Attachment A- Draft MBSOA PWS.docx

DOCX document 442 KB Posted

Attached to
Mortgage-Backed Securities Operations & Analytics (MBSOA)
Solicitation number
86615527MBSOA
Issued by

About this file

This is a Performance Work Statement (PWS) for the Mortgage-Backed Securities Operations & Analytics (MBSOA) contract with the Government National Mortgage Association (Ginnie Mae), a wholly owned corporate instrumentality of the U.S. Department of Housing and Urban Development (HUD). The contract supports management and reporting on a $2.1 trillion portfolio consisting of 11 million loans and 675,400 MBS pools across Single Family, Multifamily, Manufactured Housing, Home Equity Conversion Mortgages, and Multiclass securities programs.

The scope encompasses four primary service areas: MBS Operations Services, Information Technology Services, MBS Analytics & Risk Services, and Other Services. Specific deliverables are organized into ten tasks: Transition-In/Out Services (6-month periods); Program Management including development of a Program Management Plan, Risk Management Plan, Quality Control Plan, and monthly metrics reporting; Data Collection & Reporting covering pool, loan, and participation-level validation, processing, and analysis; Data Disclosures with scheduled release and enhancement activities; Risk & Information Analytics providing program, portfolio, and issuer analysis; Operations, Maintenance & Minor Enhancements (defined as improvements under 500 labor hours, with approximately eight per month); Systems Security Requirements aligned with FISMA, NIST, and other federal standards; Enhancements and Integrated Software Development (Major Enhancements exceeding 500 hours, estimated 15-20 annually); Customer-Centric Service Delivery including training and conferences; and SSAE 18 Type II SOC 1 & SOC 2 audits. The contract period consists of one base year plus nine one-year option periods, with principal place of performance at the Contractor's site and weekly meetings at Ginnie Mae headquarters in Alexandria, Virginia. The contractor must maintain SEI CMMI Level III certification, active ISO/IEC 20000 and ISO 9001 certifications throughout performance. All infrastructure and applications are hosted in AWS GovCloud through the Ginnie Mae Cloud Application Migration and Operations (CAMO) Contractor, requiring extensive integration and coordination with MBSIBA Contractor and other Ginnie Mae business partners. The contractor is responsible for operations and maintenance of multiple applications including RFS modules, EWODS, Informatica, SAP Business Objects, and GEMS, with work hours from 8:00 a.m. to 5:00 p.m. ET Monday through Friday.

View the file

Other files

File Type Posted
MBSOA Sources Sought Notice.docx DOCX document

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file

Text version

Performance Work Statement (PWS) Mortgage-Backed Securities Operations & Analytics (MBSOA) September 1, 2026

Table of Contents

Vision Statement7
1 General Information7
1.1 Scope of Work7
1.2 Background7
1.2.1Overview of Integrated Support Systems8
1.2.1.1Division of Contractor Responsibilities9
1.2.1.2Hosting10
1.2.1.3Connectivity with Consolidated Cloud Infrastructure10
1.2.1.4Troubleshooting10
1.2.2Description of Applications & Databases11
1.2.2.1RFS Front-End & Back-End Hosting11
1.2.2.2RFS11
1.2.2.3Enterprise Wide Operational Data Store (EWODS)11
1.2.2.4Informatica12
1.2.2.5SAP Business Objects (SAP BOBJ)12
1.2.2.6Ginnie Mae Meta Data System (GEMS)12
1.2.3Ginnie Mae Definitions & Terminology13
1.2.3.1Continuous Improvements - Minor and Major Enhancements13
1.2.3.2Technical Advisory Services versus Specialized Analytics, Consultation, and Project Support Work14
1.2.3.3Document Support15
1.2.3.4Reporting15
1.3 Constraints15
1.3.1Project Planning and Management17
1.4 Non-Personal Services18
1.5 Period of Performance18
1.6 Place of Performance18
1.7 Hours of Operation19
1.8 Special Qualifications19
1.9 Post Award/Kickoff Conference19
1.10 Status Meetings19
1.11 Contractor Travel19
1.12 Transition-In19
1.13 Transition-Out20
2 Definitions and Acronyms20
2.1 Definitions20
2.2 Acronyms22
3 Government-Furnished Property and Services27
3.1 Government Services27
3.2 Facilities27
3.3 Equipment27
3.4 Materials and Information27
3.5 Quality Assurance (QA)28
4 Contractor-Furnished Items and Services28
4.1 Facilities28
4.2 Equipment29
4.3 Materials29
4.4 Contractor Responsibilities29
4.5 Contractor Personnel29
4.6 Identification of Contractor Employees29
5 Specific Tasks29
5.1 Task One – Transition-In/Out Services30
5.1.1Transition-In30
5.1.2Transition-Out33
5.2 Task Two – Program Management35
5.2.1Post Award Kickoff Conference35
5.2.2Program Management Support36
5.2.3Enterprise Level Guidance, Deliveries & Continuous Process Improvements36
5.2.4Program Management Plan (PMP)36
5.2.5Communications37
5.2.6Risk Management Plan38
5.2.7Quality Control Plan38
5.2.8Meetings40
5.2.9Monthly Metrics Reporting40
5.2.10Content Management Solution41
5.2.11 Support of Ginnie Mae’s Operational Risk Analysis Divisions Examinations and Audits43
5.3 Task Three – Data Collection & Reporting44
5.3.1Data Collection and Reporting (Monthly, Quarterly, Annually)44
5.3.2Validate, Process, Analyze, Access, Monitor and Report Data on Pool, Loan and Participation Level Information Received Monthly from Ginnie Mae Issuers, Contractors and Other Parties45
5.3.3Reporting of Monthly Operational Activity and Statistics47
5.3.4Collect Multifamily Prepayment Penalty Data and Deliver to the MBSIBA47
5.3.5Guaranty Fee Reconciliation48
5.3.6Assigning Census IDs to Loan Level Records49
5.3.7Monthly Loan Matching49
5.3.8Support the Monthly RFS Suspense Process51
5.3.9Mortgage Electronic Registration (MERS) Reconciliation52
5.3.10Digital Collateral Monitoring Support53
5.3.11Widely Held Fixed Investment Trusts (WHFITs)54
5.3.12Custodial Account Verification (CAVS)55
5.3.13SCRA Qualifications & Reimbursements55
5.3.14Liquidation Event Reporting (LER) and Payment Default System (PDS)57
5.3.15Validation & Testing Tool (VTT) and Mortgage Industry Standards Maintenance Organization (MISMO) Pool Delivery Dataset (PDD) User Support57
5.4 Task Four – Data Disclosures59
5.4.1Data Disclosure Release Schedule60
5.4.2Data Disclosure Activities62
5.4.3Data Disclosure Enhancements63
5.5 Task Five – Risk & Information Analytics65
5.5.1Program, Portfolio, and Issuer Analysis65
5.5.2Analytics and Risk Applications69
5.5.3Support for Issuer Audited Financial Statement Review80
5.5.4Risk Review of New Issuer Applications80
5.5.5Mortgage Bankers Financial Reporting Form (MBFRF) Analysis - Data Quality Checks82
5.5.6Establish and Maintain Third Party Data Interfaces82
5.6 Task Six – Operations, Maintenance & Minor Enhancements83
5.6.1Operations and Maintenance (O&M)83
5.6.2O&M for Applications Used to Provide and Support MBSOA Services86
5.6.3SUBTASK 6A – IT Operations & Maintenance87
5.6.4SUBTASK 6B – Business Operations & Maintenance97
5.6.4.1Business O&M Support97
5.6.4.2Ginnie Mae Customer Support / Centralized Service Desk103
5.6.4.3Disaster Recovery106
5.6.4.4Continuity of Operations107
5.6.5SUBTASK 6C – Post-Award Incremental Operations and Maintenance Support (Optional)109
5.7 Task Seven – Systems Security Requirements110
5.7.1Federal Information Technology Security115
5.7.2Federal Information Systems Controls Audit Manual (FISCAM), OMB A-123 And Other Audit Support117
5.8 Task Eight – Enhancements, Integrated Software Development and Specialized Support (Optional)118
5.8.1Corrective, Adaptive, and Other Major Enhancements Greater than the 500 Hours Threshold118
5.8.2Integrated Software Development and Transformation Initiatives Support125
5.8.3Capitalization Reporting126
5.8.4Specialized Analytics, Consultation, & Project Support126
5.9 Task Nine – Customer-Centric Service Delivery: Customer Adoption, Trainings & Conferences (Optional)129
5.9.1CX: Trainings & Conferences129
5.9.2CX: Adoption & Program Support130
5.9.3CX: Performance Standards, KPIs, SLAs, and Reporting Deliverables133
5.10 Task Ten – Statement on Standards for Attestation Engagements (SSAE) 18 TYPE II SOC 1 & SOC 2 (SOC 2 OPTIONAL)134
5.11Section 508 Compliance136
5.12Other Direct Costs (ODCs) & Travel136
6 Deliverables138
6.1 Quality Control Plan149
6.2 Acceptance Criteria149
7 Related Documents151
8 Performance Requirements Summary151
9 Special Contracts Requirements172
ATTACHMENT A: MBSOA RISK AND INFORMATION ANALYTICS REPORTS182
ATTACHMENT B: VENDOR CAPITALIZATION COST REPORTING187
ATTACHMENT C: GINNIE MAE MBSOA MONTHLY CONTRACT DELIVERABLES SUMMARY191
ATTACHMENT D: MORTGAGE-BACKED SECURITIES OVERVIEW192
ATTACHMENT E: GINNIE MAE PROFILE205

Performance Work Statement (PWS) Mortgage-Backed Securities Operations & Analytics (MBSOA) Vision Statement Ginnie Mae’s vision is to acquire a contractor to deliver mission-critical Mortgage-Backed Securities (MBS) operations that provide advanced data collection and reporting, robust data analytics and risk analysis, comprehensive data disclosures, regulatory and compliance monitoring, while ensuring highly available, secure, agile and optimized applications and an enhanced seamless participant experience.

1 General Information

1.1 Scope of Work

The U.S. Department of Housing and Urban Development (HUD), Government National Mortgage Association (Ginnie Mae), Office of Securities Operations (OSO) seeks contractor support to manage reporting and disclosure on a $2.1 trillion dollar portfolio consisting of 11 million loans, and 675,400 MBS pools. The Contractor shall support Ginnie Mae's core business functions: 1) Data Collection and Reporting, 2) System Support Services, as well as 3) Analysis and Risk Services. The Contractor is responsible for maintaining existing business applications and operations and for performing comprehensive risk management and data analysis activities necessary for Ginnie Mae to manage its financial risk as well as the financial risk of its program participants.

The scope of the MBSOA work to be performed under this contract is as follows:

· MBS Operations Services:

· Information Technology Services:

· MBS Analytics & Risk Services:

· Other Services:

Detailed descriptions of specific tasks are provided in Section 5 – Specific Tasks.

1.2 Background

Ginnie Mae guarantees that investors in bonds guaranteed by its programs will receive the timely payment of principal and interest. Ginnie Mae is a wholly owned corporate instrumentality of the United States located within the U.S. Department of Housing and Urban Development (HUD). Its powers are prescribed by Title III of the National Housing Act, as amended (12 U.S.C. 1716 et seq.). Through its MBS programs, Ginnie Mae guarantees privately issued securities that are backed by pools of mortgages insured or guaranteed by the Federal Housing Administration (FHA), the Department of Veterans Affairs (VA), Rural Development (RD) of the U.S. Department of Agriculture (USDA), and HUD’s Public and Indian Housing program (PIH). If borrowers fail to make timely payments on their mortgages, the Issuer of the MBS must make the timely payments to the registered holders, using the Issuer’s own resources.

The Ginnie Mae MBS Program is governed by guaranty agreements entered by Ginnie Mae and Issuers according to the terms of the Mortgage-Backed Securities Guide 5500.3, Rev. 1 (MBS Guide). The MBS Guide is available on Ginnie Mae’s website at www.ginniemae.gov. Additional program information is available in Attachment D: Mortgage-Backed Securities Overview.

Ginnie Mae’s MBS programs include Single Family, Multifamily, Manufactured Housing (MH), Home Equity Conversion Mortgages (HECM) and Multiclass securities. These programs help to channel funds from the nation's capital markets into the market. The U.S. Government's full faith and credit guarantee makes MBS securities widely acceptable to capital markets investors which choose to invest in primary mortgages because of the guarantee. Ginnie Mae guarantees the registered holder of the securities the timely payment of scheduled monthly principal and interest (P&I) payments, loan prepayments and early recoveries of principal on the underlying mortgages. Issuers that receive funds through the sale of MBS securities can use the capital to make additional residential and other types of mortgage loans. Through this process, the MBS program increases the overall supply of credit available for housing and helps to ensure that credit is available at reasonable interest rates.

Ginnie Mae requires a Contractor to support the Agency’s work to administer its single class and multiclass MBS programs and to ensure the smooth functioning of MBS markets. Ginnie Mae requires services to support its MBS operations; data collection and reporting; application operations, maintenance, and security; risk and information analytics; enhancements, integrated software development and transformation initiative support; and specialized data and risk analysis support needed to run Ginnie Mae’s MBS programs.

The objective of this requirement is for Ginnie Mae to acquire a contractor to:

· Support the program participant reporting cycles for the life of all MBS and provide robust MBS data analytics, risk analysis and predictive analytic capabilities to improve Ginnie Mae’s data driven decision making ability to effectively manage its MBS portfolio of evolving programs, services and risk profile.

· Support Ginnie Mae in providing a seamless customer experience for its program participants and robust and enhanced data disclosure reporting for its investors while streamlining Ginnie Mae’s MBSOA operations and business processes.

· Provide agile, efficient, reliable, flexible, highly available and secure MBSOA applications, systems and business processes to enable Ginnie Mae to quickly respond to MBS market changes with new capabilities, products and improved performance.

· Provide MBS expertise and thought leadership with innovative approaches and solutions to support and expand Ginnie Mae’s MBS programs and capabilities to meet program participants needs by working collaboratively with Ginnie Mae and its business partners.

1.2.1 Overview of Integrated Support Systems

Ginnie Mae and its Contractors operate in a highly integrated IT infrastructure and business process environment. Systems, applications, and infrastructure used to support the MBSOA Contractor are hosted primarily in the AWS GovCloud and supported by Ginnie Mae’s IT Infrastructure Dedicated Cloud Services (IT IDCS) Contractor, to be referred to in this PWS as the Cloud Application Migration and Operations (CAMO) Contractor. This platform is tightly integrated with systems supported by the CAMO Contractor which includes direct connectivity to the CAMO technology environments. Additionally, the MBSOA systems, data and applications are tightly integrated with platforms and applications supported by Ginnie Mae’s MBS Issuance & Bond Administration (MBSIBA) Contractor.

There are also several other Contractors that support additional Ginnie Mae key MBS operations, business applications and technology systems that interface or integrate with the MBSOA applications to include the Ginnie Mae Financial Accounting System (GFAS), Subledger Database (SLDB), VMMR and MSS Contractors. This requires a high degree of integration, collaboration, and coordination between each of Ginnie Mae’s business partners to support the overall Ginnie Mae enterprise.

The MBSOA Contractor shall assume application O&M responsibility for all current MBSOA services as part of this contract. The MBSOA Contractor shall provide the technical and collaborative skills necessary to operate as part of an integrated team across Ginnie Mae’s technology support ecosystems to include multiple contractors as part of IPT.

1.2.1.1 Division of Contractor Responsibilities

The MBSOA Contractor is responsible for O&M and enhancements for all applications necessary to support the services described in this contract along with the Data Collection and Reporting and Risk and Information Analytic services described in this PWS.

The MBSIBA Contractor is responsible for the engineering, connectivity to Ginnie Mae’s mainframe infrastructure, mainframe hosting, MBSIBA application security, compliance, O&M, integration and enhancements of the systems and applications depicted in the infrastructure architecture for MBSIBA in the Virtual Reading Room (See Solicitation for Virtual Reading Room Instructions) along with the other services they provide.

AWS GovCloud hosting services for the MBSOA applications are provided by the CAMO Contractor. It shares responsibility with the MBSOA Contractor for the security, and O&M of the applications. The applications are tightly integrated across both the MBSIBA Contractor as well as the CAMO Contractor with its infrastructure and systems.

Securitization Division of Contractor Responsibilities

MBSIBA Contractor
MBSOA Contractor
CAMO Contractor

· Pool processing, issuance & delivery.

· Calculation, collection, and distribution of P&I due security holders.

· Ongoing Bond Administration.

· Platinum Trustee & REMIC Information Agent.

· Engineering, mainframe hosting, security, O&M, and enhancements of IT mainframe infrastructure, systems and applications supporting these services.

· Investor Reporting & Disclosures.

· Ongoing Bond Administration.

· Risk & Information Analytics.

· O&M, administration, patching, upgrading, security & enhancements for applications, identity and access management, monitoring, integrated tools, and systems supporting these services.

· AWS GovCloud services and supporting infrastructure operations for Ginnie Mae’s portable distributed applications which include MBSOA applications / systems and MBSIBA non-mainframe applications / systems.

· Granting application access for Ginnie Mae applications hosted by the CAMO Contractor.

Shared Responsibility: MBSIBA, MBSOA & CAMO Contractor

· Coordination with Ginnie Mae’s business partners on integrated projects impacting multiple business partners.

· Support integrated MBS business processes and data exchange.

· This work requires high levels of Contractor collaboration.

1.2.1.2 Hosting

All Infrastructure and applications supported by this effort are hosted in AWS GovCloud. All hosting services are provided through the Ginnie Mae CAMO contract. Mainframe applications and services are hosted by the MBSIBA contract.

1.2.1.3 Connectivity with Consolidated Cloud Infrastructure

Ginnie Mae, in coordination with the CAMO Contractor and its related providers, will provide connectivity to the Ginnie Mae AWS cloud environments via Ginnie Mae’s Virtual Desktop Infrastructure (VDI) and other secure remote access services for infrastructure or application administration related activities. The CAMO Contractor and other related providers will provide and support all dedicated connectivity to and within the AWS GovCloud.

1.2.1.4 Troubleshooting

The MBSOA Contractor will primarily work with Ginnie Mae's CAMO Contractor and other Ginnie Mae IT support Contractors as applicable for all IT-related monitoring and troubleshooting activities as well as initiatives. The Contractor is responsible for application monitoring for all applications as described in the contract. Coordination and management will be provided by Ginnie Mae as explained in Task Six – Operations, Maintenance & Minor Enhancements.

1.2.2 Description of Applications & Databases

See Task Six – Operations, Maintenance & Minor Enhancements, Section 5.6.2 O&M for Applications Used to Provide and Support MBSOA Services. These Ginnie Mae applications perform and support all MBS operations, data collections, reporting, and risk and information analytics tasks in this contract.

1.2.2.1 RFS Front-End & Back-End Hosting

RFS is used to support many MBSOA processes. The following core data reporting RFS applications/modules use the CAMO Contractor for front-end and back-end hosting and integrate with the MBSIBA for access, identity/access management, data, and processing functionalities:

(a) Contact Management (CM);

(b) Custodial Account Verification System (CAVS);

(c) Data Disclosure (DD);

(d) E-Notification (EN);

(e) HMBS Reporting and Administration (HRA);

(f) Independent Public Accounting (IPA);

(g) Matching and Suspense (MAS);

(h) Pool Accounting & Exception Feedback (PAEF), Single and Multifamily modules;

(i) RFS Administration (ADMIN);

(j) Servicemembers’ Civil Relief Act (SCRA), and

(k) Widely Held Fixed Investment Trust (WHFIT).

1.2.2.2 RFS

The following other RFS modules, applications and Operational Data Stores are hosted by the CAMO Contractor:

(a) Corporate Watch (CW);

(b) Data Analysis and Reporting Tool (DART);

(c) Ginnie Mae Analytics and Reporting System (GMARS);

(d) Ginnie Mae Meta Data System (GEMS);

(e) Ginnie Mae Operational Data Store (GMODS)

(f) Ginnie Mae Portfolio Analysis Database (GPADS);

(g) Issuer Operational Performance Profile (IOPP);

(h) Master Subservicer Operational Reporting (MOR).

In respect to items (a) through (h), above, all the application code, plus back end and reporting functionality such as Informatica, SAP Business Objects (SAP BOBJ), Tableau and databases for these applications, are hosted at the CAMO Contractor.

1.2.2.3 Enterprise Wide Operational Data Store (EWODS)

The Enterprise-Wide Operational Data Store (EWODS) is an Oracle relational database that stores transaction processing data that is sourced from various Ginnie Mae applications. EWODS is the repository of data that is collected and shared across the Ginnie Mae enterprise and multiple contractors.

EWODS supports centralized data collection and feedback for all MBS new Issuer processing, new pool originations, monthly accounting and reporting for Single Family and Multifamily pools, and Multiclass securities. EWODS provides a secure single source for all Ginnie Mae’s enterprise data, minimizing redundancy and data synchronization across disparate systems. This repository stores data from all Ginnie Mae’s Enterprise applications including RFS (maintained by the MBSOA Contractor) and Integrated Pool Management System (IPMS), GinnieNET and the other pool delivery modules (maintained by the MBSIBA Contractor). Data necessary to support the activities performed by the MBSOA will be sourced from or loaded into EWODS and often shared across various database tables and other data repositories.

1.2.2.4 Informatica

Informatica is used to manage the transfer of data across Ginnie Mae’s environments. Installations of Informatica will be hosted by the CAMO Contractor and operated and maintained by the MBSIBA Contractor and interact with applications and databases utilized by the MBSOA Contractor. Installations of Informatica are hosted at Ginnie Mae’s CAMO Contractor and are operated and maintained by the MBSOA Contractor in support of MBSOA operations. Additional installations of Informatica are hosted at Ginnie Mae’s CAMO Contractor, interact with applications and databases utilized by the GFAS Contractor, and are operated and maintained by the MBSOA Contractor. Informatica Dynamic Data Masking is hosted at Ginnie Mae’s CAMO Contractor and is utilized for creating and or masking data. Informatica Dynamic Data Masking is operated and maintained by the MBSOA Contractor.

1.2.2.5 SAP Business Objects (SAP BOBJ)

SAP BOBJ is used to support both MBSIBA and MBSOA applications. BOBJ supports the MBSOA’s RFS PAEF and other software such as IOPP, MOR and DART as well as other applications. BOBJ supports the MBSIBA’s IPMS. The CAMO Contractor will provide the hosting services and infrastructure supporting BOBJ. The MBSIBA Contractor operates and maintains installations of BOBJ that support functionality performed by the MBSOA Contractor, for example, populating various EWODS tables and transferring other data necessary to support the MBSOA. There are additional installations of BOBJ at Ginnie Mae’s CAMO Contractor used to support RFS application modules and are operated and maintained by the MBSOA contractor.

1.2.2.6 Ginnie Mae Meta Data System (GEMS)

GEMS provides a dynamic view of applications’ metadata, including the original source of data elements, the business rules applied to a data element, and the latest refresh date of each data element. Ginnie Mae uses the tool to capture the results of data integration routine activity and outputs, affording Ginnie Mae the ability to leverage the tool’s functionality in certifying mission critical data. GEMS is maintained in a sustainment state and is not expected to require enhancements or modernization activities. Contractor support is limited to periodic monitoring, routine administrative activities, and other minimal operational support necessary to maintain the system until it is decommissioned.

1.2.3 Ginnie Mae Definitions & Terminology

The ever-evolving nature of capital financial markets requires Ginnie Mae to continuously adapt, update, and change its internal work requirements, processes, and procedures. As markets evolve, Ginnie Mae must undertake minor and major changes in order to continue operating in the market. The following definitions and terms are used throughout this contract to define the types of services Ginnie Mae uses for flexibility in responding to market changes. Often, because markets respond to changes in political and economic trends, it is difficult for Ginnie Mae to predict the types of adaptations it will need to make over the next two years.

1.2.3.1Continuous Improvements - Minor and Major Enhancements
(a)Continuous Improvements

Ginnie Mae must implement continuous business, process, system, and application improvements in a cost-effective manner. Ginnie Mae proactively seeks improvements to save money, to improve performance, or for any other purpose which presents a service advantage to Ginnie Mae. The Government seeks improvements to the services, features, or other requirements in this contract. Both the Government and the Contractor may propose and, when necessary, develop any type of improvements related to this contract. To implement improvements in a cost-effective manner, all improvements are divided between Minor Enhancements and Major Enhancements based on the number of labor hours each requires.

(b) Minor Enhancements - Improvements Requiring Less Than 500 Hours A Minor Enhancement is defined as any business, process, service, or technology improvement that will take the Contractor less than 500 labor hours to implement. All Minor Enhancements are covered under Section 5.6 Task Six – Operations, Maintenance & Minor Enhancements as Firm Fixed Priced (FFP) services required by this contract. On average, Ginnie Mae undertakes eight (8) Minor Enhancements to applications per month, not to exceed 35 per quarter. The Contractor shall submit an Estimation of Effort and scope to the Contracting Officer’s Representative (COR). The COR and the Contractor shall mutually agree to whether each initiative will be performed as an enhancement of less than 500 hours or greater than 500 hours. Multiple minor enhancements less than 500 hours must not be bundled to exceed the 500-hour threshold. In the event of a dispute, the issue must be submitted to the Contracting Officer (CO) for a determination.

(c) Major Enhancements - Corrective, Adaptive and other Improvements Requiring Greater than 500 Hours A Major Enhancement is defined as any business, process, service, or technology improvement; including corrective, adaptive and other technology improvements; which will take the Contractor more than 500 labor hours to develop and implement. The Government recognizes that the Contractor may need additional staffing or expertise to develop and implement Major Enhancements. All Major Enhancements are covered under Section 5.8 Task Eight – Enhancements, Integrated Software Development and Specialized Support. Although the volume may be driven by unforeseen circumstances, the Government estimates that it will undertake fifteen (15) to twenty (20) Major Enhancements per year under the MBSOA contract through the use of Technical Guidance Memos (TGM) by approval of the CO/COR. In addition, the Government estimates that it will undertake twenty (20) plus projects of varying size per year for Integrated Software Development and Transformation Initiatives Support.

1.2.3.2 Technical Advisory Services versus Specialized Analytics, Consultation, and Project Support Work

(a) Technical Advisory Requests

(1) Technical advisory services are defined as simple requests, queries, reporting, and research work the Contractor performs as part of the regular operations and reporting requirements of this contract. The Contractor can perform this work without adding to existing staff. The information the Contractor needs to complete this work is available in the public domain or in the existing systems and applications the Contractor regularly uses to fulfill the contract requirements. Some of this work will be to pull historical information from applications. To complete this work, the Contractor does not need to undertake project development activities or receive a detailed project description from the Government. In most cases, the timing of this work is flexible, and the Contractor and the Government can mutually agree upon the delivery. All technical advisory work is covered under the relevant FFP services required by this contract.

(b) Specialized Analytics, Consultation, and Project Support

(1) Specialized Analytics, Consultation, and Project Support services are defined as more complex services that require specialized subject matter expertise, expert advice, or unique information to complete this work. Although the volume may be driven by unforeseen circumstances, the Government estimates that it will undertake ten (10) to fourteen (14) projects each year of varying size and complexity under Section 5.8.4 Specialized Analytics, Consultation, & Project Support.

(i) Specialized Subject Matter Expertise: A person or entity that is an authority in a particular area or topic. For example, Ginnie Mae may need a subject matter expert with in-depth knowledge of the MBS securities market.

(ii) Expert Advice: Advice or guidance based on experience and technical knowledge of Ginnie Mae’s programs, applications, policies, processes, and procedures.

(iii) Unique Information: External information that is not provided through Ginnie Mae’s data feeds, internal applications, or systems. For example, in-depth mathematical, modeling, market research, and sector analysis all require unique information.

(2) The Contractor may need to access outside resources, information, or expertise to complete the Specialized Projects. The Contractor may also need to undertake project development activities and or receive a detailed project description from Ginnie Mae. All work performed under Specialized Projects is covered under Section 5.8.4 Task Eight - Specialized Analytics, Consultation, and Project Support. Ginnie Mae will provide the Contractor with guidance on the performance of the Specialized Projects. Such guidance will not be of a nature which:

(i) Causes the Contractor to perform new work outside the PWS or specifications of the contract;

(ii) Constitutes a change as defined in Federal Acquisition Regulation (FAR) 52.212- 4(c) Contract Terms and Conditions - Commercial Products and Commercial Services;

(iii) Causes an increase or decrease in the cost of the contract;

(iv) Alters the period of performance (PoP) or delivery dates; or

(v) Changes any of the other express terms or conditions of the contract.

1.2.3.3 Document Support

Document support is defined as the documentation that supports the running, improving, and training for all services required by this contract. The Contractor is required to document, update, and provide the Standard Operating Procedures (SOPs), user manuals, reference materials, application related documents, diagrams, all security / Security Assessment and Authorization (SA&A) documentation related to the MBSOA applications, presentations, or online help for the services covered by this contract based on the frequency noted in the Section 6 Deliverables. All document support activities are covered under the relevant FFP services required by this contract. While performing minor enhancements, the Contractor shall review all documentation affected by the enhancement including systems, operational, user and technical documentation, and complete all required updates within 15 business days after implementation unless otherwise approved by the COR and/or PM.

1.2.3.4 Reporting

Ginnie Mae has three (3) tiers of reports: 1) automated system generated reports; 2) core reports; and 3) customized, specific reports that Ginnie Mae requests. For automated reports, each respective application produces reports that are relevant to the nature of the action being performed in that application. Ginnie Mae expects the Contractor to produce automated reports based on the business operations and processes articulated in the operations manuals. The core reports are part of the normal business functions and are listed in Section 6 Deliverables. For customized, specific reports, see Attachment A: MBSOA Risk and Information Analytics Reports.

1.3 Constraints

The services identified in this PWS will adhere to the rules, regulations, laws, standards, and conventions identified by HUD as well as within the Federal Government including all future revisions. The Contractor must adhere to all policies and procedures prescribed by Ginnie Mae to perform the services stated within this PWS. These policies and procedures have been primarily established by Ginnie Mae's Office of Securities Operations (OSO), Chief Information Security Officer (CISO), Chief Technology Architect (CTA), Project Management Organization (PMO), Data Management Competency Center (DMCC), Architecture Review Board (ARB), Office of Issuer and Portfolio Management (OIPM), Office of Capital Market (OCM), Office of Enterprise Risk (OER) and Office of Chief Financial Officer (OCFO).

Constraints include the following:

MBSOA RECOMPETE CONSTRAINTS LIST

#
Constraint Reference Name
Reference Link
1
Federal Information Security Modernization Act (FISMA)
Federal Information Security Modernization Act (FISMA)
2
Federal Information Systems Controls Audit Manual (FISCAM)
Federal Information Systems Controls Audit Manual (FISCAM)
3
Federal Managers' Financial Integrity Act (FMFIA)
Federal Managers Financial Integrity Act (FMFIA)
4
Federal Financial Management Improvement Act (FFMIA)
Federal Financial Management Improvement Act (FFMIA)
5
The Clinger-Cohen Act
The Clinger-Cohen Act
6
Government Paper Reduction Act
Government Paper Reduction Act
7
National Archives and Records Administration (NARA) Policies and Regulations
National Archives and Records Administration (NARA) Policies and Regulations
8
Federal Information Processing Standard (FIPS) Publication 199: Standards for Security Categorization of Federal Information and Information Systems
Federal Information Processing Standard (FIPS) Publication 199: Standards for Security Categorization of Federal Information and Information Systems
9
FIPS 200: Minimum Security Requirements for Federal Information and Information Systems
FIPS 200: Minimum Security Requirements for Federal Information and Information Systems
10
NIST SP 800-53 rev. 5, Security and Privacy Controls for Federal Information Systems and Organizations
NIST SP 800-53 rev. 5, Security and Privacy Controls for Federal Information Systems and Organizations
11
NIST SP 800-18 – Guide for Developing Security Plans for Federal Information Systems
NIST SP 800-18 – Guide for Developing Security Plans for Federal Information Systems
12
NIST SP 800-30 – Guide for Conducting Risk Assessments
NIST SP 800-30 – Guide for Conducting Risk Assessments
13
NIST SP 800-34 Rev. 1 – Contingency Planning Guide for Federal Information Systems
NIST SP 800-34 Rev. 1 – Contingency Planning Guide for Federal Information Systems
14
NIST SP 800-37 Rev. 2 – Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
NIST SP 800-37 Rev. 2 – Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy
15
NIST SP 800-47 Rev. 1 – Managing the Security of Information Exchanges
NIST SP 800-47 Rev. 1 – Managing the Security of Information Exchanges
16
NIST SP 800-53A Rev. 5 – Assessing Security and Privacy Controls in Information Systems and Organizations
NIST SP 800-53A Rev. 5 – Assessing Security and Privacy Controls in Information Systems and Organizations
17
NIST SP 800-59 – Guideline for Identifying an Information System as a National Security System
NIST SP 800-59 – Guideline for Identifying an Information System as a National Security System
18
NIST SP 800-60 – Guide for Mapping Types of Information and Information Systems to Security Categories
NIST SP 800-60 – Guide for Mapping Types of Information and Information Systems to Security Categories
19
NIST SP 800-84 – Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities
NIST SP 800-84 – Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities
20
NIST SP 800-160 Vol. 1 Rev. 1 – Engineering Trustworthy Secure Systems
NIST SP 800-160 Vol. 1 Rev. 1 – Engineering Trustworthy Secure Systems
21
NIST SP 800-160 Vol. 2 Rev. 1 – Developing Cyber-Resilient Systems: A Systems Security Engineering Approach
NIST SP 800-160 Vol. 2 Rev. 1 – Developing Cyber-Resilient Systems: A Systems Security Engineering Approach
22
NIST SP 800-61 Rev. 3 – Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile
NIST SP 800-61 Rev. 3 – Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile
23
NIST SP 800-171 Rev. 3 – Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
NIST SP 800-171 Rev. 3 – Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
24
OMB Circular A-123 Management's Responsibility for Internal Control
OMB Circular A-123 Management's Responsibility for Internal Control
25
OMB Circular A-123, Appendix D
OMB Circular A-123, Appendix D
26
OMB Circular A-130 Managing Information as a Strategic Resource
OMB Circular A-130
27
Executive Order 12656
Executive Order 12656
28
PPD-40, Federal Continuity Directives 1 (FCD)
PPD-40, Federal Continuity Directives 1 (FCD)
29
PPD-40, Federal Continuity Directives 2 (FCD)
PPD-40, Federal Continuity Directives 2 (FCD)
30
Executive Orders for Information Technology and Cyber Security
Executive Orders
31
CISA Directives
CISA Directives
32
DHS Management Directives - Security
DHS Management Directives - Security
33
GAO Directives
GAO Directives
34
Mortgage-Backed Securities Guide 5500.3, Rev. 1 (MBS Guide)
Mortgage-Backed Securities Guide 5500.3, Rev. 1 (MBS Guide).
35
HUD Project Planning and Management (PPM) Life Cycle V2.0
HUD Project Planning and Management (PPM) Life Cycle V2.0
36
HUD Regulations, Handbooks and Policies
HUD Regulations, Handbooks and Policies – www.HUD.gov
37
Ginnie Mae Technology Management Division Policies and Procedures
Link not applicable
38
Ginnie Mae Chief Information Security Officer Sub-policies and Procedures
Link not applicable
39
Ginnie Mae SOPs for the relevant services in this PWS
Link not applicable

1.3.1 Project Planning and Management

All HUD IT projects, including all information systems acquired, developed, enhanced, or maintained shall follow the policy, procedures, standards, and guidelines set forth within the IT Management Framework using the Project Planning and Management (PPM) Life Cycle located at HUD’s PPM Life Cycle Website:

http://portal.hud.gov/hudportal/HUD?src=/program_offices/cio/ppm/PPMV20HOME PPM was designed based on the best practices from Capability Maturity Model Integration (CMMI) for systems development and PMBok for project management. While at the foundation, PPM is designed as a Waterfall methodology, HUD encourages tailoring the PPM to use the many modern solution development methodologies available to enable the planning, development and delivery of useable functionality within 6-9 month increments.

Contractors are encouraged to propose a preferred methodology whether their solution(s) are for custom development, includes prototypes or pilots, Commercial Off the Shelf (COTS)/ Government Off the Shelf (GOTS) configuration, or Software as a Services. Working with the HUD Project Manager(s), the Contractor will tailor PPM to take advantage of contractor proposed expertise in using other methodologies in a manner that will provide HUD the best value and address all of the work necessary for successful project completion, on time, within budget, and delivering intended functionality.

The decisions of PPM tailoring are captured in the Project Tailoring Agreement (PTA), which documents the specific agreement for creating, combining, referring, or omitting specific artifacts applicable to the project, as well as adjust project control gate reviews to be consistent with the tailoring. All tailoring of PPM must be approved by HUD’s Deputy Chief Information Officer (DCIO) for Business & IT Modernization. As a default, any project without an approved project tailoring agreement is required to follow all PPM phases and artifacts as presented.

1.4 Non-Personal Services

The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual Contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services.

If the Contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the Contractor's responsibility to notify the Contracting Officer (CO) immediately. These services shall not be used to perform work of a policy, decision making or management nature, i.e., inherently Government functions. All decisions relative to programs supported by the Contactor shall be the sole responsibility of the Government.

1.5 Period of Performance

The Period of Performance shall be a one-year base period with nine (9), one-year option periods.

1.6 Place of Performance

The principal place of performance for work performed by the Contractor under this contract shall be at the Contractor’s site. Weekly, and on occasion, and with short notice, the Contractor will be asked to attend meetings at Ginnie Mae headquarters, 2415 Eisenhower Ave, Alexandria, VA 22314.

1.7 Hours of Operation

The Contractor is responsible for providing services between the hours of 8:00 a.m. to 5:00 p.m. ET Monday thru Friday except for Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closing, or similar Government directed facility closings. The Government reserves the right to change hours of operation or restrict contractor access. Government agencies will not be available during scheduled holidays, inclement weather, weekends, and after duty hours.

The Contractor shall maintain an adequate workforce for the uninterrupted performance of all tasks defined within the contract when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce is essential.

1.8 Special Qualifications

The Contractor must maintain a Software Engineering Institute (SEI) CMMI Level III Certificate for Development, active corporate ISO/IEC 20000 certification and ISO 9001 (Quality Management) certification during the contract PoP.

1.9 Post Award/Kickoff Conference

The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5 and HUD Acquisition Regulation (HUDAR) clause 2452.237-79 - Post Award Conference.

1.10 Status Meetings

The Contracting Officer, Contracting Officer’s Representative (COR), and other Government personnel, as appropriate, may meet periodically with the Contractor to also review Contractor performance, requirement status, etc. At these meetings, the Contracting Officer will apprise the Contractor of how the Government views the Contractor's performance or progress of the requirement. The Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government. Post Award Conference and subsequent meetings may be held via teleconference at the Contracting Officer's discretion.

1.11 Contractor Travel

Prior to travel, the Contractor shall coordinate with and receive Government authorization from the COR for all travel. Reimbursement of travel costs will be in accordance with the Federal Travel Regulation and in accordance with FAR 31.205-46.

1.12 Transition-In

The Contractor shall, upon the Contracting Officer's written notice, furnish transition-in services as required. As a successor, the Contractor shall have sufficient personnel on board during the six (6) month transition-in period to ensure a smooth transition with the incumbent Contractor. The Contractor shall provide an orderly transition of work acceptance and accomplishment such that any impact to the program is minimized. During the transition-in period, the Contractor shall become familiar with the requirements in order to commence full performance of services by the end of the contract transition-in period. Transition-in is not required if the successor Contractor is the incumbent Contractor.

1.13 Transition-Out

To minimize any decrease in productivity and to prevent possible negative impacts on additional services, the Contractor shall have sufficient personnel on board during the six (6) month transition-out period. The incumbent Contractor shall ensure a smooth transition with the successor Contractor during the transition-out period, prior to completion of contractual performance. The incumbent Contractor shall aid the successor in the development of plans, procedures, and methods for the assumption of all on going work. The Contractor shall provide an orderly transition of work acceptance and accomplishment, such that full control by the successor contractor is achieved by the end of the new contract transition-in period.

2 Definitions and Acronyms

2.1 Definitions

Business Day / Workday – Every official day of the week which are days between and including Monday to Friday. This does not include federal holidays and weekends.

Contractor – A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Contracting Officer (CO) – A person with authority to enter into, administer, and/or terminate contracts and make related determinations and findings on behalf of the Government. Note: the only individual who can legally bind the Government.

Contracting Officer’s Representative (COR) – An employee of the U.S. Government appointed by the Contracting Officer to perform contract administration activities regarding technical issues. This individual has authority to provide technical direction to the Contractor if direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have the authority to change the terms and conditions of the contract.

Defective Service – A service output that does not meet the standard of performance associated with the Performance Work Statement.

Deliverable – Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

Demonstration (DEMO) – This environment contains sample configuration and transaction data. The DEMO environment is leveraged to conduct additional testing for new functionality Development (DEV) – The development (DEV) environment is used by Vendors and Ginnie Mae to conduct development and integration testing prior to official system testing in SIT and UAT. Code is promoted here from the developer’s local machine and tested to ensure correctness. Once code is successfully integrated and tested here, it is considered ready for system testing.

Disaster Recovery (DR) – The disaster recovery environment is configured to support Ginnie Mae applications in the event the primary hosting facility is rendered inoperable. The disaster recovery environment will include a dedicated production environment including dedicated servers for each production (PROD) application. Connectivity will be secured through a secure VPN internet connection.

Government Furnished Property (GFP) – Government-furnished property is property in the possession of, or directly acquired by, the Government and subsequently furnished to the Contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification. Government-furnished property also includes contractor-acquired property if the contractor-acquired property is a deliverable under a cost contract when accepted by the Government for continued use under the contract.

Performance Standard – The Contractor’s performance level required by the Government.

Performance Work Statement (PWS) – A statement of work for performance-based acquisitions that describe the required results in clear, specific, and objective terms with measurable outcomes.

Production (PROD) – The production environment for Ginnie Mae. Only software that has passed system testing and been fully accepted and baselined by Ginnie Mae can be promoted to production. These are considered the critical servers hosting live data and systems for use by the public and require the highest uptime.

Quality Assurance (QA) – Policies and procedures adopted by the Government to ensure that supplies and services acquired under Government contracts conform to the contracts quality requirements.

Quality Assurance (QA) – The QA environment is for testing upgrade procedures against data, hardware, and software that closely simulates the Production environment and where intended, users test the resulting application.

Quality Assurance Surveillance Plan (QASP) – A plan describing how the agency will survey, observe, test, sample, evaluate and document the Contractor's performance in meeting critical performance standards identified in the contract.

Quality Control (QC) – All necessary measures taken by the Contractor to assure that the quality of an end product of service shall meet contract requirements.

Staging (STG)(PreProd) – This environment mirrors the production environment, and its purpose is to enable Quality Assurance tests after the DEV environment before moving to the PROD environment.

Subcontractor – Any person, other than the prime Contractor, who offers to furnish or furnishes any supplies, material, equipment, or services of any kind under a prime contract or a subcontract entered into in connection with such prime contract, and any person who offers to furnish or furnishes general supplies to the prime contractor or a higher tier subcontractor. The Government does not have privity of contract with a subcontractor.

System Integration Testing (SIT) – The SIT testing environment is where pieces of Ginnie Mae application code are uploaded and tested for interoperability with other applications. The code is integrated after normal software testing is conducted and approved.

Test (TST) – The Test environment is reserved for testing single pieces of Ginnie Mae application code. Prior to moving the code through SIT and UAT testing, the code must be tested and approved in this environment.

Training (TRN) – The Training Environment is designated for educating end users on how to operate Ginnie Mae applications. The Training environments are also paired with QA environments in some instances. These environments are typically closed off from PROD environments and enable users to experiment and learn.

User Acceptance Testing (UAT) – The UAT Environment is where Ginnie Mae applications are tested to confirm that the functionality is working properly for end users. Code will have already passed through the TST and SIT environments to reach this stage of the Software Development Lifecycle.

2.2 Acronyms

Acronym
Definition
ACH
Automated Clearing House
AI
Artificial intelligence
AICPA
American Institute of Certified Public Accounts
APMS

This is the start of the file's text. The full file is on GovTribe.

File details come from the government source that posted it. Updated .