Attachment A- Draft MBSOA PWS.docx
DOCX document 442 KB Posted
- Solicitation number
- 86615527MBSOA
About this file
This is a Performance Work Statement (PWS) for the Mortgage-Backed Securities Operations & Analytics (MBSOA) contract with the Government National Mortgage Association (Ginnie Mae), a wholly owned corporate instrumentality of the U.S. Department of Housing and Urban Development (HUD). The contract supports management and reporting on a $2.1 trillion portfolio consisting of 11 million loans and 675,400 MBS pools across Single Family, Multifamily, Manufactured Housing, Home Equity Conversion Mortgages, and Multiclass securities programs.
The scope encompasses four primary service areas: MBS Operations Services, Information Technology Services, MBS Analytics & Risk Services, and Other Services. Specific deliverables are organized into ten tasks: Transition-In/Out Services (6-month periods); Program Management including development of a Program Management Plan, Risk Management Plan, Quality Control Plan, and monthly metrics reporting; Data Collection & Reporting covering pool, loan, and participation-level validation, processing, and analysis; Data Disclosures with scheduled release and enhancement activities; Risk & Information Analytics providing program, portfolio, and issuer analysis; Operations, Maintenance & Minor Enhancements (defined as improvements under 500 labor hours, with approximately eight per month); Systems Security Requirements aligned with FISMA, NIST, and other federal standards; Enhancements and Integrated Software Development (Major Enhancements exceeding 500 hours, estimated 15-20 annually); Customer-Centric Service Delivery including training and conferences; and SSAE 18 Type II SOC 1 & SOC 2 audits. The contract period consists of one base year plus nine one-year option periods, with principal place of performance at the Contractor's site and weekly meetings at Ginnie Mae headquarters in Alexandria, Virginia. The contractor must maintain SEI CMMI Level III certification, active ISO/IEC 20000 and ISO 9001 certifications throughout performance. All infrastructure and applications are hosted in AWS GovCloud through the Ginnie Mae Cloud Application Migration and Operations (CAMO) Contractor, requiring extensive integration and coordination with MBSIBA Contractor and other Ginnie Mae business partners. The contractor is responsible for operations and maintenance of multiple applications including RFS modules, EWODS, Informatica, SAP Business Objects, and GEMS, with work hours from 8:00 a.m. to 5:00 p.m. ET Monday through Friday.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| MBSOA Sources Sought Notice.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Performance Work Statement (PWS) Mortgage-Backed Securities Operations & Analytics (MBSOA) September 1, 2026
Table of Contents
| Vision Statement | 7 | |
| 1 General Information | 7 | |
| 1.1 Scope of Work | 7 | |
| 1.2 Background | 7 | |
| 1.2.1 | Overview of Integrated Support Systems | 8 |
| 1.2.1.1 | Division of Contractor Responsibilities | 9 |
| 1.2.1.2 | Hosting | 10 |
| 1.2.1.3 | Connectivity with Consolidated Cloud Infrastructure | 10 |
| 1.2.1.4 | Troubleshooting | 10 |
| 1.2.2 | Description of Applications & Databases | 11 |
| 1.2.2.1 | RFS Front-End & Back-End Hosting | 11 |
| 1.2.2.2 | RFS | 11 |
| 1.2.2.3 | Enterprise Wide Operational Data Store (EWODS) | 11 |
| 1.2.2.4 | Informatica | 12 |
| 1.2.2.5 | SAP Business Objects (SAP BOBJ) | 12 |
| 1.2.2.6 | Ginnie Mae Meta Data System (GEMS) | 12 |
| 1.2.3 | Ginnie Mae Definitions & Terminology | 13 |
| 1.2.3.1 | Continuous Improvements - Minor and Major Enhancements | 13 |
| 1.2.3.2 | Technical Advisory Services versus Specialized Analytics, Consultation, and Project Support Work | 14 |
| 1.2.3.3 | Document Support | 15 |
| 1.2.3.4 | Reporting | 15 |
| 1.3 Constraints | 15 | |
| 1.3.1 | Project Planning and Management | 17 |
| 1.4 Non-Personal Services | 18 | |
| 1.5 Period of Performance | 18 | |
| 1.6 Place of Performance | 18 | |
| 1.7 Hours of Operation | 19 | |
| 1.8 Special Qualifications | 19 | |
| 1.9 Post Award/Kickoff Conference | 19 | |
| 1.10 Status Meetings | 19 | |
| 1.11 Contractor Travel | 19 | |
| 1.12 Transition-In | 19 | |
| 1.13 Transition-Out | 20 | |
| 2 Definitions and Acronyms | 20 | |
| 2.1 Definitions | 20 | |
| 2.2 Acronyms | 22 | |
| 3 Government-Furnished Property and Services | 27 | |
| 3.1 Government Services | 27 | |
| 3.2 Facilities | 27 | |
| 3.3 Equipment | 27 | |
| 3.4 Materials and Information | 27 | |
| 3.5 Quality Assurance (QA) | 28 | |
| 4 Contractor-Furnished Items and Services | 28 | |
| 4.1 Facilities | 28 | |
| 4.2 Equipment | 29 | |
| 4.3 Materials | 29 | |
| 4.4 Contractor Responsibilities | 29 | |
| 4.5 Contractor Personnel | 29 | |
| 4.6 Identification of Contractor Employees | 29 | |
| 5 Specific Tasks | 29 | |
| 5.1 Task One – Transition-In/Out Services | 30 | |
| 5.1.1 | Transition-In | 30 |
| 5.1.2 | Transition-Out | 33 |
| 5.2 Task Two – Program Management | 35 | |
| 5.2.1 | Post Award Kickoff Conference | 35 |
| 5.2.2 | Program Management Support | 36 |
| 5.2.3 | Enterprise Level Guidance, Deliveries & Continuous Process Improvements | 36 |
| 5.2.4 | Program Management Plan (PMP) | 36 |
| 5.2.5 | Communications | 37 |
| 5.2.6 | Risk Management Plan | 38 |
| 5.2.7 | Quality Control Plan | 38 |
| 5.2.8 | Meetings | 40 |
| 5.2.9 | Monthly Metrics Reporting | 40 |
| 5.2.10 | Content Management Solution | 41 |
| 5.2.11 Support of Ginnie Mae’s Operational Risk Analysis Divisions Examinations and Audits | 43 | |
| 5.3 Task Three – Data Collection & Reporting | 44 | |
| 5.3.1 | Data Collection and Reporting (Monthly, Quarterly, Annually) | 44 |
| 5.3.2 | Validate, Process, Analyze, Access, Monitor and Report Data on Pool, Loan and Participation Level Information Received Monthly from Ginnie Mae Issuers, Contractors and Other Parties | 45 |
| 5.3.3 | Reporting of Monthly Operational Activity and Statistics | 47 |
| 5.3.4 | Collect Multifamily Prepayment Penalty Data and Deliver to the MBSIBA | 47 |
| 5.3.5 | Guaranty Fee Reconciliation | 48 |
| 5.3.6 | Assigning Census IDs to Loan Level Records | 49 |
| 5.3.7 | Monthly Loan Matching | 49 |
| 5.3.8 | Support the Monthly RFS Suspense Process | 51 |
| 5.3.9 | Mortgage Electronic Registration (MERS) Reconciliation | 52 |
| 5.3.10 | Digital Collateral Monitoring Support | 53 |
| 5.3.11 | Widely Held Fixed Investment Trusts (WHFITs) | 54 |
| 5.3.12 | Custodial Account Verification (CAVS) | 55 |
| 5.3.13 | SCRA Qualifications & Reimbursements | 55 |
| 5.3.14 | Liquidation Event Reporting (LER) and Payment Default System (PDS) | 57 |
| 5.3.15 | Validation & Testing Tool (VTT) and Mortgage Industry Standards Maintenance Organization (MISMO) Pool Delivery Dataset (PDD) User Support | 57 |
| 5.4 Task Four – Data Disclosures | 59 | |
| 5.4.1 | Data Disclosure Release Schedule | 60 |
| 5.4.2 | Data Disclosure Activities | 62 |
| 5.4.3 | Data Disclosure Enhancements | 63 |
| 5.5 Task Five – Risk & Information Analytics | 65 | |
| 5.5.1 | Program, Portfolio, and Issuer Analysis | 65 |
| 5.5.2 | Analytics and Risk Applications | 69 |
| 5.5.3 | Support for Issuer Audited Financial Statement Review | 80 |
| 5.5.4 | Risk Review of New Issuer Applications | 80 |
| 5.5.5 | Mortgage Bankers Financial Reporting Form (MBFRF) Analysis - Data Quality Checks | 82 |
| 5.5.6 | Establish and Maintain Third Party Data Interfaces | 82 |
| 5.6 Task Six – Operations, Maintenance & Minor Enhancements | 83 | |
| 5.6.1 | Operations and Maintenance (O&M) | 83 |
| 5.6.2 | O&M for Applications Used to Provide and Support MBSOA Services | 86 |
| 5.6.3 | SUBTASK 6A – IT Operations & Maintenance | 87 |
| 5.6.4 | SUBTASK 6B – Business Operations & Maintenance | 97 |
| 5.6.4.1 | Business O&M Support | 97 |
| 5.6.4.2 | Ginnie Mae Customer Support / Centralized Service Desk | 103 |
| 5.6.4.3 | Disaster Recovery | 106 |
| 5.6.4.4 | Continuity of Operations | 107 |
| 5.6.5 | SUBTASK 6C – Post-Award Incremental Operations and Maintenance Support (Optional) | 109 |
| 5.7 Task Seven – Systems Security Requirements | 110 | |
| 5.7.1 | Federal Information Technology Security | 115 |
| 5.7.2 | Federal Information Systems Controls Audit Manual (FISCAM), OMB A-123 And Other Audit Support | 117 |
| 5.8 Task Eight – Enhancements, Integrated Software Development and Specialized Support (Optional) | 118 | |
| 5.8.1 | Corrective, Adaptive, and Other Major Enhancements Greater than the 500 Hours Threshold | 118 |
| 5.8.2 | Integrated Software Development and Transformation Initiatives Support | 125 |
| 5.8.3 | Capitalization Reporting | 126 |
| 5.8.4 | Specialized Analytics, Consultation, & Project Support | 126 |
| 5.9 Task Nine – Customer-Centric Service Delivery: Customer Adoption, Trainings & Conferences (Optional) | 129 | |
| 5.9.1 | CX: Trainings & Conferences | 129 |
| 5.9.2 | CX: Adoption & Program Support | 130 |
| 5.9.3 | CX: Performance Standards, KPIs, SLAs, and Reporting Deliverables | 133 |
| 5.10 Task Ten – Statement on Standards for Attestation Engagements (SSAE) 18 TYPE II SOC 1 & SOC 2 (SOC 2 OPTIONAL) | 134 | |
| 5.11 | Section 508 Compliance | 136 |
| 5.12 | Other Direct Costs (ODCs) & Travel | 136 |
| 6 Deliverables | 138 | |
| 6.1 Quality Control Plan | 149 | |
| 6.2 Acceptance Criteria | 149 | |
| 7 Related Documents | 151 | |
| 8 Performance Requirements Summary | 151 | |
| 9 Special Contracts Requirements | 172 | |
| ATTACHMENT A: MBSOA RISK AND INFORMATION ANALYTICS REPORTS | 182 | |
| ATTACHMENT B: VENDOR CAPITALIZATION COST REPORTING | 187 | |
| ATTACHMENT C: GINNIE MAE MBSOA MONTHLY CONTRACT DELIVERABLES SUMMARY | 191 | |
| ATTACHMENT D: MORTGAGE-BACKED SECURITIES OVERVIEW | 192 | |
| ATTACHMENT E: GINNIE MAE PROFILE | 205 |
Performance Work Statement (PWS) Mortgage-Backed Securities Operations & Analytics (MBSOA) Vision Statement Ginnie Mae’s vision is to acquire a contractor to deliver mission-critical Mortgage-Backed Securities (MBS) operations that provide advanced data collection and reporting, robust data analytics and risk analysis, comprehensive data disclosures, regulatory and compliance monitoring, while ensuring highly available, secure, agile and optimized applications and an enhanced seamless participant experience.
1 General Information
1.1 Scope of Work
The U.S. Department of Housing and Urban Development (HUD), Government National Mortgage Association (Ginnie Mae), Office of Securities Operations (OSO) seeks contractor support to manage reporting and disclosure on a $2.1 trillion dollar portfolio consisting of 11 million loans, and 675,400 MBS pools. The Contractor shall support Ginnie Mae's core business functions: 1) Data Collection and Reporting, 2) System Support Services, as well as 3) Analysis and Risk Services. The Contractor is responsible for maintaining existing business applications and operations and for performing comprehensive risk management and data analysis activities necessary for Ginnie Mae to manage its financial risk as well as the financial risk of its program participants.
The scope of the MBSOA work to be performed under this contract is as follows:
· MBS Operations Services:
· Information Technology Services:
· MBS Analytics & Risk Services:
· Other Services:
Detailed descriptions of specific tasks are provided in Section 5 – Specific Tasks.
1.2 Background
Ginnie Mae guarantees that investors in bonds guaranteed by its programs will receive the timely payment of principal and interest. Ginnie Mae is a wholly owned corporate instrumentality of the United States located within the U.S. Department of Housing and Urban Development (HUD). Its powers are prescribed by Title III of the National Housing Act, as amended (12 U.S.C. 1716 et seq.). Through its MBS programs, Ginnie Mae guarantees privately issued securities that are backed by pools of mortgages insured or guaranteed by the Federal Housing Administration (FHA), the Department of Veterans Affairs (VA), Rural Development (RD) of the U.S. Department of Agriculture (USDA), and HUD’s Public and Indian Housing program (PIH). If borrowers fail to make timely payments on their mortgages, the Issuer of the MBS must make the timely payments to the registered holders, using the Issuer’s own resources.
The Ginnie Mae MBS Program is governed by guaranty agreements entered by Ginnie Mae and Issuers according to the terms of the Mortgage-Backed Securities Guide 5500.3, Rev. 1 (MBS Guide). The MBS Guide is available on Ginnie Mae’s website at www.ginniemae.gov. Additional program information is available in Attachment D: Mortgage-Backed Securities Overview.
Ginnie Mae’s MBS programs include Single Family, Multifamily, Manufactured Housing (MH), Home Equity Conversion Mortgages (HECM) and Multiclass securities. These programs help to channel funds from the nation's capital markets into the market. The U.S. Government's full faith and credit guarantee makes MBS securities widely acceptable to capital markets investors which choose to invest in primary mortgages because of the guarantee. Ginnie Mae guarantees the registered holder of the securities the timely payment of scheduled monthly principal and interest (P&I) payments, loan prepayments and early recoveries of principal on the underlying mortgages. Issuers that receive funds through the sale of MBS securities can use the capital to make additional residential and other types of mortgage loans. Through this process, the MBS program increases the overall supply of credit available for housing and helps to ensure that credit is available at reasonable interest rates.
Ginnie Mae requires a Contractor to support the Agency’s work to administer its single class and multiclass MBS programs and to ensure the smooth functioning of MBS markets. Ginnie Mae requires services to support its MBS operations; data collection and reporting; application operations, maintenance, and security; risk and information analytics; enhancements, integrated software development and transformation initiative support; and specialized data and risk analysis support needed to run Ginnie Mae’s MBS programs.
The objective of this requirement is for Ginnie Mae to acquire a contractor to:
· Support the program participant reporting cycles for the life of all MBS and provide robust MBS data analytics, risk analysis and predictive analytic capabilities to improve Ginnie Mae’s data driven decision making ability to effectively manage its MBS portfolio of evolving programs, services and risk profile.
· Support Ginnie Mae in providing a seamless customer experience for its program participants and robust and enhanced data disclosure reporting for its investors while streamlining Ginnie Mae’s MBSOA operations and business processes.
· Provide agile, efficient, reliable, flexible, highly available and secure MBSOA applications, systems and business processes to enable Ginnie Mae to quickly respond to MBS market changes with new capabilities, products and improved performance.
· Provide MBS expertise and thought leadership with innovative approaches and solutions to support and expand Ginnie Mae’s MBS programs and capabilities to meet program participants needs by working collaboratively with Ginnie Mae and its business partners.
1.2.1 Overview of Integrated Support Systems
Ginnie Mae and its Contractors operate in a highly integrated IT infrastructure and business process environment. Systems, applications, and infrastructure used to support the MBSOA Contractor are hosted primarily in the AWS GovCloud and supported by Ginnie Mae’s IT Infrastructure Dedicated Cloud Services (IT IDCS) Contractor, to be referred to in this PWS as the Cloud Application Migration and Operations (CAMO) Contractor. This platform is tightly integrated with systems supported by the CAMO Contractor which includes direct connectivity to the CAMO technology environments. Additionally, the MBSOA systems, data and applications are tightly integrated with platforms and applications supported by Ginnie Mae’s MBS Issuance & Bond Administration (MBSIBA) Contractor.
There are also several other Contractors that support additional Ginnie Mae key MBS operations, business applications and technology systems that interface or integrate with the MBSOA applications to include the Ginnie Mae Financial Accounting System (GFAS), Subledger Database (SLDB), VMMR and MSS Contractors. This requires a high degree of integration, collaboration, and coordination between each of Ginnie Mae’s business partners to support the overall Ginnie Mae enterprise.
The MBSOA Contractor shall assume application O&M responsibility for all current MBSOA services as part of this contract. The MBSOA Contractor shall provide the technical and collaborative skills necessary to operate as part of an integrated team across Ginnie Mae’s technology support ecosystems to include multiple contractors as part of IPT.
1.2.1.1 Division of Contractor Responsibilities
The MBSOA Contractor is responsible for O&M and enhancements for all applications necessary to support the services described in this contract along with the Data Collection and Reporting and Risk and Information Analytic services described in this PWS.
The MBSIBA Contractor is responsible for the engineering, connectivity to Ginnie Mae’s mainframe infrastructure, mainframe hosting, MBSIBA application security, compliance, O&M, integration and enhancements of the systems and applications depicted in the infrastructure architecture for MBSIBA in the Virtual Reading Room (See Solicitation for Virtual Reading Room Instructions) along with the other services they provide.
AWS GovCloud hosting services for the MBSOA applications are provided by the CAMO Contractor. It shares responsibility with the MBSOA Contractor for the security, and O&M of the applications. The applications are tightly integrated across both the MBSIBA Contractor as well as the CAMO Contractor with its infrastructure and systems.
Securitization Division of Contractor Responsibilities
| MBSIBA Contractor |
| MBSOA Contractor |
| CAMO Contractor |
· Pool processing, issuance & delivery.
· Calculation, collection, and distribution of P&I due security holders.
· Ongoing Bond Administration.
· Platinum Trustee & REMIC Information Agent.
· Engineering, mainframe hosting, security, O&M, and enhancements of IT mainframe infrastructure, systems and applications supporting these services.
· Investor Reporting & Disclosures.
· Ongoing Bond Administration.
· Risk & Information Analytics.
· O&M, administration, patching, upgrading, security & enhancements for applications, identity and access management, monitoring, integrated tools, and systems supporting these services.
· AWS GovCloud services and supporting infrastructure operations for Ginnie Mae’s portable distributed applications which include MBSOA applications / systems and MBSIBA non-mainframe applications / systems.
· Granting application access for Ginnie Mae applications hosted by the CAMO Contractor.
Shared Responsibility: MBSIBA, MBSOA & CAMO Contractor
· Coordination with Ginnie Mae’s business partners on integrated projects impacting multiple business partners.
· Support integrated MBS business processes and data exchange.
· This work requires high levels of Contractor collaboration.
1.2.1.2 Hosting
All Infrastructure and applications supported by this effort are hosted in AWS GovCloud. All hosting services are provided through the Ginnie Mae CAMO contract. Mainframe applications and services are hosted by the MBSIBA contract.
1.2.1.3 Connectivity with Consolidated Cloud Infrastructure
Ginnie Mae, in coordination with the CAMO Contractor and its related providers, will provide connectivity to the Ginnie Mae AWS cloud environments via Ginnie Mae’s Virtual Desktop Infrastructure (VDI) and other secure remote access services for infrastructure or application administration related activities. The CAMO Contractor and other related providers will provide and support all dedicated connectivity to and within the AWS GovCloud.
1.2.1.4 Troubleshooting
The MBSOA Contractor will primarily work with Ginnie Mae's CAMO Contractor and other Ginnie Mae IT support Contractors as applicable for all IT-related monitoring and troubleshooting activities as well as initiatives. The Contractor is responsible for application monitoring for all applications as described in the contract. Coordination and management will be provided by Ginnie Mae as explained in Task Six – Operations, Maintenance & Minor Enhancements.
1.2.2 Description of Applications & Databases
See Task Six – Operations, Maintenance & Minor Enhancements, Section 5.6.2 O&M for Applications Used to Provide and Support MBSOA Services. These Ginnie Mae applications perform and support all MBS operations, data collections, reporting, and risk and information analytics tasks in this contract.
1.2.2.1 RFS Front-End & Back-End Hosting
RFS is used to support many MBSOA processes. The following core data reporting RFS applications/modules use the CAMO Contractor for front-end and back-end hosting and integrate with the MBSIBA for access, identity/access management, data, and processing functionalities:
(a) Contact Management (CM);
(b) Custodial Account Verification System (CAVS);
(c) Data Disclosure (DD);
(d) E-Notification (EN);
(e) HMBS Reporting and Administration (HRA);
(f) Independent Public Accounting (IPA);
(g) Matching and Suspense (MAS);
(h) Pool Accounting & Exception Feedback (PAEF), Single and Multifamily modules;
(i) RFS Administration (ADMIN);
(j) Servicemembers’ Civil Relief Act (SCRA), and
(k) Widely Held Fixed Investment Trust (WHFIT).
1.2.2.2 RFS
The following other RFS modules, applications and Operational Data Stores are hosted by the CAMO Contractor:
(a) Corporate Watch (CW);
(b) Data Analysis and Reporting Tool (DART);
(c) Ginnie Mae Analytics and Reporting System (GMARS);
(d) Ginnie Mae Meta Data System (GEMS);
(e) Ginnie Mae Operational Data Store (GMODS)
(f) Ginnie Mae Portfolio Analysis Database (GPADS);
(g) Issuer Operational Performance Profile (IOPP);
(h) Master Subservicer Operational Reporting (MOR).
In respect to items (a) through (h), above, all the application code, plus back end and reporting functionality such as Informatica, SAP Business Objects (SAP BOBJ), Tableau and databases for these applications, are hosted at the CAMO Contractor.
1.2.2.3 Enterprise Wide Operational Data Store (EWODS)
The Enterprise-Wide Operational Data Store (EWODS) is an Oracle relational database that stores transaction processing data that is sourced from various Ginnie Mae applications. EWODS is the repository of data that is collected and shared across the Ginnie Mae enterprise and multiple contractors.
EWODS supports centralized data collection and feedback for all MBS new Issuer processing, new pool originations, monthly accounting and reporting for Single Family and Multifamily pools, and Multiclass securities. EWODS provides a secure single source for all Ginnie Mae’s enterprise data, minimizing redundancy and data synchronization across disparate systems. This repository stores data from all Ginnie Mae’s Enterprise applications including RFS (maintained by the MBSOA Contractor) and Integrated Pool Management System (IPMS), GinnieNET and the other pool delivery modules (maintained by the MBSIBA Contractor). Data necessary to support the activities performed by the MBSOA will be sourced from or loaded into EWODS and often shared across various database tables and other data repositories.
1.2.2.4 Informatica
Informatica is used to manage the transfer of data across Ginnie Mae’s environments. Installations of Informatica will be hosted by the CAMO Contractor and operated and maintained by the MBSIBA Contractor and interact with applications and databases utilized by the MBSOA Contractor. Installations of Informatica are hosted at Ginnie Mae’s CAMO Contractor and are operated and maintained by the MBSOA Contractor in support of MBSOA operations. Additional installations of Informatica are hosted at Ginnie Mae’s CAMO Contractor, interact with applications and databases utilized by the GFAS Contractor, and are operated and maintained by the MBSOA Contractor. Informatica Dynamic Data Masking is hosted at Ginnie Mae’s CAMO Contractor and is utilized for creating and or masking data. Informatica Dynamic Data Masking is operated and maintained by the MBSOA Contractor.
1.2.2.5 SAP Business Objects (SAP BOBJ)
SAP BOBJ is used to support both MBSIBA and MBSOA applications. BOBJ supports the MBSOA’s RFS PAEF and other software such as IOPP, MOR and DART as well as other applications. BOBJ supports the MBSIBA’s IPMS. The CAMO Contractor will provide the hosting services and infrastructure supporting BOBJ. The MBSIBA Contractor operates and maintains installations of BOBJ that support functionality performed by the MBSOA Contractor, for example, populating various EWODS tables and transferring other data necessary to support the MBSOA. There are additional installations of BOBJ at Ginnie Mae’s CAMO Contractor used to support RFS application modules and are operated and maintained by the MBSOA contractor.
1.2.2.6 Ginnie Mae Meta Data System (GEMS)
GEMS provides a dynamic view of applications’ metadata, including the original source of data elements, the business rules applied to a data element, and the latest refresh date of each data element. Ginnie Mae uses the tool to capture the results of data integration routine activity and outputs, affording Ginnie Mae the ability to leverage the tool’s functionality in certifying mission critical data. GEMS is maintained in a sustainment state and is not expected to require enhancements or modernization activities. Contractor support is limited to periodic monitoring, routine administrative activities, and other minimal operational support necessary to maintain the system until it is decommissioned.
1.2.3 Ginnie Mae Definitions & Terminology
The ever-evolving nature of capital financial markets requires Ginnie Mae to continuously adapt, update, and change its internal work requirements, processes, and procedures. As markets evolve, Ginnie Mae must undertake minor and major changes in order to continue operating in the market. The following definitions and terms are used throughout this contract to define the types of services Ginnie Mae uses for flexibility in responding to market changes. Often, because markets respond to changes in political and economic trends, it is difficult for Ginnie Mae to predict the types of adaptations it will need to make over the next two years.
| 1.2.3.1 | Continuous Improvements - Minor and Major Enhancements |
| (a) | Continuous Improvements |
Ginnie Mae must implement continuous business, process, system, and application improvements in a cost-effective manner. Ginnie Mae proactively seeks improvements to save money, to improve performance, or for any other purpose which presents a service advantage to Ginnie Mae. The Government seeks improvements to the services, features, or other requirements in this contract. Both the Government and the Contractor may propose and, when necessary, develop any type of improvements related to this contract. To implement improvements in a cost-effective manner, all improvements are divided between Minor Enhancements and Major Enhancements based on the number of labor hours each requires.
(b) Minor Enhancements - Improvements Requiring Less Than 500 Hours A Minor Enhancement is defined as any business, process, service, or technology improvement that will take the Contractor less than 500 labor hours to implement. All Minor Enhancements are covered under Section 5.6 Task Six – Operations, Maintenance & Minor Enhancements as Firm Fixed Priced (FFP) services required by this contract. On average, Ginnie Mae undertakes eight (8) Minor Enhancements to applications per month, not to exceed 35 per quarter. The Contractor shall submit an Estimation of Effort and scope to the Contracting Officer’s Representative (COR). The COR and the Contractor shall mutually agree to whether each initiative will be performed as an enhancement of less than 500 hours or greater than 500 hours. Multiple minor enhancements less than 500 hours must not be bundled to exceed the 500-hour threshold. In the event of a dispute, the issue must be submitted to the Contracting Officer (CO) for a determination.
(c) Major Enhancements - Corrective, Adaptive and other Improvements Requiring Greater than 500 Hours A Major Enhancement is defined as any business, process, service, or technology improvement; including corrective, adaptive and other technology improvements; which will take the Contractor more than 500 labor hours to develop and implement. The Government recognizes that the Contractor may need additional staffing or expertise to develop and implement Major Enhancements. All Major Enhancements are covered under Section 5.8 Task Eight – Enhancements, Integrated Software Development and Specialized Support. Although the volume may be driven by unforeseen circumstances, the Government estimates that it will undertake fifteen (15) to twenty (20) Major Enhancements per year under the MBSOA contract through the use of Technical Guidance Memos (TGM) by approval of the CO/COR. In addition, the Government estimates that it will undertake twenty (20) plus projects of varying size per year for Integrated Software Development and Transformation Initiatives Support.
1.2.3.2 Technical Advisory Services versus Specialized Analytics, Consultation, and Project Support Work
(a) Technical Advisory Requests
(1) Technical advisory services are defined as simple requests, queries, reporting, and research work the Contractor performs as part of the regular operations and reporting requirements of this contract. The Contractor can perform this work without adding to existing staff. The information the Contractor needs to complete this work is available in the public domain or in the existing systems and applications the Contractor regularly uses to fulfill the contract requirements. Some of this work will be to pull historical information from applications. To complete this work, the Contractor does not need to undertake project development activities or receive a detailed project description from the Government. In most cases, the timing of this work is flexible, and the Contractor and the Government can mutually agree upon the delivery. All technical advisory work is covered under the relevant FFP services required by this contract.
(b) Specialized Analytics, Consultation, and Project Support
(1) Specialized Analytics, Consultation, and Project Support services are defined as more complex services that require specialized subject matter expertise, expert advice, or unique information to complete this work. Although the volume may be driven by unforeseen circumstances, the Government estimates that it will undertake ten (10) to fourteen (14) projects each year of varying size and complexity under Section 5.8.4 Specialized Analytics, Consultation, & Project Support.
(i) Specialized Subject Matter Expertise: A person or entity that is an authority in a particular area or topic. For example, Ginnie Mae may need a subject matter expert with in-depth knowledge of the MBS securities market.
(ii) Expert Advice: Advice or guidance based on experience and technical knowledge of Ginnie Mae’s programs, applications, policies, processes, and procedures.
(iii) Unique Information: External information that is not provided through Ginnie Mae’s data feeds, internal applications, or systems. For example, in-depth mathematical, modeling, market research, and sector analysis all require unique information.
(2) The Contractor may need to access outside resources, information, or expertise to complete the Specialized Projects. The Contractor may also need to undertake project development activities and or receive a detailed project description from Ginnie Mae. All work performed under Specialized Projects is covered under Section 5.8.4 Task Eight - Specialized Analytics, Consultation, and Project Support. Ginnie Mae will provide the Contractor with guidance on the performance of the Specialized Projects. Such guidance will not be of a nature which:
(i) Causes the Contractor to perform new work outside the PWS or specifications of the contract;
(ii) Constitutes a change as defined in Federal Acquisition Regulation (FAR) 52.212- 4(c) Contract Terms and Conditions - Commercial Products and Commercial Services;
(iii) Causes an increase or decrease in the cost of the contract;
(iv) Alters the period of performance (PoP) or delivery dates; or
(v) Changes any of the other express terms or conditions of the contract.
1.2.3.3 Document Support
Document support is defined as the documentation that supports the running, improving, and training for all services required by this contract. The Contractor is required to document, update, and provide the Standard Operating Procedures (SOPs), user manuals, reference materials, application related documents, diagrams, all security / Security Assessment and Authorization (SA&A) documentation related to the MBSOA applications, presentations, or online help for the services covered by this contract based on the frequency noted in the Section 6 Deliverables. All document support activities are covered under the relevant FFP services required by this contract. While performing minor enhancements, the Contractor shall review all documentation affected by the enhancement including systems, operational, user and technical documentation, and complete all required updates within 15 business days after implementation unless otherwise approved by the COR and/or PM.
1.2.3.4 Reporting
Ginnie Mae has three (3) tiers of reports: 1) automated system generated reports; 2) core reports; and 3) customized, specific reports that Ginnie Mae requests. For automated reports, each respective application produces reports that are relevant to the nature of the action being performed in that application. Ginnie Mae expects the Contractor to produce automated reports based on the business operations and processes articulated in the operations manuals. The core reports are part of the normal business functions and are listed in Section 6 Deliverables. For customized, specific reports, see Attachment A: MBSOA Risk and Information Analytics Reports.
1.3 Constraints
The services identified in this PWS will adhere to the rules, regulations, laws, standards, and conventions identified by HUD as well as within the Federal Government including all future revisions. The Contractor must adhere to all policies and procedures prescribed by Ginnie Mae to perform the services stated within this PWS. These policies and procedures have been primarily established by Ginnie Mae's Office of Securities Operations (OSO), Chief Information Security Officer (CISO), Chief Technology Architect (CTA), Project Management Organization (PMO), Data Management Competency Center (DMCC), Architecture Review Board (ARB), Office of Issuer and Portfolio Management (OIPM), Office of Capital Market (OCM), Office of Enterprise Risk (OER) and Office of Chief Financial Officer (OCFO).
Constraints include the following:
MBSOA RECOMPETE CONSTRAINTS LIST
| # |
| Constraint Reference Name |
| Reference Link |
| 1 |
| Federal Information Security Modernization Act (FISMA) |
| Federal Information Security Modernization Act (FISMA) |
| 2 |
| Federal Information Systems Controls Audit Manual (FISCAM) |
| Federal Information Systems Controls Audit Manual (FISCAM) |
| 3 |
| Federal Managers' Financial Integrity Act (FMFIA) |
| Federal Managers Financial Integrity Act (FMFIA) |
| 4 |
| Federal Financial Management Improvement Act (FFMIA) |
| Federal Financial Management Improvement Act (FFMIA) |
| 5 |
| The Clinger-Cohen Act |
| The Clinger-Cohen Act |
| 6 |
| Government Paper Reduction Act |
| Government Paper Reduction Act |
| 7 |
| National Archives and Records Administration (NARA) Policies and Regulations |
| National Archives and Records Administration (NARA) Policies and Regulations |
| 8 |
| Federal Information Processing Standard (FIPS) Publication 199: Standards for Security Categorization of Federal Information and Information Systems |
| Federal Information Processing Standard (FIPS) Publication 199: Standards for Security Categorization of Federal Information and Information Systems |
| 9 |
| FIPS 200: Minimum Security Requirements for Federal Information and Information Systems |
| FIPS 200: Minimum Security Requirements for Federal Information and Information Systems |
| 10 |
| NIST SP 800-53 rev. 5, Security and Privacy Controls for Federal Information Systems and Organizations |
| NIST SP 800-53 rev. 5, Security and Privacy Controls for Federal Information Systems and Organizations |
| 11 |
| NIST SP 800-18 – Guide for Developing Security Plans for Federal Information Systems |
| NIST SP 800-18 – Guide for Developing Security Plans for Federal Information Systems |
| 12 |
| NIST SP 800-30 – Guide for Conducting Risk Assessments |
| NIST SP 800-30 – Guide for Conducting Risk Assessments |
| 13 |
| NIST SP 800-34 Rev. 1 – Contingency Planning Guide for Federal Information Systems |
| NIST SP 800-34 Rev. 1 – Contingency Planning Guide for Federal Information Systems |
| 14 |
| NIST SP 800-37 Rev. 2 – Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy |
| NIST SP 800-37 Rev. 2 – Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy |
| 15 |
| NIST SP 800-47 Rev. 1 – Managing the Security of Information Exchanges |
| NIST SP 800-47 Rev. 1 – Managing the Security of Information Exchanges |
| 16 |
| NIST SP 800-53A Rev. 5 – Assessing Security and Privacy Controls in Information Systems and Organizations |
| NIST SP 800-53A Rev. 5 – Assessing Security and Privacy Controls in Information Systems and Organizations |
| 17 |
| NIST SP 800-59 – Guideline for Identifying an Information System as a National Security System |
| NIST SP 800-59 – Guideline for Identifying an Information System as a National Security System |
| 18 |
| NIST SP 800-60 – Guide for Mapping Types of Information and Information Systems to Security Categories |
| NIST SP 800-60 – Guide for Mapping Types of Information and Information Systems to Security Categories |
| 19 |
| NIST SP 800-84 – Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities |
| NIST SP 800-84 – Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities |
| 20 |
| NIST SP 800-160 Vol. 1 Rev. 1 – Engineering Trustworthy Secure Systems |
| NIST SP 800-160 Vol. 1 Rev. 1 – Engineering Trustworthy Secure Systems |
| 21 |
| NIST SP 800-160 Vol. 2 Rev. 1 – Developing Cyber-Resilient Systems: A Systems Security Engineering Approach |
| NIST SP 800-160 Vol. 2 Rev. 1 – Developing Cyber-Resilient Systems: A Systems Security Engineering Approach |
| 22 |
| NIST SP 800-61 Rev. 3 – Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile |
| NIST SP 800-61 Rev. 3 – Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile |
| 23 |
| NIST SP 800-171 Rev. 3 – Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations |
| NIST SP 800-171 Rev. 3 – Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations |
| 24 |
| OMB Circular A-123 Management's Responsibility for Internal Control |
| OMB Circular A-123 Management's Responsibility for Internal Control |
| 25 |
| OMB Circular A-123, Appendix D |
| OMB Circular A-123, Appendix D |
| 26 |
| OMB Circular A-130 Managing Information as a Strategic Resource |
| OMB Circular A-130 |
| 27 |
| Executive Order 12656 |
| Executive Order 12656 |
| 28 |
| PPD-40, Federal Continuity Directives 1 (FCD) |
| PPD-40, Federal Continuity Directives 1 (FCD) |
| 29 |
| PPD-40, Federal Continuity Directives 2 (FCD) |
| PPD-40, Federal Continuity Directives 2 (FCD) |
| 30 |
| Executive Orders for Information Technology and Cyber Security |
| Executive Orders |
| 31 |
| CISA Directives |
| CISA Directives |
| 32 |
| DHS Management Directives - Security |
| DHS Management Directives - Security |
| 33 |
| GAO Directives |
| GAO Directives |
| 34 |
| Mortgage-Backed Securities Guide 5500.3, Rev. 1 (MBS Guide) |
| Mortgage-Backed Securities Guide 5500.3, Rev. 1 (MBS Guide). |
| 35 |
| HUD Project Planning and Management (PPM) Life Cycle V2.0 |
| HUD Project Planning and Management (PPM) Life Cycle V2.0 |
| 36 |
| HUD Regulations, Handbooks and Policies |
| HUD Regulations, Handbooks and Policies – www.HUD.gov |
| 37 |
| Ginnie Mae Technology Management Division Policies and Procedures |
| Link not applicable |
| 38 |
| Ginnie Mae Chief Information Security Officer Sub-policies and Procedures |
| Link not applicable |
| 39 |
| Ginnie Mae SOPs for the relevant services in this PWS |
| Link not applicable |
1.3.1 Project Planning and Management
All HUD IT projects, including all information systems acquired, developed, enhanced, or maintained shall follow the policy, procedures, standards, and guidelines set forth within the IT Management Framework using the Project Planning and Management (PPM) Life Cycle located at HUD’s PPM Life Cycle Website:
http://portal.hud.gov/hudportal/HUD?src=/program_offices/cio/ppm/PPMV20HOME PPM was designed based on the best practices from Capability Maturity Model Integration (CMMI) for systems development and PMBok for project management. While at the foundation, PPM is designed as a Waterfall methodology, HUD encourages tailoring the PPM to use the many modern solution development methodologies available to enable the planning, development and delivery of useable functionality within 6-9 month increments.
Contractors are encouraged to propose a preferred methodology whether their solution(s) are for custom development, includes prototypes or pilots, Commercial Off the Shelf (COTS)/ Government Off the Shelf (GOTS) configuration, or Software as a Services. Working with the HUD Project Manager(s), the Contractor will tailor PPM to take advantage of contractor proposed expertise in using other methodologies in a manner that will provide HUD the best value and address all of the work necessary for successful project completion, on time, within budget, and delivering intended functionality.
The decisions of PPM tailoring are captured in the Project Tailoring Agreement (PTA), which documents the specific agreement for creating, combining, referring, or omitting specific artifacts applicable to the project, as well as adjust project control gate reviews to be consistent with the tailoring. All tailoring of PPM must be approved by HUD’s Deputy Chief Information Officer (DCIO) for Business & IT Modernization. As a default, any project without an approved project tailoring agreement is required to follow all PPM phases and artifacts as presented.
1.4 Non-Personal Services
The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual Contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services.
If the Contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the Contractor's responsibility to notify the Contracting Officer (CO) immediately. These services shall not be used to perform work of a policy, decision making or management nature, i.e., inherently Government functions. All decisions relative to programs supported by the Contactor shall be the sole responsibility of the Government.
1.5 Period of Performance
The Period of Performance shall be a one-year base period with nine (9), one-year option periods.
1.6 Place of Performance
The principal place of performance for work performed by the Contractor under this contract shall be at the Contractor’s site. Weekly, and on occasion, and with short notice, the Contractor will be asked to attend meetings at Ginnie Mae headquarters, 2415 Eisenhower Ave, Alexandria, VA 22314.
1.7 Hours of Operation
The Contractor is responsible for providing services between the hours of 8:00 a.m. to 5:00 p.m. ET Monday thru Friday except for Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closing, or similar Government directed facility closings. The Government reserves the right to change hours of operation or restrict contractor access. Government agencies will not be available during scheduled holidays, inclement weather, weekends, and after duty hours.
The Contractor shall maintain an adequate workforce for the uninterrupted performance of all tasks defined within the contract when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce is essential.
1.8 Special Qualifications
The Contractor must maintain a Software Engineering Institute (SEI) CMMI Level III Certificate for Development, active corporate ISO/IEC 20000 certification and ISO 9001 (Quality Management) certification during the contract PoP.
1.9 Post Award/Kickoff Conference
The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5 and HUD Acquisition Regulation (HUDAR) clause 2452.237-79 - Post Award Conference.
1.10 Status Meetings
The Contracting Officer, Contracting Officer’s Representative (COR), and other Government personnel, as appropriate, may meet periodically with the Contractor to also review Contractor performance, requirement status, etc. At these meetings, the Contracting Officer will apprise the Contractor of how the Government views the Contractor's performance or progress of the requirement. The Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government. Post Award Conference and subsequent meetings may be held via teleconference at the Contracting Officer's discretion.
1.11 Contractor Travel
Prior to travel, the Contractor shall coordinate with and receive Government authorization from the COR for all travel. Reimbursement of travel costs will be in accordance with the Federal Travel Regulation and in accordance with FAR 31.205-46.
1.12 Transition-In
The Contractor shall, upon the Contracting Officer's written notice, furnish transition-in services as required. As a successor, the Contractor shall have sufficient personnel on board during the six (6) month transition-in period to ensure a smooth transition with the incumbent Contractor. The Contractor shall provide an orderly transition of work acceptance and accomplishment such that any impact to the program is minimized. During the transition-in period, the Contractor shall become familiar with the requirements in order to commence full performance of services by the end of the contract transition-in period. Transition-in is not required if the successor Contractor is the incumbent Contractor.
1.13 Transition-Out
To minimize any decrease in productivity and to prevent possible negative impacts on additional services, the Contractor shall have sufficient personnel on board during the six (6) month transition-out period. The incumbent Contractor shall ensure a smooth transition with the successor Contractor during the transition-out period, prior to completion of contractual performance. The incumbent Contractor shall aid the successor in the development of plans, procedures, and methods for the assumption of all on going work. The Contractor shall provide an orderly transition of work acceptance and accomplishment, such that full control by the successor contractor is achieved by the end of the new contract transition-in period.
2 Definitions and Acronyms
2.1 Definitions
Business Day / Workday – Every official day of the week which are days between and including Monday to Friday. This does not include federal holidays and weekends.
Contractor – A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.
Contracting Officer (CO) – A person with authority to enter into, administer, and/or terminate contracts and make related determinations and findings on behalf of the Government. Note: the only individual who can legally bind the Government.
Contracting Officer’s Representative (COR) – An employee of the U.S. Government appointed by the Contracting Officer to perform contract administration activities regarding technical issues. This individual has authority to provide technical direction to the Contractor if direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have the authority to change the terms and conditions of the contract.
Defective Service – A service output that does not meet the standard of performance associated with the Performance Work Statement.
Deliverable – Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.
Demonstration (DEMO) – This environment contains sample configuration and transaction data. The DEMO environment is leveraged to conduct additional testing for new functionality Development (DEV) – The development (DEV) environment is used by Vendors and Ginnie Mae to conduct development and integration testing prior to official system testing in SIT and UAT. Code is promoted here from the developer’s local machine and tested to ensure correctness. Once code is successfully integrated and tested here, it is considered ready for system testing.
Disaster Recovery (DR) – The disaster recovery environment is configured to support Ginnie Mae applications in the event the primary hosting facility is rendered inoperable. The disaster recovery environment will include a dedicated production environment including dedicated servers for each production (PROD) application. Connectivity will be secured through a secure VPN internet connection.
Government Furnished Property (GFP) – Government-furnished property is property in the possession of, or directly acquired by, the Government and subsequently furnished to the Contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification. Government-furnished property also includes contractor-acquired property if the contractor-acquired property is a deliverable under a cost contract when accepted by the Government for continued use under the contract.
Performance Standard – The Contractor’s performance level required by the Government.
Performance Work Statement (PWS) – A statement of work for performance-based acquisitions that describe the required results in clear, specific, and objective terms with measurable outcomes.
Production (PROD) – The production environment for Ginnie Mae. Only software that has passed system testing and been fully accepted and baselined by Ginnie Mae can be promoted to production. These are considered the critical servers hosting live data and systems for use by the public and require the highest uptime.
Quality Assurance (QA) – Policies and procedures adopted by the Government to ensure that supplies and services acquired under Government contracts conform to the contracts quality requirements.
Quality Assurance (QA) – The QA environment is for testing upgrade procedures against data, hardware, and software that closely simulates the Production environment and where intended, users test the resulting application.
Quality Assurance Surveillance Plan (QASP) – A plan describing how the agency will survey, observe, test, sample, evaluate and document the Contractor's performance in meeting critical performance standards identified in the contract.
Quality Control (QC) – All necessary measures taken by the Contractor to assure that the quality of an end product of service shall meet contract requirements.
Staging (STG)(PreProd) – This environment mirrors the production environment, and its purpose is to enable Quality Assurance tests after the DEV environment before moving to the PROD environment.
Subcontractor – Any person, other than the prime Contractor, who offers to furnish or furnishes any supplies, material, equipment, or services of any kind under a prime contract or a subcontract entered into in connection with such prime contract, and any person who offers to furnish or furnishes general supplies to the prime contractor or a higher tier subcontractor. The Government does not have privity of contract with a subcontractor.
System Integration Testing (SIT) – The SIT testing environment is where pieces of Ginnie Mae application code are uploaded and tested for interoperability with other applications. The code is integrated after normal software testing is conducted and approved.
Test (TST) – The Test environment is reserved for testing single pieces of Ginnie Mae application code. Prior to moving the code through SIT and UAT testing, the code must be tested and approved in this environment.
Training (TRN) – The Training Environment is designated for educating end users on how to operate Ginnie Mae applications. The Training environments are also paired with QA environments in some instances. These environments are typically closed off from PROD environments and enable users to experiment and learn.
User Acceptance Testing (UAT) – The UAT Environment is where Ginnie Mae applications are tested to confirm that the functionality is working properly for end users. Code will have already passed through the TST and SIT environments to reach this stage of the Software Development Lifecycle.
2.2 Acronyms
| Acronym |
| Definition |
| ACH |
| Automated Clearing House |
| AI |
| Artificial intelligence |
| AICPA |
| American Institute of Certified Public Accounts |
| APMS |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .