Attachment A HECM PWS.pdf

Performance Work Statement (PWS)

Home Equity Conversion Mortgage (HECM)

Software as a Service (SaaS)

10/17/2024

Table of Content

Vision Statement

1 General Information

1.1 Introduction

1.2 Background

1.3 Constraints

1.3.1 Cybersecurity and Privacy Requirements

1.3.2 Project Planning and Management

1.3.3 Single Family Housing (SFH) Requirements

1.4 Non-Personal Services

1.5 Period of Performance

1.6 Place of Performance

1.7 Hours of Operation

1.8 Special Qualifications

1.9 Post Award/Kickoff Conference

1.10 Status Meeting

1.11 Contractor Travel

1.12 Transition In

1.13 Transition Out

2 Definitions and Acronyms

2.1 Definitions

2.2 Acronyms

3 Government-Furnished Property and Services

3.1 Government Services

3.2 Facilities

3.3 Equipment

3.4 Materials

3.5 Quality Assurance (QA)

4 Contractor-Furnished Items and Services

4.1 Facilities

4.2 Equipment

4.3 Material

4.4 Contractor Responsibilities

4.5 Contractor Personnel

4.6 Identification of Contractor Employees

5 Specific Tasks

5.1 HECM Business Services.

5.1.1 HECM Loan Origination/Projection

5.1.2 HECM Loan Setup

5.1.3 HECM Loan Servicing

5.1.4 HECM Endorsed Loan Servicing

5.1.5 HECM Assignment Document Upload and Tracking

5.1.6 HECM Assigned Servicing

5.1.7 Workflow Management

5.1.8 Borrower Portal

5.1.9 User Generated Reports

5.2 Help Desk Services.

5.3 Training

5.3.1 Instructor led Training

5.3.2 Training Material

5.3.3 On-line User Manual

5.4 Project Management, Support, and Reporting.

5.4.1 Management Plan

5.4.2 Reporting

5.5 Data Fixes and Maintenance

5.6 Interfacing with Other Systems and Data Sources

5.6.1 Interface Control Document (ICD)

5.6.2 Data Exchange - Internal and External

5.6.3 Certification and Accreditation (ATO)

5.7 Transition-In

5.8 Transition-Out.

6 Deliverables

6.1 Quality Control Plan

6.2 Acceptance Criteria

7 Related Documents

8 Performance Requirement Summary

Performance Work Statement (PWS) Home Equity Conversion Mortgage (HECM)

Vision Statement This requirement is to obtain contractor support to assist the U.S. Department of Housing and Urban Development (HUD) with business services for the Home Equity Conversion Mortgage (HECM) insurance program.

1 General Information

1.1 Scope of Work

The U.S. Department of Housing and Urban Development (HUD), Office of Single Family Housing requires contractor support to provide a business solution that fully supports all functional requirements, processes, steps, and timelines associated with loan origination/production, loan setup, and loan servicing for its HECM loan portfolios and insurance program. Services shall include:

HECM Loan Origination/Projection HECM Loan Setup HECM Loan Servicing HECM Endorsed Loan Servicing HECM Assignment Document Upload and Tracking HECM Assigned Servicing Workflow Management Borrower Portal User Generated Reports Help Desk Services.

Training Instructor led Training Training Material On-line User Manual Project Management, Support, and Reporting.

Management Plan Reporting Data Fixes and Maintenance Interfacing with Other Systems and Data Sources Interface Control Document (ICD) Data Exchange - Internal and External Certification and Accreditation (ATO) Transition-In Transition-Out

1.2 Background

The HECM program enables eligible senior homeowners to convert a portion of their accumulated home equity into available funds without requiring repayment for as long as the borrower complies with the terms of the mortgage.

Borrowers have the option to receive their loan proceeds as a lump-sum payment at closing, a scheduled monthly payment, a line of credit, or a combination of a scheduled payment and line of credit. Borrowers who choose to receive their loan proceeds in any manner except for a lump-sum payment at origination will sign two promissory notes and two mortgages, one set to the originating mortgagee and the second to the Secretary of HUD. HECMs do not have a pre-determined maturity date and remain active as long as all terms of the mortgage are met.

HECMs are originated by FHA-approved mortgagees, and provided all criteria are met, are insured by FHA. This insurance protects mortgagees from covered losses. Mortgagees are required to report information to FHA regarding insured HECMs and must request approval from HUD for some servicing tasks as well as for extensions of time.

Since HECMs do not have a pre-determined maturity date, FHA will accept assignment of qualified HECMs when the loan balance reaches a designated threshold. When HUD accepts assignment of a HECM, HUD assumes all responsibilities for servicing the loan until final disposition.

1.3 Constraints

The services identified in this PWS will adhere to the rules, regulations, laws, standards, and conventions identified by HUD as well as within the Federal Government. Constraints include the following:

The Contractor shall abide by all applicable regulations, publications, manuals, and policies, and procedures in the performance of this contract and any subsequent revisions, updates, and/or changes. These include, but are not limited to the following:

Rules, proposed rules, and notices in the Federal Register, http://www.gpo.gov/fdsys/browse/collection.action?collectionCode=FR

Healthcare Mortgage Insurance Program Handbook 4232.1, Housing Handbook 4232.1 | HUD.gov / U.S. Department of Housing and Urban Development (HUD)

E-mail Blast Link - ORCF: Index to Email Blasts | HUD.gov / U.S. Department of Housing and Urban Development (HUD)

Federal Records and Retention Acts and Regulations, and Freedom of Information Act (FOIA) Laws and Regulations, FOIA.gov - Freedom of Information Act

Handbook 1325.01, Privacy Act Handbook, https://www.hud.gov/program_offices/administration/hudclips/handbooks/admh

HUD OCIO Handbooks: https://www.hud.gov/program_offices/administration/hudc Housing Handbook 4060.1, Mortgagee Approval Handbook, Housing Handbook 4060.1 |

HUD.gov / U.S. Department of Housing and Urban Development (HUD) OMB Memoranda, https://www.whitehouse.gov/omb/information-for-agencies/memoranda/ FIPS 200 Standards for Security Categorization of Federal Information and Information

Systems, FIPS 200, Minimum Security Requirements for Federal Information and Information Systems | CSRC (nist.gov)

SP 800-171 Rev. 1 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations | CSRC (nist.gov)

Publications from National Institute of Standards and Technology (NIST), https://csrc.nist.gov/publications/sp

The Federal Information Security Modernization Act (FISMA) of 2014, Policies & Priorities | CIO.GOV

Federal Information Systems Controls Audit Manual (Government Accountability Office), Federal Information System Controls Audit Manual | U.S. GAO

Statements of Federal Financial Accounting Concepts and Standards, Federal Accounting Standards Advisory Board (FASAB), fasab.gov

Authoritative Documents from Accounting and Auditing Policy Committee Processes, aapc_op_procedures_feb_27_2014_final.pdf (fasab.gov)

Generally Accepted Government Auditing Standards (GAGAS), Yellow Book:

Government Auditing Standards | U.S. GAO

Federal Financial Management Improvement Act (FFMIA), http://www.whitehouse.gov/omb/financial/fm_systems.html

Federal Managers Financial Integrity Act (FMFIA), Federal Managers Financial Integrity Act of 1982 | The White House (archives.gov)

Government Management Reform Act, cfs-1994.pdf (treasury.gov) Good Accounting Obligations in Government Act (AGO-IC Act) (formally known as

Government Performance and Results Act or GPRA), USCODE-2019-title31-subtitleII-chap11-sec1101.pdf (govinfo.gov)

Chief Financial Officers Act, 2.4 Chief Financial Officers Act (1990) | CIO.GOV Reducing Improper Payments through the "Do Not Pay List", Do Not Pay - Contact Us

(treasury.gov) Prompt Payment; Final Rule, Document (treasury.gov) Debt Collection Act, compliance handbook (federalreserve.gov) Debt Collection Improvement Act, Debt Management (treasury.gov) E-Government Act of 2002, E-Gov Act of 2002 – Digital.gov Homeland Security Presidential Directive (HSPD) 12, Policy for a Common

Identification for Federal Employees and Contractors United States Standard General Ledger, http://www.fms.treas.gov

Reports Consolidation Act, Public Law 106 - 531 - Reports Consolidation Act of 2000 - Content Details - (govinfo.gov)

Federal Credit Reform Act, fcra.pdf (treasury.gov) Information Technology Management Reform Act of 1996 (Clinger-Cohen Act), The

Clinger Cohen Act of 1996 (defense.gov) Government Paperwork Elimination Act, 2.8 Government Paperwork Elimination Act

(1998) | CIO.GOV

Government Corporation Control Act, U.S.C. Title 31 - MONEY AND FINANCE

(govinfo.gov) Section 508 of the Rehabilitation Act of 1998, http://www.gpo.gov/fdsys/pkg/PLAW-

105publ220/pdf/PLAW-105publ220.pdf Treasury Financial Manual (TFM), http://tfm.fiscal.treasury.gov Policies, procedures, and regulations promulgated by the Bureau of the Fiscal Service, Bureau of the Fiscal Service (treasury.gov) E-Government Policy and Legislation | HUD.gov / U.S. Department of Housing and

Urban Development (HUD)

Due to the Sensitive but Unclassified (SBU) nature of the Section 232 program financial data and the Personally Identifiable Information (PII) contained therein, the Contractor shall ensure that its facilities are secured at all times.

1.3.1 Cybersecurity and Privacy Requirements

1. The Contractor shall maintain compliance with all current and future Federal IT security requirements. The Contractor shall:

A. Maintain IT security and comply with all terms and conditions of the contract throughout the term of the contract with respect to all data and information technology requirements.

B. Use, maintain, enhance, develop and upgrade all information technology software and system documentation under this Contract in accordance with Federal Laws, best practices, and regulations. This includes, but is not limited to:

i. Federal Information Security Management Act -https://www.dhs.gov/fisma

ii. The Privacy Act - https://www.archives.gov/about/laws/privacy-act-1974.html

iii. The E-Government Act - https://www.archives.gov/about/laws/egov-act-section- 207.html;

iv. The Clinger-Cohen Act - https://www.fismacenter.com/Clinger%20Cohen.pdf

v. Government Paper Reduction Act - http://www.hhs.gov/ocio/policy/collection/;

vi. Office of Management and Budget Circulars A-130, and A-I23 -https://www.whitehouse.gov/omb/circulars_default;

vii. Office of Management and Budget Memorandum 17-12 https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/ 2017/m- 17-12_0.pdf;

viii. Department of Housing and Urban Development regulations, Handbooks and Policies - http://www.HUD.gov;

ix. GAO directives; and

x. Federal Financial Manager Integrity Act (FFMIA).

C. Maintain Security Assessment and Authorization (SA&A) standards in accordance with guidance published by NIST. An independent SA&A will be performed by Housing and Urban Development (HUD) during the period of performance of this contract. The Contractor shall complete the SA&A within six (6) months after the award of the contract and again at the expiration of the SA&A and to include any revisions or updates.

D. Follow HUD’s Project Planning and Management (PPM) Life Cycle and industry best practices in the analysis, design, development, testing and implementation of proposed new systems and/or the enhancement to existing systems. This includes prohibiting live data from being used in any environment other than Production and Disaster Recovery (DR) environments.

Specifically, no live data should be used in development, testing or staging environments.

E. Review and update system documentation to ensure accuracy, compliance and completeness. Reviews and revisions must be completed and delivered to HUD quarterly.

F. The Contractor will prepare its security plan as part of its demonstration that it meets the requirements for SA&A per the applicable requirements from HUD, OMB, NIST, etc., which will require the preparation of several related documents, including but not limited to:

i. NIST FIPS 199/200 Security Categorization Analysis;

ii. NIST SP-800 Security Controls Self-Assessment;

iii. Application and network venerability scans;

iv. Business Impact Assessment;

v. Privacy Impact Assessment;

vi. Create System Security Plan, Risk Assessment, Technical Architecture, COOP and Contingency Plans, Quality Control Plan, ST&E Plan and other relevant SA&A supporting documentation for each new application;

vii. Security Assessment Tests (formerly ST&E Testing);

viii. Security Assessment Reports (formerly ST&E Report);

ix. POA&M; and

x. Accreditation Documentation.

G. Each mixed or financial system that the contractor manages, develops, modifies, enhances, releases and/or upgrades will be assessed under the Federal Information System Controls Audit Manual (FISCAM) methodology that include control families for both General Computer and Business Process Application controls:

i. General Controls:

1. Security Management

2. Access Controls

3. Configuration Management

4. Segregation of Duties

5. Contingency Planning

ii. Business Process Application Controls:

1. Application Security

2. Business Process Controls

3. Interfaces

4. Data Management

H. Each mixed or financial system that the contractor manages, develops, modifies, enhances, releases and/or upgrades must comply with identified OMB A-123 Appendix A "Management's Responsibility for Internal Control", and Appendix D “Compliance with the Federal Financial Management Improvement Act of l996” key controls; and the Federal Information Security Management Act of 2002 (FISMA) to include:

i. National Institute of Standards and Technology Special Publication (SP) 800-53, Security and Privacy Controls for Federal Information Systems and Organizations, Revision 5 (NIST SP 800-53, Rev. 5);

ii. NIST SP 800-18 Rev. 5 - Guide for Developing Security Plans for Federal Information Systems;

iii. NIST SP 800-23 - Guidelines to Federal Organizations on Security Assurance and Acquisition/Use of Tested/Evaluated Products;

iv. NIST SP 800-30 Rev. 5 - Guide for Conducting Risk Assessments;

v. NIST SP 800-34 Rev. 5 - Contingency Planning Guide for Federal Information Systems;

vi. NIST SP 800-37 Rev. 5 - Guide for Applying the Risk Management Framework to Federal Information Systems;

vii. NIST SP 800-47 - Security Guide for Interconnecting Information Technology Systems

viii. NIST SP 800-53A Rev. 5 - Guide for Assessing the Security Controls in Federal Information Systems and Organizations, Building Effective Security Assessment Plans;

ix. NIST SP 800-59 - Guideline for Identifying an Information System as a National Security System;

x. NIST SP 800-60 Rev. 5 - Guide for Mapping Types of Information and Information Systems to Security Categories;

xi. NIST SP 800-84 - Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities;

xii. Federal Information Processing Standards (FIPS) 199/200 - Security Categorization Analysis; and

xiii. FIPS 191 - Guideline for the Analysis of Local Area Network Security.

2. HUD’s Office of the Chief Information Officer (OCIO) will have responsibility for maintaining the FISCAM-based mapping of security controls that will be required in order to maintain compliance with FISMA, OMB A-123, and HUD security requirements.

3. The Contractor shall support and provide system security to ensure availability, confidentiality, and integrity of the HUD data applications (e.g. maintaining access control, user identification, password protection and authentication, confidentiality of customer profiles and traffic, physical and personnel security required under this PWS). Provide SA&A support, including potential off cycle or unanticipated SA&A support, over the life of the contract.

4. The HUD System Security Plans (Risk Assessment, Incidence Response Plan and IT Contingency Plan) shall be reviewed and presented to HUD’s Chief Information Security Officer for approval.

5. The Contractor shall maintain compliance with OMB Memorandum 17-12 (Preparing for and Responding to a Breach of Personally Identifiable Information), which requires contractors and sub-contractors (at any tier) to:

A. Cooperate with and exchange information with agency officials, as determined necessary by the agency, in order to effectively report and manage a suspected or confirmed breach.

B. Properly encrypt PII in accordance with OMB Circular A-130 and other applicable policies and to comply with any agency-specific policies for protecting PII;

C. Provide and participate in mandatory training on how to identify and report a breach;

D. Report a suspected or confirmed breach in any medium or form, including paper, oral, and electronic, as soon as possible and without unreasonable delay, consistent with the agency's incident management policy and US-CERT notification guidelines;

E. Maintain capabilities to determine what Federal information was or could have been accessed and by whom, construct a timeline of user activity, determine methods and techniques used to access Federal information, and identify the initial attack vector;

F. Allow for an inspection, investigation, forensic analysis, and any other action necessary to ensure compliance with OMB M 17-12, the agency's breach response plan, and to assist with responding to a breach;

G. Identify roles and responsibilities, in accordance with OMB M 17-12 and the agency's breach response plan; and, H. Explain that a report of a breach shall not, by itself, be interpreted as evidence that the contractor or its subcontractor (at any tier) failed to provide adequate safeguards for

PII.

6. The Contractor shall provide and present a Security Self-Assessment Report to HUD’s Chief Information Security Officer on an annual basis, due no later than August 31st of each calendar year.

7. Plans of Action and Milestones (POA&Ms) shall be reviewed and updated on a timeframe that is consistent with contract terms, e.g. quarterly, annual, bi-monthly, etc. and present them to HUD’s CISO for review and approval.

8. Failure to adhere to the above NIST requirements could result in penalties, to include a contract performance stop-work order until compliance can be demonstrated. Disregard of these NIST requirements could also lead to other criminal, civil, administrative, or contract penalties, including, but not limited to:

A. Breach of Contract damages B. False Claims Act damages C. Liquidated Damages D. Termination for Default E. Termination for Convenience F. Poor Past Performance G. Suspension/debarment

1.3.2 Project Planning and Management

All HUD IT projects, including all information systems acquired, developed, enhanced, or maintained shall follow the policy, procedures, standards, and guidelines set forth within the IT Management Framework using the Project Planning and Management (PPM) Life Cycle located at HUDs PPM Life Cycle Website:

http://portal.hud.gov/hudportal/HUD?src=/program_offices/cio/ppm/PPMV20HOME PPM was designed based on the best practices from the Capability Maturity Model Integration (CMMI) for systems development and PMBok for project management. While at the foundation, PPM is designed as a Waterfall methodology, HUD encourages tailoring the PPM to use the many modern solution development methodologies available to enable the planning, development, and delivery of useable functionality within 6-9-month increments.

Contractors are encouraged to propose a preferred methodology whether their solution(s) are for custom development, includes prototypes or pilots, Commercial Off the Shelf (COTS)/ Government Off the Shelf (GOTS) configuration, or Software as a Services. Working with the HUD Project Manager(s), the Contractor will tailor PPM to take advantage of contractor proposed expertise in using other methodologies in a manner that will provide HUD the best value and address all the work necessary for successful project completion, on time, within budget, and delivering intended functionality.

The decisions of PPM tailoring are captured in the Project Tailoring Agreement (PTA), which documents the specific agreement for creating, combining, referring, or omitting specific artifacts applicable to the project, as well as adjust project control gate reviews to be consistent with the tailoring. All tailoring of PPM must be approved by HUDs Deputy Chief Information

Officer (DCIO) for Business & IT Modernization. As a default, any project without an approved project tailoring agreement is required to follow all PPM phases and artifacts as presented.

1.3.3 Single Family Housing (SFH) Requirements

The services identified in this PWS will adhere to the applicable rules, regulations, laws, standards, and conventions identified by SFH include the following:

National Housing Act, 12 USC 1715z-20, Insurance of Home Equity Conversion Mortgages for Elderly Homeowners

24 CFR 206, Home Equity Conversion Mortgage Insurance Rules, proposed rules, and notices in the Federal Register http://www.gpo.gov/fdsys/browse/collection.action?collectionCode=FR Home Equity Conversion Mortgages for Seniors http://portal.hud.gov/hudportal/HUD?src=/program_offices/housing/sfh/hecm/hecmhom HUD Handbook 2400.25, Information Technology Security Policy Housing Handbook 4060.1, Mortgagee Approval Handbook Housing Handbook 4000.1 FHA Single Family Housing Policy Housing Handbook 4310.5, Revision 2, Property Disposition Handbook – One to Four

Family Housing Handbook 4330.1, Revision 5, Administration of Insured Home Mortgages, Chapter 13, Home Equity Conversion Mortgages (HECMs) Housing Handbook 4330.2, Revisions 1 & 2, Mortgage Assignment Processing and

Secretary-Held Servicing Housing Handbook 4335.2, Secretary-Held Servicing Housing Handbook 7610.0, HECM Housing Counseling Protocol Housing Handbook 7610.1, Revision 5, Housing Counseling Program Handbook Home Equity Conversion Mortgages for Lenders (HECMs) http://portal.hud.gov/hudportal/HUD?src=/program offices/housing/sfh/hecm/hecmhome lenders HUD Mortgagee Letters https://www.hud.gov/program_offices/administration/hudclips/letters/mortgagee of the E-Government Act of 2002 OMB Memorandum M-99-20, Security of Federal Automated Information Resources OMB Memorandum M-06-15, Safeguarding Personally Identifiable Information OMB Memorandum M-06-16, Protection of Sensitive Agency Information OMB Memorandum M-06-19, Reporting Incidents Involving PII OMB Memorandum M-06-20, Reporting Instructions for the Federal Information

Security Act and Agency Privacy Management Federal Information Processing Standards (FIPS) Publications http://csrc.nist.gov/publications/PubsFIPS.html Federal Information Systems Controls Audit Manual (Government Accountability Office) Privacy Act Prompt Payment Act E-Government Act Homeland Security Presidential Directive (HSPD) 12, Policy for a Common

Identification for Federal Employees and Contractors

Information Technology Management Reform Act Government Paperwork Elimination Act Section 508 of the Rehabilitation Act Treasury Financial Manual (TFM) http://tfm.fiscal.treasury.gov Policies, procedures, and regulations promulgated by the Bureau of the Fiscal Service

1.4 Non-Personal Services

The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual Contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services.

If the Contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the Contractor's responsibility to notify the Contracting Officer (CO) immediately. These services shall not be used to perform work of a policy, decision making, or management nature, i.e. inherently Government functions. All decisions relative to programs supported by the Contactor shall be the sole responsibility of the Government.

1.5 Period of Performance

The period of performance shall be for one 12-month base period and four 12-month option periods for a total of five (5) years.

1.6 Place of Performance

The place of performance shall be at the Contractor’s facility.

1.7 Hours of Operation

The Contractor is responsible to have the solution available twenty-four (24) hour a day, seven

(7) days per week, including recognized Federal holidays, except for periods of approved scheduled downtime/maintenance.

The helpdesk shall be available between the hours of 7:00am and 9:00pm EST Monday thru Friday. Exceptions to the helpdesk availability requirements are Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closing, or similar Government directed facility closings.

The Contractor shall maintain an adequate workforce for the uninterrupted performance of all tasks defined within the contract.

1.8 Special Qualifications – N/A

1.9 Post Award/Kickoff Conference

The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5 and HUD Acquisition Regulation (HUDAR) clause 2452.237-79 – Post Award Conference.

The Government intends to convene a Post Award Teleconference with the Contractor within ten business days after contract award. The Contracting Officer will notify the Contractor of the specific date, time, and agenda within five business days after contract award.

1.10 Status Meetings

The Contracting Officer, Contracting Officer’s Representative (COR), and other Government personnel, as appropriate, may meet periodically with the Contractor to also review Contractor performance, requirement status, etc. At these meetings, the Contracting Officer will apprise the Contractor of how the Government views the Contractor's performance or progress of the requirement. The Contractor will apprise the Government of problems, if any, being experienced.

Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government. Post Award Conference and subsequent meetings may be held via teleconference at the Contracting Officer's discretion.

1.12 Contractor Travel

Prior to travel in support of this requirement, the Contractor shall coordinate with and receive Government authorization from the COR for all travel. Reimbursement of travel costs will be in accordance with the Federal Travel Regulation and in accordance with FAR 31.205-46.

1.12 Transition In

The Contractor shall, upon the Contracting Officer's written notice, furnish Transition-In services as required. As a successor, the Contractor shall have sufficient personnel on board during the 180-day Transition-In period to ensure a smooth transition with the incumbent Contractor. The Contractor shall provide an orderly transition of work acceptance and accomplishment such that any impact to the program is minimized. During the Transition-In period, the Contractor shall become familiar with the requirements in order to commence full performance of services by the end of the contract Transition-In period. Transition-In is not required if the successor Contractor is the incumbent Contractor. Additional transition-in requirements are listed in Section 5.

1.13 Transition Out

To minimize any decrease in productivity and to prevent possible negative impacts on additional services, the Contractor shall have sufficient personnel on board during the 180-day Transition- Out period. The incumbent Contractor shall ensure a smooth transition with the successor Contractor during the Transition-Out period, prior to completion of contractual performance. The incumbent Contractor shall aid the successor in the development of plans, procedures, and methods for the assumption of all on going work. The Contractor shall provide an orderly transition of work acceptance and accomplishment, such that full control by the successor Contractor is achieved by the end of the new contract Transition-In period. Additional transition-out requirements are listed in Section 5.

2 Definitions and Acronyms

2.1 Definitions

Accelerated Note - A mortgage note that must be paid in full in order to avoid foreclosure.

Asset Sale - Secretary Held mortgages sold in bulk to investors.

Assigned Mortgages - The terms Assigned Mortgages, Secretary-Held, and Assignments shall be synonymous and may be used interchangeably in this contract.

Assignments - Loans assigned by Lenders to the Secretary of HUD for servicing.

Assignment of Mortgage – Document transferring legal ownership of a security interest in a property to the Secretary of HUD.

Acceptable Quality Level - The level of acceptable performance required by the Government.

Business/Work Days - Every official work day of the week which are days between and including Monday to Friday. This does not include public holidays and weekends.

Calendar Day - Any day of the week.

Contractor - A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Contracting Officer (CO) - A person with authority to enter into, administer, and/or terminate contracts and make related determinations and findings on behalf of the Government. Note: the only individual who can legally bind the Government.

Contracting Officer Representative (COR) - An employee of the U.S. Government appointed by the Contracting Officer to perform contract administration activities regarding technical issues.

This individual has authority to provide technical direction to the Contractor if direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

Corrective Action Plan- A step by step plan of action that is developed by the Contractor to achieve targeted outcomes for resolution of identified nonconforming service(s).

Corrective Action Request- A formal notification sent from the Contracting Officer to the Contractor. The notification asks the Contractor to provide cause and remedy for a nonconformity found within a product, process, or service.

Custodial Care - The managing of vacant properties, secured by a HUD-held mortgage, which have been assigned to one of HUD’s Management and Marketing contractors to preserve and protect the property.

Day – a calendar day, unless otherwise specified.

Defective Service - A service output that does not meet the standard of performance associated with the Performance Work Statement.

Deliverable - Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

Due and Payable - A mortgage that must be paid in order to avoid foreclosure.

FHA Connection - HUDs interactive internet system that provides approved Federal Housing Administration (FHA) lenders the ability to process loan information.

First 12-month Disbursement Period - the period beginning on the day of closing and ending on the day before the anniversary date of closing. When the day before the anniversary date of closing falls on a federally observed holiday, Saturday, or Sunday, the end period will be on the next business day.

Force Majeure - Specific events that are beyond the control and without the fault or negligence of the Contractor. Examples of these events are (1) acts of God or of the public enemy, (2) acts of the Government in either its sovereign or contractual capacity, (3) fires, (4) floods, (5) epidemics, (6) quarantine restrictions, (7) strikes (8) freight embargoes, and (9) unusually severe weather.

Foreclosure Agent - A contract attorney, a Department of Justice contract attorney, a Department of Justice attorney, or a Foreclosure Commissioner designated under the Single- Family Mortgage Foreclosure Act who carries out the foreclosure actions.

Government Furnished Property (GFP ) - Government-furnished property means property in the possession of, or directly acquired by, the Government and subsequently furnished to the Contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification.

Government-furnished property also includes contractor-acquired property if the contractor-acquired property is a deliverable under a cost contract when accepted by the Government for continued use under the contract.

HOA/COA-Home Owners Association/Condominium Owners Association Industry Standards - Generally accepted business practices within the Industries of Real Estate, Lending, and Management of Assets.

Key Personnel - Personnel specifically considered being essential to the work being performed under this contract, pursuant to HUDAR 2452.237-70, Key Personnel.

Line of Credit Payment - A line of credit established by the borrower at the time of origination that the borrower may draw against at any time over the life of the loan.

Mandatory Obligations-are fees and/or charges incurred in connection with the origination of the HECM that are requirements for loan approval and which will be paid at closing or during the First 12-Month Disbursement Period Net Principal Limit – the amount of mortgage proceeds available each month Originator-an FHA-approved lender that (I) takes a residential mortgage loan application; and (II) offers or negotiates terms of a residential mortgage loan for compensation or gain.

Performance Dashboard- a data visualization tool that provides Government users with the ability to measure, manage, and monitor the performance activities within a contract, to help ensure successful contract performance.

Performance Evaluation - The COR’s record of the Contractor’s performance, under the contract, will be used for consideration of exercising an option and future source selection purposes by other Federal departments and agencies.

Performance Requirements Summary (PRS) - A listing of the performance requirements under the contract that are to be evaluated by the Government on a regular basis, performance indicators for these requirements, performance standards for these requirement and surveillance methods to be used to determine if performance standards are met.

Performance Standard - The Contractor's performance level required by the Government.

Performance Work Statement (PWS) - A statement of work for performance based acquisitions that describe the required results in clear, specific and objective terms with measurable outcomes.

Physical Security - Actions that prevent the loss or damage of Government property.

Principal Balance - the sum of all disbursements made to or on behalf of the borrower as of a particular date, commonly known as the outstanding mortgage balance.

Principal Limit - the initial amount of mortgage proceeds available for disbursement Program Office - For the purposes of this contract, the Office of Single Family Housing under the Assistant Secretary for Housing/FHA Commissioner.

Property Charges - Charges consisting of taxes, ground rents, flood and hazard insurance premiums, flood insurance premiums, condominium fees, planned unit development fees, homeowner’s association fees, and any other special assessments.

Quality Assurance (QA) - Policies and procedures adopted by the Government to ensure that supplies and services acquired under Government contracts conform to the contracts quality requirements.

Quality Assurance Surveillance Plan (QASP) - A plan describing how the agency will survey, observe, test, sample, evaluate and document the Contractor's performance in meeting critical performance standards identified in the contract.

Quality Control (QC) - All necessary measures taken by the Contractor to assure that the quality of an end product of service shall meet contract requirements.

Reimbursable Cost - A bill, expense, or cost the Contractor pays directly and subsequently invoices and obtains payment from HUD for reimbursement of the amount paid, with no additional fees added.

Secretary-Held - Any mortgage or property owned by the Department of HUD Servicer – an FHA-approved Mortgagee performing servicing actions on FHA-insured Mortgages on its behalf or on behalf of or at the direction of another FHA-approved Mortgagee.

Set Aside account – mortgage proceeds set aside from the initial principal limit amount, includes repairs, property charge, life expectancy, and servicing fee Short Sale - The offer by a third party to purchase a property secured by a Secretary-held mortgage for the market value where that value is less than the total amount owed on the mortgage.

Subcontractor - Any person, other than the prime Contractor, who offers to furnish or furnishes any supplies, material, equipment, or services of any kind under a prime contract or a subcontract entered into in connection with such prime contract, and any person who offers to furnish or furnishes general supplies to the prime contractor or a higher tier subcontractor. The Government does not have privity of contract with a subcontractor.

Title II – Section of the National Housing Act governing HUD’s Single Family Mortgage Insurance Program.

Work Week - Monday through Friday, unless specified otherwise.

2.2 Acronyms

AQL - Acceptable Quality Level CAP- Corrective Action Plan CAR- Corrective Action Request CBT - Computer-Based Training CFO or OCFO - Office of the Chief Financial Officer of HUD CFR - Code of Federal Regulations CIO or OCIO - Office of the Chief Information Officer of HUD CO - Contracting Officer COI - Certificate of Indebtedness COOP - Continuity of Operations Plan COR - Contracting Officer Representative COTS - Commercial Off-the-Shelf CPO - Office of the Chief Procurement Officer of HUD DIL - Deed in Lieu of Foreclosure DOJ - Department of Justice EST - Eastern Standard Time (U.S.)

FHA - Federal Housing Administration

FHAC - FHA Connection FOIA - Freedom of Information Act GAO - U.S. General Accounting Office HCA - Housing Counseling Agency HECM - Home Equity Conversion Mortgages HUD - U.S. Department of Housing and Urban Development HUDAR - HUD Acquisition Regulation HUD/ISG - Internet Services Group within the Telecom Processing Division HUD Web - HUDs Intranet Web Site and related web pages.

IG or OIG – Office of Inspector General IRS - Internal Revenue Service IT - Information Technology IV&V - Independent Validation and Verification M & M(s) - Management and Marketing Contractor(s) MIC - Mortgage Insurance Certificate ML - Mortgagee Letter MOU - Memorandums of Understanding MWP - Management Work Plan NHW - Neighborhood Watch NJF - Non-Judicial Foreclosure NARA - National Archives and Records Administration NSC - HUD National Servicing Center, Oklahoma City and Tulsa, OK OCPO - Office of the Chief Procurement Officer OIG - Office of Inspector General OMB - Office of Management and Budget PII - Personally Identifiable Information PL - Public Law PLF – Principal Limit Factor PM - Project Manager POC - Point of Contact PPM - Project Planning and Management QA - Quality Assurance QASP - Quality Assurance Surveillance Plan QCP - Quality Control Plan REO - HUD Real Estate Owned Division RESPA - Real Estate Settlement Procedures Act SF - Standard Form SOP - Standard Operating Procedure TBD - To be determined UERM - Universal Electronic Records Management U.S.C - United States Code VRS - Voice Response System

3 Government-Furnished Property and Services The Contractor shall ensure accurate control and accountability of all Government-Furnished Property in accordance with the terms and conditions of this contract. The Government will furnish, at no cost to the Contractor, the GFP shown below.

3.1 Government Services

The Government will provide Annual Security Awareness and Ethics training.

3.2 Facilities

The Government will not provide facilities.

3.3 Equipment

The Government will not provide equipment.

3.4 Materials

See HUDAR 2452.227-70, Government Information.

The Government shall provide the following materials and information:

Data Tables Data Dictionary HECM Business Requirement Documents (BRD)

3.5 Quality Assurance (QA)

The Government shall evaluate the Contractor's performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable quality level.

4 Contractor-Furnished Items and Services The Contractor shall furnish, all facilities, equipment, and supplies required to perform the work under this contract that are not listed under Government-Furnished Property and Services.

4.1 Facilities

The contractor shall furnish all facilities necessary to perform the services stated within the

PWS.

4.2 Equipment

The contractor shall furnish all equipment necessary to perform the services stated within this

PWS.

4.3 Material

The contractor shall furnish all material necessary to perform the services stated within this

PWS.

4.4 Contractor Responsibilities

The Contractor shall only conduct business with designated Government personnel listed as points of contact (POCs). Names of authorized personnel shall be provided to the Contractor by the Government, in writing, and updated as necessary throughout the contract period.

U.S. Government records, copies of original results and reports, verified original data, corrected data and corrected supporting final reports which are maintained by the Contractor remain the property of the U.S. Government. These files/results must be surrendered to the COR

4.5 Contractor Personnel

See HUDAR clause 2452.237-70 – Key Personnel in the Key Personnel Section of the contract.

4.6 Identification of Contractor Employees

All Contractor/subcontractor personnel shall wear company picture identification badges as to distinguish themselves from Government employees. When conversing with Government personnel during business meetings, over the telephone, or via electronic mail, Contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees.

Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation. Where practicable, Contractor/subcontractors occupying collocated space with their Government program customer shall identify their work space area with their name and company affiliation, or at a minimum, "Contractor" after name.

5 Specific Tasks The Contractor shall provide a solution that accepts, tracks, captures, displays, calculates, replicates, reports, and interfaces with HUD and HUD Contractor systems as well as with other systems used to support the HECM program.

5.1 HECM Business Services

The Contractor shall provide a fully functioning HECM Business Services solution that is available seven (7) days per week / twenty-four (24) hours a day except during scheduled outages for updating and maintenance.

5.1.1 HECM Loan Origination/Production

The primary responsibility for HECM loan origination through closing/endorsement processing rests with FHA-approved originators and FHA’s Homeownership Center (HOC) staff, who use HUD’s FHAC/CHUMS system. HECM Loan Production starts in FHAC/CHUMS and certain case-level data will be transferred to other HUD systems and the Contractor’s platform as the progression from origination to servicing activities are completed.

The Contractor shall exchange multiple file transfers (send and receive data multiple times a day) with FHAC/CHUMS via an FTP server located at HUD. The contractor shall:

accurately capture and display case-level data elements received via the FHAC/CHUMS interface.

ensure the FHAC/CHUMS interface file is updated at frequencies directed by HUD, with a minimum of two interface updates performed annually.

provide the ability to add/remove additional fields to the CHUMS interface file based on changes to the HECM program that are the result of legislative, regulatory, and administrative changes, or at the direction of HUD when changes are necessary, including but not limited to changes required to mitigate audit findings and to improve oversight and monitoring responsibilities.

capture, display, and store HECM Transactional Data functions from FHAC/CHUMS.

accept, capture, and display Single Family forward mortgage data from SFIS for properties refinanced with a HECM loan, including the ability to capture, link, and display the forward mortgage case number with the new HECM case number.

capture and display any previous HECM case numbers from FHAC/CHUMS and related servicer records from LEAP for all eligible HECM refinance transactions.

provide storage capacity sufficient enough to maintain all data elements, initial and subsequent data changes.

provide the ability to extract historical data upon the request of HUD.

create a data dictionary for all data elements.

generate a daily detailed interface report at the close of business every day – on-screen and downloadable – of HECM cases from FHAC/CHUMS that do not pass HECM IIF parameters, edits, and what data was and was not successfully processed and posted between the systems. The report shall list the error code, error description, number of days in error status, and additional fields as directed by HUD.

5.1.2 HECM Loan Setup

The Contractor shall provide a platform for performing HECM Loan Setup according to HECM program requirements. HECM Loan Setup is a mortgage activity that consists of additional data elements, beyond loan production data received via the FHAC/CHUMS interface, that are necessary for initially establishing the loan based on loan parameters established at closing and defined by legally executed documents.

In performing Loan Setup, the Contractor’s solution shall:

1) provide the ability, support, and functionality to perform Loan Setup, including the ability to upload case-level data manually and electronically via B2G and web interface, as a single transaction or in bulk upload.

2) accept, validate, capture, display, record and support initial data elements and subsequent changes and corrections sent from the FHAC/CHUMS interface:

provide mortgagees with B2G functionality for bulk data changes upon the approval of HUD staff and based on HUD parameters;

record endorsements from FHAC/CHUMS along with updates and changes to endorsed case information

3) provide a solution to establish, track, and maintain a running balance of mortgage proceeds available and allotted to the principal limit, net principal limit, principal balance, and the aggregate amount of disbursements that occur at closing and over the life cycle of the loan causing the principal balance to increase/decrease.

4) provide users with the ability to monitor, track and update loans within their portfolio

5) display data elements on the Loan Setup screen, including:

FHA case number;

HECM type;

borrower name;

property address;

case status;

maximum claim amount;

net principal limit;

payment option and term;

name of originator name and 10-digit FHA number;

servicer name and 10-digit FHA number;

and investor name and 10-digit FHA number.

6) perform corrective measures to update data element according to HECM business rules and parameters that are approved by the COR and HUD staff that cannot be changed by users.

7) capture, utilize, store and display additional data fields needed to establish and maintain a running balance of the principal limit, net principal limit, principal balance, post-closing periodic interest rate adjustments, disbursement of mortgage proceeds, and set-asides.

8) track and maintain an audit log of changes made to all data fields either manually or electronically via B2G, including:

User ID "Current” data field value "New” data field value Date and Time change was entered in HECM BSP Effective Date of change Transaction Date of change

9) provide, support, adjust and recalculate all loan balances, including set-aside accounts, when mortgagees enter/submit reconciliation data corrections or subsequent data is received via FHAC/CHUMS interface files that may increase or decrease the net Principal Limit amount.

10) provide the ability for HUD staff and users to view, print and export transactions in bulk for each case within their portfolio.

11) provide a solution to capture, to track and monitor the disbursement of mortgage proceeds used to satisfy Mandatory Obligations, including:

Capture and display all corrections/adjustments. Restrictions on the types of corrections and adjustments will be established by HUD.

12) capture, track, and monitor disbursement transactions that occur at closing and through the first 12 months of the loan, ensuring disbursement limits are not exceeded, and displays the amount of mortgage proceeds that will be available during the first year of the loan. FHA shall provide the formula used to determine disbursement limit;

enables scheduled and unscheduled disbursement transactions to be entered manually or entered B2G online by the servicer and applied against the first year disbursement limit;

calculate and display the expiration date of the first year disbursement limit.

calculate, capture, and display the net principal limit of mortgage proceeds available for withdrawal upon the expiration of the first year disbursement limit.

13) record and track scheduled and unscheduled disbursement transactions according to the payment options selected by the borrower. FHA will provide a list of acceptable payment options and its calculation, where applicable.

14) Automatically validate sum of the data elements on the Loan Setup screen ensuring the aggregate total does not exceed 100% of the initial principal limit amount established at loan closing.

15) provide an automated solution to establish set-aside accounts, capture and…