PLAW-113publ283.pdf As well as Federal Information System Controls Audit Manual (FISCAM) and National Institute of Standards and Technology (NIST) standards and regulations such as the Electronic Funds Transfer Act, Fair Debt Collection Practices Act, HIPAA, Real Estate Settlement Procedures Act (RESPA) and Foreign Corrupt Practices Act, among others.

1.4 Non-Personal Services

The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual Contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services.

If the Contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the Contractor's responsibility to notify the Contracting Officer (CO) immediately. These services shall not be used to perform work of policy, decision making, or management nature, i.e., inherently Government functions. All decisions relative to programs supported by the Contactor shall be the sole responsibility of the Government.

1.5 Period of Performance

The Period of Performance shall be a 12-month base with four (4) 12-month option periods.

1.6 Place of Performance

The services to be performed under this contract shall be performed at Contractor’s facilities, except for when the Contractor may be called to the government or vendor facility to attend meetings and conduct VRM interviews.

1.7 Hours of Operation

The Contractor is responsible for providing services between the hours of 8:00am to 5:00pm, Monday thru Friday except for Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closing, or similar Government directed facility closings. The Government reserves the right to change hours of operation or restrict contractor access. Work outside of these daily hours is prohibited without Contracting Officer approval. Government agencies will not be available during scheduled holidays, inclement weather, weekends, and after-duty hours.

The Contractor shall always maintain an adequate workforce for the uninterrupted performance of all tasks defined within the contract when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce is essential.

1.8 Special Qualifications

The Contractor shall have the following risk and compliance industry expertise in:

· Certified Public Accountant (CPA)

· Certified Information Systems Auditor (CISA)

· Certified Internal Auditor (CIA)

· Certified Fraud Examiner (CFE)

· Committee of Sponsoring Organizations (COSO)

· Certified Government Financial Manager (CGFM)

1.9 Post Award/Kickoff Conference

The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5 and HUD Acquisition Regulation (HUDAR Clause 2452.237.79 - Post Award Conference). The Government intends to convene a Post Award Conference with the Contractor within ten business days after contract award. The Contracting Officer will notify the Contractor of the specific date, location, and agenda within five (5) business days after contract award.

1.10 Status Meetings

The Contracting Officer, Contracting Officers Representative (COR), Program/Project Manager (PM) and other Government personnel, as appropriate, may meet periodically with the Contractor to review Contractor performance, requirement status, etc. At these meetings, the Contracting Officer will apprise the Contractor of how the Government views the Contractor's performance or progress of the requirement. The Contractor will apprise the Government of problems, if any, being experienced. Appropriate action should be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government. Post Award Conference and subsequent meetings may be held via teleconference.

1.11 Contractor Travel

Prior to travel, the Contractor shall coordinate with and receive Government authorization from the COR for all travel.

1.12 Transition In

The Contractor shall, upon the Contracting Officer's written notice, furnish transition-in services as required. As a successor, the Contractor shall have sufficient personnel on board during the 30 days transition-in period to ensure a smooth transition with the incumbent Contractor. The Contractor shall provide an orderly transition of work acceptance and accomplishment such that any impact to the program is minimized. During the transition-in period, the Contractor shall become familiar with the requirements in order to commence full performance of services by the end of the contract transition-in period. Transition-in is not required if the successor Contractor is the incumbent Contractor.

1.13 Transition Out

To minimize any decrease in productivity and to prevent possible negative impacts on additional services, the Contractor shall have sufficient personnel on board during the 30 days transition-out period. The incumbent Contractor shall ensure a smooth transition with the successor Contractor during the transition-out period, prior to completion of contractual performance. The incumbent Contractor shall aid the successor in the development of plans, procedures, and methods for the assumption of all on going work. The Contractor shall provide an orderly transition of work acceptance and accomplishment, such that full control by the successor contractor is achieved by the end of the new contract transition-in period.

2 Definitions and Acronyms

2.1 Definitions

Business/Workdays - Every official workday of the week which are days between and including Monday to Friday. This does not include public holidays and weekends.

Calendar Day - Any day of the week.

Contractor - A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Contracting Officer (CO) - A person with authority to enter into, administer, and/or terminate contracts and make related determinations and findings on behalf of the Government. Note: the only individual who can legally bind the Government.

Contracting Officer's Representative (COR) - An employee of the U.S. Government appointed by the Contracting Officer to perform contract administration activities regarding technical issues. This individual has authority to provide technical direction to the Contractor as long as direction is within the scope of the contract, does not constitute a change and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

Defective Service - A service output that does not meet the standard of performance associated with the Performance Work Statement.

Deliverable Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

Government Furnished Property (GFP) - Government-furnished property means property in the possession of, or directly acquired by, the Government and subsequently furnished to the Contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification. Government-furnished property also includes contractor-acquired property if the contractor-acquired property is deliverable under a cost contract when accepted by the Government for continued use under the contract.

Performance Requirements Summary (PRS) - A listing of the performance requirements under the contract that are to be evaluated by the Government on a regular basis, performance indicators for these requirements, performance standards for these requirements and surveillance methods to be used to determine if performance standards are met.

Performance Standard - The Contractor's performance level required by the Government.

Performance Work Statement (PWS) - A statement of work for performance-based acquisitions that describe the required results in clear, specific, and objective terms with measurable outcomes.

Physical Security - Actions that prevent the loss or damage of Government property.

Quality Assurance (QA) - Policies and procedures adopted by the Government to ensure that supplies and services acquired under Government contracts conform to the contracts’ quality requirements.

Quality Assurance Surveillance Plan (QASP) - A plan describing how the agency will survey, observe, test, sample, evaluate and document the Contractor's performance in meeting critical performance standards identified in the contract.

Quality Control (QC) - All necessary measures taken by the Contractor to assure that the quality of an end-product of service shall meet contract requirements.

Service Contract - A contract that directly engages the time and effort of a Contractor whose primary purpose is to perform an identifiable task rather than to furnish an end item of supply.

Subcontractor - Any person, other than the prime Contractor, who offers to furnish or furnishes any supplies, material, equipment, or services of any kind under a prime contract or a subcontract entered into in connection with such prime contract, and any person who offers to furnish or furnishes general supplies to the prime contractor or a higher tier subcontractor. The Government does not have privity of contract with a subcontractor.

Work Week - Monday through Friday, unless specified otherwise.

2.2 Acronyms

· AICPA - American Institute of Certified Public Accountants

· AQL - Acceptable Quality Level

· CAP – Corrective Action Plan

· CCB - Change Control Board

· CCMB - Configuration Change Management Board

· CMMI - Capability Maturity Model Integration

· CFO or OCFO - Office of the Chief Financial Officer of HUD

· CFR - Code of Federal Regulations

· CIO or OCIO - Office of the Chief Information Officer of HUD

· CO - Contracting Officer

· COR - Contracting Officer Representative

· COTS - Commercial Off-the-Shelf

· CPO - Office of the Chief Procurement Officer of HUD

· CSF - NIST Cybersecurity Framework

· CUEC - Complementary User Entity Controls

· ERM - Enterprise Risk Management

· EST - Eastern Standard Time (U.S.)

· ETC - Estimate to Completion

· FISCAM - Federal Information Systems Audit Manual

· FISMA - Federal Information Security Modernization Act of 2014

· GAO - U.S. General Accounting Office

· GFP - Government-Furnished Property

· HUD - U.S. Department of Housing and Urban Development

· HUDAR - HUD Acquisition Regulation

· HUD/ISG - Internet Services Group within the Telecom Processing Division

· HUD Web - HUDs Intranet Web Site and related WEB pages.

· IG or OIG - Inspector General (Office of)

· IT - Information Technology

· IV&V - Independent Validation and Verification

· KPI - Key Performance Indicator

· KRI - Key Risk Indicator

· MSS - Master Subservicer

· NIST - National Institute of Standards and Technology

· OCFO - Office of the Chief Financial Officer

· OCM - Office of Capital Markets

· OCPO - Office of the Chief Procurement Officer

· OEDTS - Office of Enterprise Data & Technology Solutions

· OER - Office of Enterprise Risk

· OI Operational Incident

· OIG - Office of Inspector General

· OIPM - Office of Issuer and Portfolio Management

· OMB - Office of Management and Budget

· OMO - Office of Management Operations

· OSO -Office of Securities Operations

· OSPPC - Office of Strategic Planning, Policy Communications

· ORAD - Operational Analysis Division

· PL - Public Law

· PM - Program Manager

· POA&M - Plan of Action and Milestones

· POC - Point of Contact

· PPM - Project Planning and Management

· PWS - Performance Work Statement

· QA - Quality Assurance

· QASP - Quality Assurance Surveillance Plan

· QCP - Quality Control Plan

· RCSA - Risk and Controls Self-Assessment

· SF - Standard Form

· SOC - System and Organization Controls

· SSAE 18 - Statement on Standards for Attestation Engagements

· TO Task Order

· TOD - Test of Design

· TBD - To be determined

· U.S.C - United States Code

· VRM Vendor Risk Management

3 Government-Furnished Property and Services The Contractor shall ensure accurate control and accountability of all Government-Furnished Property (GFP) in accordance with the terms and conditions of this contract. The Government will furnish, at no cost to the Contractor, the GFP shown below.

3.1 Government Services

The Government will not provide services.

3.2 Facilities

Facilities will not be provided.

3.3 Equipment

Equipment will not be provided.

3.4 Materials and Information

Copies of required materials may be provided to the Contractor in hard copy or soft copy. All materials will remain the property of the Government and will be returned to the COR upon request or at the end of the contract period.

3.5 Quality Assurance (QA)

The Government shall evaluate the Contractor's performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable quality level.

4 Contractor-Furnished Items and Services The Contractor shall furnish, all facilities, equipment, and supplies required to perform the work under this contract that are not listed under Government-Furnished Property and Services.

4.1 Facilities

The Contractor shall furnish all necessary facilities to meet the requirements.

4.2 Equipment

The Contractor shall furnish all required equipment to fulfill the requirements.

4.3 Material

The Contractor shall furnish all materials to meet the requirements.

4.4 Contractor Responsibilities

The Contractor shall only conduct business with designated Government personnel listed as points of contact (POCs). Names of authorized personnel shall be provided to the Contractor by the Government, in writing, and updated as necessary throughout the contract period.

U.S. Government records, copies of original results and reports, verified original data, corrected data, and corrected supporting final reports which are maintained by the Contractor remain the property of the U.S. Government. These files / results must be surrendered to the COR/PM.

4.5 Contractor Personnel

See HUDAR 2452.237-70 - Key Personnel in the Key Personnel section of the contract.

4.6 Identification of Contractor Employees

All Contractor/subcontractor personnel shall wear company picture identification badges as to distinguish themselves from Government employees. When conversing with Government personnel during business meetings, over the telephone, or via electronic mail, Contractor/ subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees. Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation. Where practicable, Contractor/subcontractors occupying collocated space with their Government program customer shall identify their workspace area with their name and company affiliation, or at a minimum, "Contractor" after name.

5 Specific Tasks

5.1 Task One - Program Management

The Contractor shall provide program management support under this task order (TO). This includes the management and oversight of all activities performed by contractor personnel, including subcontractors, to satisfy the requirements identified in this TO.

5.1.1 Weekly Status Meetings & Reports

The Contractor will meet with the COR/PM and other Government personnel weekly to review Contractor performance, contract requirements, engagement status, etc. The Contractor shall apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. The Contractor shall provide the COR minutes of these meetings, including attendance, issues discussed, decisions made, and action items assigned, within two (2) business days following the meeting.

The Contractor PM shall develop and provide a Weekly Status Report using Microsoft (MS) Office Suite applications to the COR/PM in accordance with the PWP). The Weekly Status Report shall include, at a minimum:

· Activities during reporting period, by task (on-going activities, new activities, activities completed; progress to date on all above-mentioned activities). Start each section with a brief description of the task.

· Problems, risks, issues, and corrective actions taken or proposed resolutions to address them.

· Personnel gains, losses, and status (security clearance, etc.).

· Government actions required.

· Schedule (show major tasks, milestones, and deliverables; planned and actual start and completion dates for each).

· Accumulated invoiced cost for each CLIN up to the previous month.

· Projected cost of each CLIN for the current month.

a) Standard: Completes the Weekly Status Reports in accordance with the PWP.

AQL: Zero deviation, unless discussed and agreed upon by the COR.

b) Standard: Quality - The Weekly Status Reports are accurate, free of grammatical errors, and contain all required information.

AQL: The Weekly Status Reports shall conform to the established requirements of the project with minimal revisions due to less than adequate requirements or analysis.

Deliverables A001 Weekly Status Reports

5.1.2 Project Work Plan

The Contractor shall submit a Project Work Plan (PWP) for the contracted services within five (5) business days of contract award. Changes to the PWP shall be reviewed and accepted by the COR/PM prior to work beginning. The PWP shall be updated annually. Provisions will be established to update the PWP at appropriate junctures, as directed by the COR/PM.

The PWP shall consist of a narrative description and a graphic summary of the schedule and financial elements of the contract. The narrative shall:

1. Describe the planned deliverables schedule.

2. Identify each step in the work process required for executing the full scope of the period of performance year and the period of time needed to accomplish each step, expressed in terms of the calendar dates. All key milestones and actions required to achieve Ginnie Mae’s near-term objectives and to satisfy OMBs requirements must be included in the PWP.

3. Provide the staff, financial, and other resources allocated to each task.

4. Provide the rationale for project organization, staff utilization, and other resources allocated to each task or activity.

a) Standard: Completes the Project Work Plan in accordance with the PWP.

AQL: Zero deviation, unless discussed and agreed upon by the COR.

b) Standard: Quality - The Project Work Plan is accurate, free of grammatical errors, and contains all required information.

AQL: The Project Work Plan shall conform to the established requirements of the project with minimal revisions due to less than adequate requirements or analysis.

Deliverables A002 Project Work Plan

5.2 Task Two - Update of VRM Framework

The Contractor shall assist Ginnie Mae with updating and producing the VRM Framework on an annual basis. All methodologies and framework related activities should be documented, and all procedures must be approved by the COR/PM prior to any VRM Framework activities being finalized.

a. The Contractor shall provide recommended updates to Ginnie Mae’s VRM Framework, the VRM Assessment Plan along with supporting tools and templates, presentations, and Dashboards, and develop additional tools and templates as needed. Tools and templates include but are not limited to VRM Framework, Assessment Plan, questionnaire templates, Risk Register, VRM PowerPoint templates, vendor inventory, and key risk indicators/ thresholds. This also includes documenting the evaluation methodology for each control.

b. Update Ginnie Mae’s VRM Framework and Risk Focus Areas for any new AICPA, GAO, OMB, FISMA, FISCAM, HUD, government or agency requirements and the latest industry best practices in accordance with NIST and COSO guidelines. (See Acronyms list for all definitions.)

c. Incorporate and update VRM Framework and Risk Focus Areas for any new or revised Ginnie Mae related risk initiatives as applicable. Incorporate and update for any changes in Ginnie Mae’s MBS business landscape, business processes, policies or procedures that impact VRM (e.g., budget, strategic planning, internal controls, etc.).

Performance Standards

a) Standard: Completes the VRM Framework in accordance with the PWP.

AQL: Zero deviation, not unless discussed and agreed upon by the COR.

b) Standard: Quality - The VRM Framework is accurate, free of grammatical errors, and contains all required information.

AQL: The VRM Framework shall conform to the established requirements of the project with minimal revisions due to less than adequate requirements or analysis.

c) Standard: Completes the Assessment Plan in accordance with the PWP.

AQL: Zero deviation, not unless discussed and agreed upon by the COR.

d) Standard: Quality - The Assessment Plan is accurate, free of grammatical errors, and contains all required information.

AQL: The Assessment Plan shall conform to the established requirements of the project with minimal revisions due to less than adequate requirements or analysis.

e) Standard: Completes the Tools & Templates in accordance with the PWP.

AQL: Zero deviation, not unless discussed and agreed upon by the COR.

f) Standard: Quality - The Tools & Templates are accurate, free of grammatical errors, and contains all required information.

AQL: The Tools & Templates shall conform to the established requirements of the project with minimal revisions due to less than adequate requirements or analysis.

Deliverables A003 VRM Framework, A004 Assessment Plan, A005 Supporting Tools and Templates

5.3 Task Three - Vendor Assessments

The Contractor shall perform VRM assessments for a minimum of four (4) to five (5) Ginnie Mae vendors each year of the requirement or up to ten over a two-year period. All Vendor Assessments should be completed based on annual PWP. The specific vendors to be assessed will be decided upon each year of the requirement. Ginnie Mae may change which vendors are assessed for any given year. The vendor assessments will cover all VRM Framework Risk Focus Areas (see "VRM Framework Risk Focus Areas” below).

For the specific VRM Information Security Risk Focus Area assessment requirements by vendor, please see Attachment A VRM Information Security Risk Focus Area Requirements.

The work for the Service Organization Monitoring Risk Focus Area will be performed under Task Five: Service Organization Monitoring and Risk Mitigation with the work being executed concurrently as part of the overall Task Four: Vendor Assessments.

VRM Framework – Risk Focus Areas

*Note: Service Organization Monitoring work will be performed under Task Four: Service Organization Monitoring and Risk Mitigation.

The Contractor shall adhere to Ginnie Mae’s established VRM procedures, processes, and templates for VRM planning, evaluation, reporting and remediation and recommend enhancements based on best practices. Ginnie Mae will provide the priority order of the vendor assessments and ensure the required Ginnie Mae and vendor key stakeholder are available to support the applicable VRM activities.

5.3.1 Plan, Define Risks, and Scope Assessment

Annually, the Contractor shall work with Ginnie Mae to plan and schedule all key VRM assessment activities by performing vendor Scope Assessments. Additionally, the Contractor shall annually update the VRM Assessment Plan tailored for each vendor and submit to the COR/PM.

a. The Contractor shall inventory and segment vendors into risk tiers based on the impact to Ginnie Mae’s operations. The analysis is performed with Ginnie Mae’s excel based Vendor Segmentation Workbook which segments vendors into risk tiers based on criteria provided by Ginnie Mae.

b. Vendors selected will be assessed by the Contractor following Ginnie Mae’s VRM Framework and procedures. Prioritization will be given to vendors performing mission critical functions such as (1) the MBSIBA Contractor (currently called the PPA/CPTA Contractor), (2) the MBSOA Contractor, (3) The Ginnie Mae IT Integrated Cloud Migration (CAMO) Contractor, the (4 & 5) two Single Family MSS Contractors, and (6) the Ginnie Mae Financial Accounting Services Contractor.

c. The Contractor shall conduct a Scope Assessment. This is the review of the contract and initial conversations with the vendors’ CORs to determine which of the seven risk focus areas and sub areas will be relevant to the assessment. The scope is then documented as assessment steps within the assessment results template for each vendor to determine and appropriately size the annual VRM assessments.

d. As part of this, the Contractor shall begin to understand and document the inherent risks to Ginnie Mae’s operations for the vendor provided services in the Initial Risk Register.

e. The VRM Assessment Plan provides detailed steps for performing the assessment. It describes steps used to execute Ginnie Mae’s VRM Framework methodology phases two and three (Information Gathering and Assess Documentation and Management of Vendors). The results of completing this assessment plan will facilitate development of the vendor assessments results and risks rating as part of Ginnie Mae’s VRM Framework methodology phase four (Identify Gaps, Analyze Risk and Rate Vendors). The Assessment Plan supports Ginnie Mae’s ongoing efforts to maintain oversight and management of its vendors to ensure their activities are conducted with effective internal controls and quality control standards in compliance with contract requirements and applicable laws and regulations.

· The Contractor shall tailor the VRM Assessment Plan for each vendor selected before executing the vendor assessments. The VRM Assessment Plan and all procedures must be approved by the COR/PM and Ginnie Mae’s Operational Risk Division prior to assessments being performed.

Performance Standard

a. Standard: Completes Vendor Risk Segmentation by Tier, Scope Assessment, and Final VRM Assessment Plans tailored for each Tier 1 vendor in accordance with the PWP.

AQL: Zero deviation, unless discussed and agreed upon by the COR.

b. Standard: Quality - The Vendor Segmentation Workbook and VRM Assessment Plan are accurate, free of grammatical errors, and contain all required information.

AQL: The Vendor Segmentation Workbook and Assessment Plan shall conform to the established requirements of the project with minimal revisions due to less than adequate requirements or analysis.

Deliverables A006 Vender Segmentation Workbook A007 VRM Assessment Plan

5.3.2 Information Gathering

The Contractor shall gather a wide variety of vendor background information and documentation on each vendor for the services provided to Ginnie Mae including interviewing key Ginnie Mae and vendor stakeholders.

a. Gather Vendor and Ginnie Mae Documentation: Obtain existing Ginnie Mae and vendor information to facilitate assessments for the VRM Framework - Risk Focus Areas. Gather and validate documentation such as relevant contract information, contract tasks and deliverables, contract service and compliance requirements, SLA performance reporting, key business processes, applications, and systems and related.

b. Interview Key Stakeholders and Perform Walk Throughs:

1. Ginnie Mae Stakeholder Interviews and Walk-throughs: The Contractor shall conduct Ginnie Mae stakeholder interviews and perform walk throughs. As part of the interviews, obtain an understanding of the purpose, scope, and objectives of the services provided, along with Ginnie Mae’s internal assessments of vendor performance and potential risks. Obtain information and documentation on Ginnie Mae’s vendor contract management processes, procedures, policies, internal controls and Ginnie Mae personnel criticality to be able to determine risks, gaps, and mitigation strategies. Coordinate and conduct the Information Gathering Stakeholder Questionnaires with Ginnie Mae stakeholders. Provide meeting minutes of interviews and facilitate the Ginnie Mae stakeholder sign-off of the Documentation Acceptance Form.

2. Vendor Stakeholder Interviews and Walk-throughs: The Contractor shall conduct key vendor contact interviews and perform walkthroughs in conjunction with Ginnie Mae personnel to identify and gather existing information on vendor policies, processes and procedures, vendor personnel criticality, internal controls environment, and information technology applications and systems and related for the Risk Focus Areas. Coordinate and conduct the Information Gathering Vendor Stakeholder Questionnaires with Ginnie Mae’s vendor stakeholders. Provide meeting minutes of interviews and facilitate the Ginnie Mae stakeholder sign-off of the Documentation Acceptance Form.

3. The Contractor shall document the results of the interviews and walkthroughs utilizing Ginnie Mae tools and templates as well as the approved meeting minutes format. Information gathering results shall be included within the Vendor Assessment Report.

Performance Standard

a. Standard: Completes Interview Questions, Questionnaire Forms and Templates, Information Gathering, Meeting Minutes and Documentation Acceptance Forms. in accordance with the PWP.

AQL: Zero deviation, unless discussed and agreed upon by the COR.

b. Standard – The Interview Questions, Questionnaire Forms & Templates, Final Information Gathering, Meeting Minutes and Documentation Acceptance Forms are accurate, free of grammatical errors, and contains all required information.

AQL: The Interview Questions, Questionnaire Forms and Templates, Information Gathering, Meeting Minutes and Documentation Acceptance Forms shall conform to the established requirements of the project with minimal revisions due to less than adequate requirements or analysis.

Deliverables A008 Interview Questions, Questionnaire Forms, and Templates A009 Information Gathering, Meeting Minutes, and Documentation Acceptance Forms

5.3.3 Assess Documentation and Management of Vendors

This due diligence phase includes evaluating the effectiveness of vendors in accordance with the PWP to ensure that vendor performance is in line with procurement specifications and Ginnie Mae’s business needs. Reviews of vendors compliance with contract requirements and third-party due diligence reviews will be performed. The Contractor shall ensure all Assessment Plan steps are executed as part of the review and assessment. The Contractor shall review documentation and identify, assess, and document risks and internal controls for both Ginnie Mae and the vendor in accordance with the PWP. This includes assessing operations and design of vendors’ internal controls. The Contractor shall also assess Ginnie Mae’s management of the vendors’ contractual relationship. In determining nature, timing, and extent of review, the Contractor shall consider the risk and complexity of services provided.

The VRM Assessment Plan shall provide the steps for the Contractor to perform the following for all Risk Focus Areas:

a. Assess, measure, monitor, rate, and assist Ginnie Mae in managing vendor risk by focusing on the documentation, people, processes, information security, pending or current legal issues, continuity of operations (COOP), vendors financial condition, and their ongoing ability to provide the required services. This also includes a Ginnie Mae and vendor personnel assessment.

b. Access information gathered to identify potential risks vendors pose to Ginnie Mae including, but not limited to, evaluating, and concluding on the design and operational effectiveness of the vendors key business level controls. Determine mitigation strategies/controls that exist for identified risks.

c. Assess effectiveness of Ginnie Mae’s management of the vendor contractual relationship. Identify, assess, and document risks, internal controls, and gaps in Ginnie Mae’s ongoing efforts to maintain oversight of its vendors. This should include a review and assessment of Ginnie Mae feedback on vendor performance and risk management activities.

Deliverables – N/A – The results of the assessment are reported in the VRM Assessment Plan noted in 5.3.1 Plan, Define Risks, and Scope Assessment

5.3.4 Identify Gaps, Analyze Risks, and Rate Vendors

The Contractor shall identify, analyze, and document internal control and risk management gaps and deficiencies, and perform risk assessment evaluations and gap analysis to assess the risks to Ginnie Mae. This phase includes identifying the residual risks vendors pose to Ginnie Mae through the information gathering and assessing documentation and management of vendor phases. Gaps in risk mitigation will be identified, and risks will be rated and scored for exposure to Ginnie Mae. This includes performing gap ratings and remediation recommendations and overall vendor risk scoring. This will also include development of supporting, final Risk Register and Gap Analysis to document risk ratings.

a. Risk Assessment Evaluation: The Contractor shall conduct a risk assessment evaluation to determine the risks the vendors may present to Ginnie Mae in the eight Risk Focus Areas: contractual, reputational, financial, legal, risk management, information security, business continuity, and service organization monitoring (see "VRM Framework Risk Focus Areas). The Contractor shall evaluate the overall health of the vendors, vendors’ reputation and performance, security and compliance requirements, internal control structure, operational incidents, performance metrics, etc.

b. Gap Analysis Assessment Report: For each assessment, the Contractor shall perform a Gap Analysis to identify gaps/deficiencies and any risks (contractual, reputational, financial, legal, risk management, information security, business continuity, and Service Organization Monitoring) the vendor may present to Ginnie Mae. The Gap Analysis Assessment Report provides inherent and residual risk scores of each risk identified during the assessment to establish final risk scores. It factors in gaps in vendor risk management, risk mitigation strategies, and recommendations for mitigating gaps identified. The Contractor shall identify and document gaps related to a deficiency in design, operating effectiveness, controls, and processes. The Contractor shall identify and analyze existing mitigation strategies and controls in place for the vendor risks and incorporate these into the gap assessment. The Contractor shall provide an impact analysis of these risks that shall be identified as the Risk Identification and Gap Analysis Assessment Report (Gap Analysis). The Gap results will be included as part of the Assessment Report. The Contactor shall also update the Final Risk Register.

a. The Risk Register will be updated and populated by the Contractor with VRM results (prior year Risk Register will be included in the update). The Risk Register will contain risk information based upon interviews with Ginnie Mae personnel and vendor personnel associated with the purpose, scope, and objectives of the contract services provided. The Risk Register shall include, but not limited to, risk category, risk description, risk impact description, risk owner, risk taxonomy, inherent risk scores and ratings (impact score, probability of occurrence score with resulting risk score and risk rating), mitigation strategies in place, gap, residual risk scores and ratings, and corrective actions.

b. Gap Analysis Rating and Recommendations: The VRM program rates gaps based on severity and provides recommendations for corrective actions to the business unit. The documentation of the gap should include the gap description, gap condition, gap root cause, gap example, criteria, gap impact, recommendations, and mitigation strategies with probability of occurrence, impact, and risk rating. Within this, the documentation should include the extent of the gap and whether compensating controls exist that mitigate the identified risk. Each gap documented should also provide specific, value-added recommendations which can be utilized by Ginnie Mae to improve the deficient control and reduce the probability of occurrence.

c. Overall Risk Score: An overall risk score is calculated for each vendor under assessment based on the aggregated results encompassing all applicable risk focus areas. The risk rating is based on a residual risk impact to Ginnie Mae and a residual risk probability.

Performance Standard

a. Standard – Completes Final Risk Identification and Gap Analysis Assessment Report and Final Risk Register in accordance with the PWP.

AQL: Zero deviation, unless discussed and agreed upon by the COR.

b. Standard – The Final Risk Identification and Gap Analysis Assessment Report and Final Risk Register are accurate, free of grammatical errors, and contains all required information.

AQL – The Final Risk Identification and Gap Analysis Assessment Report and Final Risk Register shall conform to the established requirements of the project with minimal revisions due to less than adequate requirements or analysis.

Deliverables A010 Risk Identification and Gap Analysis Assessment Report A011 Risk Register

5.3.5 Vendor Assessment Reporting

The Contractor shall profile the vendor through the summarization of the results of the assessment in the Vendor Assessment Report and VRM Dashboards. Risks, gaps, mitigation strategies, and recommendations for vendor risk management will be included in the report.

a. Vendor Assessment Report: At the conclusion of the assessment, the Contractor shall provide Ginnie Mae a Vendor Assessment Report summarizing the results of the review. The Vendor Assessment Report shall contain a summary of the activities performed, the results and conclusions of each activity and shall identify risk areas, gaps/deficiencies in risk management, controls and processes, and areas of significant risk to Ginnie Mae including an impact analysis. The report shall also prioritize the deficiencies noted for resolution and make recommendations on how to remediate these deficiencies. Additionally, the Vendor Assessment Reports will provide input to Ginnie Mae management on whether operational activities are affecting the goals, strategy, and financial reports of Ginnie Mae.

Below are the key components of Vendor Assessment Report.

a. Executive Summary:

I. Background Information: Assessment background, vendor background, Risk Focus Areas, the Executive Dashboard with key assessment results, the overall vendor score, and the VRM results overview which lists Ginnie Mae’s strengths and gaps or areas for improvement as well as the vendors strengths and gaps or areas for improvement.

II. Business Processes: Information about how the vendor supports Ginnie Mae’s key business processes including business function overviews for Ginnie Mae’s relevant divisions, and business process handoffs for relevant processes.

III. IT Dashboard: Summary of SSAE 18 SOC Reports Analysis for applicable vendors.

b. VRM Methodology:

I. Risk Focus Areas: The VRM Framework and Framework phase definitions.

II. Criteria: Impact categories and corresponding criteria, probability of occurrence criteria.

III. Data Collection: Data collection methods for risk validation as well as information about the risk identification and validation process.

IV. Scoring: Residual Risk Scoring, Heat Map, and overall vendor Risk Scoring.

c. VRM Assessment Results:

I. Summary Results: Overall risk score heat map and residual risk scores by Risk Focus Area heat map.

II. Risk Focus Areas Results: risk score results by residual risk heat maps by Risk Focus Area and residual and inherent risk scores by Risk Focus Area.

III. Gaps: Background info and impacts and risk response heat maps (from Gap Analysis Assessment Report described below).

d. Risk Response Recommendations:

I. Remediation Timelines: Recommended timelines to implement risk responses and corrective action plans (CAPs).

II. Personnel Criticality Assessment: criteria, Vendor Personnel Criticality Assessment Score results and Ginnie Mae Personnel Criticality Assessment Score results.

e. Other relevant information as required by Ginnie Mae.

b. VRM Dashboards and Executive Reports: Summarize assessment results, findings and recommendations in dashboards and reports for Ginnie Mae key stakeholders and executive management. The Dashboard should represent a visual, consolidated dashboard displaying identified risks and gaps for the selected vendor including such items as risks by focus area, gaps by focus area, Ginnie Mae and vendor gaps, personnel criticality and related assessment results and recommendations. The Contractor shall also provide an Information Security Dashboard for vendors that are responsible for providing SSAE 18 SOC reports as part of their contract. The dashboard shall include a summary of the vendors SSAE18 SOC reports including report type, purpose, audit period, scope, assumptions, auditor’s opinion, exceptions overview, percentage of control objectives with and without exceptions, number of exceptions, exceptions by control objective and conclusions and recommendations. The Dashboards are included in the Vendor Assessment Report.

The Contractor shall provide the report to Ginnie Mae’s management and stakeholders in coordination with the Operational Risk Division. Documentary evidence will become the property of Ginnie Mae along with all other materials performed during this assessment.

Performance Standards

a. Standard - Completes Vendor Assessment Reports, VRM Dashboards, and Executive Reports in accordance with the PWP.

AQL: Zero deviation, not unless discussed and agreed upon by the COR.

b. Standard - Quality - All deliverables are accurate, free of grammatical errors, and contain all required information.

AQL: The Vendor Assessment Reports, VRM Dashboards and Executive Reports shall conform to the established requirements of the project with minimal revisions due to less than adequate requirements or analysis.

Deliverables A012 Vendor Assessment Reports A013 VRM Dashboard and Executive Report

5.4 Task Four - Service Organization Monitoring and Risk Mitigation Contractor shall prepare and deliver a formal presentation to kick off the assessment each service year.