Attachment A - PWS - GNMA Consolidated Cloud Services_DRAFT.pdf

Performance Work Statement (PWS)

Ginnie Mae Consolidated Cloud Services

Contents

1.0 Overview

1.1 Background

1.2 Objectives

1.3 Constraints

1.4 Project Planning and Management

1.5 Description of Services - Detailed Requirements

1.6 Non-Personal Services

1.7 Period of Performance

1.8 Place of Performance

1.9 Hours of Operation

1.10 Special Qualifications

1.11 Post Award/Kickoff Conference

1.12 Status Meetings

1.13 Contractor Travel

1.14 Transition In

1.15 Transition Out

2.0 Definitions and Acronyms

2.1 Definitions

2.2 Acronyms

3.0 Government-Furnished Property and Services

3.1 Government Services

3.2 Facilities

3.3 Equipment

3.4 Materials

3.5 Quality Assurance (QA)

4.0 Contractor-Furnished Items and Services

4.1 Facilities

4.2 Equipment

4.3 Material

4.4 Contractor Responsibilities

4.5 Contractor Personnel

4.6 Identification of Contractor Employees

4.7 Quality Control

5.0 Specific Tasks

5.1 Task 1 – Transition-In

5.2 Task 2 – Program Management

5.3 Task 3 – Financial Management

5.3.1 Cloud Financial Operations (FINOPS) Office

5.4 Task 4 Consumption of Cloud Services

5.4.1 Scope of Services from Cloud providers (AWS and Non-AWS)

5.4.2 Pricing Transparency and Price Reduction Pass‐through to Ginnie Mae

5.4.3 Consolidated Billing

5.4.4 Root Credentials for Linked Accounts:

5.4.5. Account Holder:

5.4.6 Administrative Account:

5.4.7 Access to Selected Pages and Information from the Billing Management Console:

5.4.8 Cost Allocation and Usage Tags:

5.4.9. Master Payer Account:

5.4.10. Enterprise Support:

5.4.11 Consumption of non-AWS cloud services

5.5 Task 5 Transition-Out

6 Contract Deliverables

6.1 Acceptance Criteria

7 Performance Requirements Summary

7.1 Related Documents

8 Key Personnel

8.1 Program Manager (PM)

8.2 FinOps Manager

8.3 FinOps Analyst

8.4 Cost Optimization Specialist

8.5 Cloud Procurement Specialist

1.0 Overview

As part of Ginnie Mae’s strategic Information Technology (IT) modernization efforts and in accordance with the Office of Management and Budget (OMB) direction and Executive Order (EO) 14028, "Improving the Nation's Cybersecurity," which directs agencies to accelerate their migration to Cloud as part of their Zero Trust journey, Ginnie Mae is looking to more widely deploy cloud-based IT solutions to support and enhance the agency’s capability to support market expansion and improve agency cybersecurity posture.

Currently, the services are provided under an existing contract and do not support the increase in cloud services required to support the Ginnie Mae operations, modernization or the expansion of services required to meet infrastructure and cyber requirements from Executive Orders, OMB Memorandums or CISA Binding Operational Directives. At the time of the award of the existing contract, there was no published guidance or schedule supporting cloud services on a consumption-based framework. After award of existing contracts, GSA finalized a new model to support cloud services. The Cloud Services Consumption will be de-scoped from the existing contract once this contract is in place. To ensure proper funding availability of cloud services that aligns with the expansion and contraction of cloud utilization, in support of current and net new program efforts requiring cloud services, improved cyber capabilities and posture, Ginnie Mae looks to award an effort that aligns with GSA SIN 518210C. This effort is to minimize unplanned actions which is disruptive to the enterprise and increase cost, to ensure properly funding for the rapid expansion of cloud services and limit unplanned actions and contract modification requests, to seek incremental funding to support cloud services or modify or re-compete contracts due to expanding infrastructure beyond the current ceiling.

1.1 Background

Modernization of Ginnie Mae’s proprietary systems and securitization platform includes the continuation and timely implementation or enhancement of major business applications, and other MBS services related to delivering new securitization products and application infrastructure. These major IT initiatives are critical, highly specialized, and necessary to support Ginnie Mae’s role in supporting the housing market and economic recovery.

Ginnie Mae has completed its multi-year migration of its legacy applications into a cloud native/centric environment and continues to modernize the legacy platforms. The core foundation of the Ginnie Mae software development, operational infrastructure and business systems exist in the Amazon Web Services (AWS), Government Cloud Environments (GovCloud) East and West regions. Ginnie Mae has built and is currently operating 9 major Business Systems and 1 General Support System (GSS) that support over 100 mission critical applications, subsystems, web services systems, tools, Proof of Concept, and software development initiatives that are primarily hosted in the Amazon Web Services (AWS) Cloud environments and integrated across multiple cloud vendors that are designed to leverage orchestrated provisioning capabilities offered by the Cloud providers. As reference Ginnie Mae also leverages services from Salesforce, ServiceNow, and Appian Cloud Service Providers (CSPs).

The AWS cloud services are currently provided through Ginnie Mae’s IT Infrastructure Dedicated Cloud Services contract that provides the operational and security labor and cloud services through one contract. This contract does not allow for cloud services consumption on a pay as you go basis, which would enable Ginnie Mae the ability of only paying for actual services consumed. This is an industry best practice because it promotes cost efficiency and supports technological innovation that is required to meet the requirements of the organization. Additionally, the current contract model does not align with the recommended best practices for the procurement of cloud services and the separation from cloud-related IT professional services (labor) associated with operating and maintaining the cloud environment.

1.2 Objectives

Ginnie Mae intends to consolidate production and development Major Application Supporting Cloud Services purchasing under one vehicle focused on best practices for purchasing cloud services in alignment with and under Special Item Number (SIN) 518210C. This effort will not perform IT professional services (labor) associated with the security, operations, maintenance and support of the Ginnie Mae business, infrastructure and application platforms.

Ginnie Mae is increasing the use of FedRAMP commercial cloud services to maintain its technological advantage, better secure applications, and reduce costs. The commercial cloud services sought by Ginnie Mae include, but are not limited to, Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) Cloud Service Offerings (CSOs), cloud computing and commercial cloud professional support services (OEM Provider Services Only) from multiple Cloud Service Providers (CSP). Commercial (OEM Provider Services) cloud professional support services are support services provided by the CSP and are billed as part of the cloud service.

The contractor will provide the procurement of Cloud Services for Ginnie Mae that accomplishes the following:

o Transition of the existing cloud services accounts into one payer account owned by

Ginnie Mae.

o Under one payer account owned by Ginnie Mae, a multi-tenant cloud environment will exist in AWS East-West Commercial and/or Government Cloud. Ginnie Mae expects to authorize business systems at the ‘moderate’ and/or ‘low’ FISMA security categorization level to be housed in cloud environments with a mix of low, moderate and/or high controls.

o Under the same payer account owned by Ginnie Mae, a multi-tenant cloud environment will exist in AWS Government Cloud environments and associated (or linked) to the commercial account.

o Ginnie Mae expects to implement and integrate cloud services with other major Cloud

Service Providers to include (but not limited to) Microsoft, Google, and other major cloud service offerings.

o Ginnie Mae requires the abiltiy to manage and optimize cloud service costs while ensuring that the agency maintains cloud service mobility, agility, and performance.

o Achieve cost transparency by understanding cloud service costs by business function and associated business system/application.

o Promote cloud service budgeting and forecasting by tracking spending and forecasting future cloud service usage and associated costs.

1.3 Constraints

The services identified in this PWS will adhere to the rules, regulations, laws, standards, and conventions identified by HUD as well as within the Federal Government.

The Contractor shall adhere to all policies and procedures prescribed by Ginnie Mae to perform the services stated within this work statement. Such policies and procedures have been established by Ginnie Mae's Project Management Organization (PMO), Data Management Competency Center (DMCC), Architecture Review Board (ARB), Information Security Officer (ISO), and Chief Infrastructure Architecture.

Availability of the Government to direct, review deliverables, and establish guidance may influence project schedules and related milestones.

Constraints include the following:

Federal Information Security Management Act (FISMA) - https://www.dhs.gov/fisma

The Clinger-Cohen Act - https://www.fismacenter.com/Clinger%20Cohen.pdf

Government Paper Reduction Act - https://digital.gov/resources/paperwork-reduction-act-44-u-s-c-3501-et-seq

Office of Management, and Budget Circulars A-130, A-I27, and A-I23 -https://www.whitehouse.gov/omb/information-for-agencies/circulars/

Department of Housing and Urban Development regulations, Handbooks and Policies HUD

2400 series, 3150 series, 3200 series, 3300 series, 3400 series and 3500 series

FIPS 199, NIST SP 800-53, SP 800-37, SP 800-160, SP 800-30

Ginnie Mae Policies and Procedures

Executive Orders and OMB Memorandums for Information Technology and Security and CISA

Binding Operational Directives. – https://www.cisa.gov/directives -https://www.whitehouse.gov/omb/information-for-agencies/memoranda/ -https://www.federalregister.gov/presidential-documents/executive-orders

GAO directives - https://www.gao.gov/cybersecurity - https://www.gao.gov/fiscam -

Federal Financial Manager Integrity Act (FFMIA) https://obamawhitehouse.archives.gov/omb/financial_fmfia1982

E-Government Act of 2002

Homeland security Presidential Directive-12 Federal Directive 0-8530.1, Computer Network Defense (CND) Federal Instruction 0-8530.2, Support to Computer Network Defense (CND) Federal Manual 0-8530.-1M, Federal Computer Network Defense (CND) Service Provider Certification and Accreditation Process FSO Evaluator’s Scoring Metrics: Certification and Accreditation of Computer Network Defense Service Providers Federal Directive 8570.1, Information Assurance Training, Certification, and Workforce Management Federal 8570.01M, Federal Information Assurance Workforce Improvement Program Federal Directive, 8500.1, Information Assurance Federal Instruction 8500.2, Information Assurance Implémentation Federal Instruction 8510.01, Federal Information Assurance Certification and Accreditation Process

(DIACAP)

Federal 5200.2-R Federal Personnel Security Program Federal 5220.22-M, National Industrial Security Program Operating Manual Federal 5220.22-R, Industrial Security Regulation Federal 5230.20, Visits, Assignments and Exchanges of Foreign Nationals CJCS Manual 6510.01, Defense-In-Depth, Information Assurance (IA) and Computer Network Defense

(CND)

Ginnie Mae’s Information Assurance Manual Federal Security Technical Implementation Guides (STIGs)

1.4 Project Planning and Management

All HUD IT projects, including all information systems acquired, developed, enhanced, or maintained shall follow the policy, procedures, standards, and guidelines set forth within the IT Management Framework using the Project Planning and Management (PPM) Life Cycle located at HUD’s PPM Life Cycle Website:

http://portal.hud.gov/hudportal/HUD?src=/program_offices/cio/ppm/PPMV20HOME

HUD PPM was designed based on the best practices from Capability Maturity Model Integration (CMMI) for systems development and PMBok for project management. While at its foundation, PPM is designed as a Waterfall methodology, HUD encourages tailoring the PPM to use the many modern solution development methodologies available to enable the planning, development and delivery of useable functionality within 6-9 month increments.

Contractors are encouraged to propose a preferred methodology whether their solution(s) are for custom development, including prototypes or pilots, Commercial Off the Shelf (COTS)/ Government Off the Shelf (GOTS) configuration, or Software as a Services. Working with the HUD Project Manager(s), the Contractor shall tailor PPM to take advantage of Contractor proposed expertise in using other methodologies in a manner that will provide HUD the best value and address all of the work necessary for successful project completion, on time, within budget, and delivering intended functionality.

The decisions of PPM tailoring are captured in the Project Tailoring Agreement (PTA), which documents the specific agreement for creating, combining, referring or omitting specific artifacts applicable to the project, as well as adjusting project control gate reviews to be consistent with the tailoring. All tailoring of PPM must be approved by HUD’s Deputy Chief Information Officer (DCIO) for Business & IT Modernization. As a default, any project without an approved project tailoring agreement is required to follow all PPM phases and artifacts as presented.

Detailed requirements for Program Management are annotated in Section 5.2 Task 2 Program Management.

1.5 Description of Services - Detailed Requirements

1.5.1 Scope

The contract shall be for nonpersonal services to provide cloud services for Ginnie Mae production, non-production and software development environments. The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, training, training materials, and other items and non-personal services necessary to meet the requirements of this contract. The contractor shall perform all tasks identified in this PWS.

This requirement is for the procurement of cloud services to include Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS). The scope of this requirement includes all existing IaaS, PaaS, and SaaS Services, FedRAMP approved marketplace product offerings that meet the PWS requirements.

The scope includes access to any CSP marketplace product offerings that comply with the FedRAMP Impact Level of “Low”, “Moderate”, or “High”. The procurement of FedRAMP services at an Impact Level of “Low” must be approved by the Ginnie Mae Chief Architect and Chief Information Security Officer.

Any services described in this PWS for providing access, assisting in any service outages, explanations or technical discussion related to CSP services, or issues with CSP Cloud support are considered administrative in nature and will be managed through the Program Management Task.

1.5.2 Cloud Services Requirements

All services shall be provided as consumption based and on-demand which provide real-time resources to support Ginnie Mae’s infrastructure and application platforms. The resources shall become available in real time at the launch of the instance or service and shall be billed in increments no larger than one hour.

Ginnie Mae Infrastructure and Application operations teams shall have direct access to services to launch and configure resources, as approved by Ginnie Mae.

Currently, AWS US GovCloud (East and West) are Ginnie Mae’s primary regions for hosting existing Agency systems in Ginnie Mae’s consolidated cloud. There is also potential in the future for additional CSPs to be included should one offer technology, capabilities or resources that Ginnie Mae deems critical in the delivery of its mission. The Contractor must have a GSA product list that includes all products currently available in the respective CSP offering. This product list must include all commercial, US GovCloud Regions products, as applicable, offered by the CSP. The Government also requests that any pricing discounts offered on CSP’s products be passed on to the Government by the Contractor.

The Contractor will be required to demonstrate that they possess a valid, current authorization to resell the respective CSP resources, that they have a certification(s) awarded by the CSP that demonstrates that the Contractor has experience in supporting and reselling the respective CSP resources equivalent in size and scope to Ginnie Mae’s requirement.

The Contractor shall implement an automated process for updating their GSA Product list each month with any new or deprecated products or capabilities within the respective CSP’s virtual and marketplace product offering. The services and products offered by each CSP must be made available on the Contractor’s GSA Federal Supply Schedule.

The Contractor shall ensure each CSP’s IaaS, PaaS and SaaS offerings, products, application(s), data availability, performance, and durability meet or exceed thresholds described by the CSP’s Service Level Agreement to meet the highest levels of performance possible using the CSP resources.

CSP GovCloud offerings must comply with FedRAMP Impact Level of “Moderate or High” guidelines and keep their PaaS and SaaS infrastructure fully patched/protected against known vulnerabilities.

Procurement of Direct Connection Services is included in this effort. Current Direct Connect providers are AT&T and Verizon.

To support Ginnie Mae objectives and architectures, the Contractor shall provide the CSP’s complete IaaS, SaaS and PaaS marketplace product offerings. All offerings must be FedRAMP Authorized and FedRAMP Impact Level of “Moderate” at a minimum.

1.5.3 Premium Support Requirements

The Contractor will be required to provide CSP Premium Support. This support should include 24x7 access to customer service, access to a console/dashboard-based reporting tool that provides recommendations for:

Savings and cost optimization.

Performance and health of infrastructure provisioned within the CSP’s offering.

Security and best practices for secure implementation of infrastructure within the CSP’s offering.

Fault Tolerance for services and resources implemented within the CSP’s offering.

The premium support service needs to provide enhanced technical support that allows the Government to interact directly with the CSP via phone, email, chat to support engineers and/or the assigned account manager contact on problems and issues that have been submitted or identified by the Government or the Governments Infrastructure and Applications Service Providers. There can be no limit on the number of active cases and the Government must be able to prioritize resolution of issues and/or problems being experienced. The severity level assigned to the ticket/issue will determine the response time. The following table should be used as a guideline for the response time in supporting the resolution of known problems/issues.

Case/Issue Severity Response Time General Inquiries Less than 24 hours System Impaired (Non-Production) Less than 12 Hours System Impaired (Production) Less than 4 Hours System Down (Production) Less than 1 Hour System Down (Mission Critical Production) Less than 15 Minutes

The support shall also provide consultative review and guidance on architectural implementations for CSP services and resources as they relate to application design and implementation.

The CSP support model should include the ability to provide programmatic case management using a support API.

Interoperability and configuration guidance and troubleshooting for third-party software and products.

The service should also provide proactive programs and self-service, training, account assistance and an assigned Technical Account Manager (TAM) to assist in coordination of required support.

The scope of this contract covers all Ginnie Mae Cloud Services and is organized in the following major tasks:

● 5.1 Task 1 – Transition-In

● 5.2 Task 2 - Program Management

● 5.3 Task 3 – Cloud Financial Management

● 5.4 Task 4 - Consumption of Cloud Services

● 5.5 Task 5 – Transition-Out

1.6 Non-Personal Services

The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual Contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services.

If the Contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the Contractor's responsibility to notify the Contracting Officer (CO) immediately. These services shall not be used to perform the work of a policy, decision making, or management nature, i.e. inherently Government functions. All decisions relative to programs supported by the Contactor shall be the sole responsibility of the Government.

1.7 Period of Performance

The period of performance shall be for one base period of 12 months and four 12-month option periods.

1.8 Place of Performance

The services to be performed under this contract shall be performed at the Contractors facility.

1.9 Hours of Operation

The Contractor is responsible for providing services between the hours of 7:00am - 6:00pm Monday thru Friday except for federal holidays or when the Government facility is closed due to local or national emergencies, administrative closing or similar Government directed facility closings. Weekly hours shall not exceed a forty (40) hour work week, and a typical workday will be 8 hours each day Monday through Friday. The Government reserves the right to change the hours of operation or restrict contractor access. Work outside of these daily hours is prohibited without Contracting Officer approval. Government agencies will not be available during scheduled holidays, inclement weather, weekends and after duty hours. The Contractor shall always maintain an adequate workforce for the uninterrupted performance of all tasks defined within the contract when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce is essential.

1.10 Special Qualifications

This PWS seeks only contractors holding the Multiple Award Schedule (MAS) IT Cloud Special Item Number (SIN) 518210C, however, the contractor may utilize other SINs to propose a complete solution.

1.11 Post Award/Kickoff Conference

The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The Government intends to convene a Post

Award Conference with the Contractor within ten business days after the contract award. The Contracting Officer will notify the Contractor of the specific date, location, and agenda within five business days after contract award. The purpose of the Kick-Off Meeting is to (1) aid both the Government and Contractor personnel in achieving a clear and mutual understanding of all requirements, and (2) identify and resolve potential risks.

The Kick-Off Meeting shall include the following topics at a minimum:

Introduction of contract personnel Program Review and any issues requiring clarification Additional information regarding kick off is documented under Section 5, Task 2, Program

Management.

1.12 Status Meetings

The Contracting Officer, Contracting Officer’s Representative (COR) and other Government personnel, as appropriate, may meet periodically with the Contractor to also review Contractor performance, requirement status, etc. At these meetings, the Contracting Officer will appraise the Contractor of how the Government views the Contractor's performance or progress of the requirement. The Contractor shall apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government. Post Award Conference and subsequent meetings may be held via teleconference.

1.13 Contractor Travel

No Contractor travel is anticipated during the performance period of the contract.

1.14 Transition In

The Contractor shall, upon the Contracting Officer's written notice, furnish Transition-In services as required. As a successor, the Contractor shall have sufficient personnel on board during the 180-day Transition-In period to ensure a smooth transition with the incumbent Contractor. The Contractor shall provide an orderly transition of work acceptance and accomplishment such that any impact on the program is minimized. During the Transition-In period, the Contractor shall become familiar with the requirements to commence full performance of services by the end of the contract Transition-In period. Transition-In is not required if the successor Contractor is the incumbent Contractor. Detailed requirements for Transition-In services is annotated in Section 5, Task 1 Transition In.

1.15 Transition Out

To minimize any decrease in productivity and to prevent possible negative impacts on additional services, the Contractor shall have sufficient personnel on board during the 180 days Transition- Out period. The incumbent Contractor shall ensure a smooth transition with the successor Contractor during the Transition-Out period, prior to completion of contractual performance. The incumbent Contractor shall aid the successor in the development of plans, procedures, and methods for the assumption of all on going work. The Contractor shall provide an orderly transition of work acceptance and accomplishment, such that full control by the successor Contractor is achieved by the end of the new contract Transition-In period. Detailed requirements for Transition-Out services are annotated in Section 5, Task 5 Transition Out.

2.0 Definitions and Acronyms

2.1 Definitions

Business/Work Days - Every official workday of the week which are days between and including Monday to Friday. This does not include public holidays and weekends.

Calendar Day - Any day of the week.

Contractor - A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Contracting Officer (CO) - A person with authority to enter into, administer, and/or terminate contracts and make related determinations and findings on behalf of the Government. Note: the only individual who can legally bind the Government.

Contracting Officer's Representative (COR) - An employee of the U.S. Government appointed by the Contracting Officer to perform contract administration activities regarding technical issues. This individual has authority to provide technical direction to the Contractor if direction is within the scope of the contract, does not constitute a change and has no funding implications. This individual does NOT have the authority to change the terms and conditions of the contract.

Defective Service - A service output that does not meet the standard of performance associated with the Performance Work Statement.

Deliverable Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

Government Furnished Property (GFP) - Government-furnished property means property in the possession of, or directly acquired by, the Government and subsequently furnished to the Contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification. Government-furnished property also includes Contractor-acquired property if the Contractor-acquired property is deliverable under a cost contract when accepted by the Government for continued use under the contract.

Performance Requirements Summary (PRS) - A listing of the performance requirements under the contract that are to be evaluated by the Government on a regular basis, performance indicators for these requirements, performance standards for these requirements and surveillance methods to be used to determine if performance standards are met.

Performance Standard - The Contractor's performance level required by the Government.

Performance Work Statement (PWS) - A statement of work for performance-based acquisitions that describe the required results in clear, specific and objective terms with measurable outcomes.

Physical Security - Actions that prevent the loss or damage of Government property.

Quality Assurance (QA) - Policies and procedures adopted by the Government to ensure that supplies and services acquired under Government contracts conform to the contract’s quality requirements.

Quality Assurance Surveillance Plan (QASP) - A plan describing how the agency will survey, observe, test, sample, evaluate and document the Contractor's performance in meeting critical performance standards identified in the contract.

Quality Control (QC) - All necessary measures taken by the Contractor to ensure that the quality of an end product of service shall meet contract requirements.

Service Contract - A contract that directly engages the time and effort of a Contractor whose primary purpose is to perform an identifiable task rather than to furnish an end item of supply.

Subcontractor - Any person, other than the prime Contractor, who offers to furnish or furnishes any supplies, material, equipment, or services of any kind under a prime contract or a subcontract entered into in connection with such prime contract, and any person who offers to furnish or furnishes general supplies to the prime Contractor or a higher tier subcontractor. The Government does not have privity of contract with a subcontractor.

Work Week - Monday through Friday, unless specified otherwise.

2.2 Acronyms

AQL - Acceptable Quality Level ARAMS - Automated Renewal and Amendment System BAA - Business Area Analysis Study C&A – Certification and Accreditation CBT - Computer-Based Training CCB - Change Control Board CCMB - Configuration Change Management Board CMMI - Capability Maturity Model Integration CND – Computer Network Defense CFO or OCFO - Office of the Chief Financial Officer of HUD CFR - Code of Federal Regulations CIO or OCIO - Office of the Chief Information Officer of HUD CISA – Cybersecurity and Infrastructure Security Agency CISO – Chief Information Security Officer CO - Contracting Officer CONOPS – Concept of Operations COR - Contracting Officer's Representative COR - Contracting Officer Representative COTS - Commercial Off-the-Shelf

CPO - Office of the Chief Procurement Officer of HUD CSAM – Cyber Security Assessment and Management Tool CSP – Cloud Service Provider CTA – Chief Technology Architect DHS – Department of Homeland Security DOS – Denial of Service EDR - Endpoint Detection and Response EST - Eastern Standard Time (U.S.)

ETC - Estimate to Completion FISMA – Federal Information Security Management Act GAO - U.S. General Accounting Office HUD - U.S. Department of Housing and Urban Development HUDAR - HUD Acquisition Regulation HUD/ISG - Internet Services Group within the Telecom Processing Division HUD Web - HUDs Intranet Web Site and related WEB pages.

IA – Information Assurance IAM – Information Assurance Manager IAVM – Information Assurance Vulnerability Management IDS – Intrusion Detection System IPS – Intrusion Prevention System IG or OIG - Inspector General (Office of) IT - Information Technology IAVA – Information Assurance and Vulnerability Assessment ISSO – Information System Security Officer IV&V - Independent Validation and Verification LOOCS - Line of Credit Control System NIST – National Institute of Standards and Technology OCPO - Office of the Chief Procurement Officer OEDTS – Office of Enterprise Data and Technology Solutions OIG - Office of Inspector General OMB - Office of Management and Budget OPORD – Operational Orders POAM – Plan of Action and Milestones PL Public Law PM - Project Manager POC - Point of Contact PPM - Project Planning and Management PPSM - Ports/Protocol/Services Management QA - Quality Assurance QASP - Quality Assurance Surveillance Plan QCP - Quality Control Plan SF - Standard Form SOP – Standard Operating Procedure TBD - To be determined TMD – Technology Management Director U.S.C - United States Code

3.0 Government-Furnished Property and Services

The Contractor shall ensure accurate control and accountability of all Government-Furnished Property in accordance with the terms and conditions of this contract. The Government will furnish, at no cost to the Contractor, the GFP shown below.

3.1 Government Services

No Government services will be provided.

3.2 Facilities

The Government will not provide facilities.

3.3 Equipment

The Government will provide HUD-issued laptops but all other IT equipment required will be furnished by the Contractor.

3.4 Materials

The Government will provide documentation or access to information via the Government provided document storage location(s). Copies of the required materials may be provided to the Contractor in hard copy or soft copy. All materials will remain the property of the Government and will be returned to the Government through the COR upon request or at the end of the contract period.

3.5 Quality Assurance (QA)

The Government shall evaluate the Contractor's performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable quality level.

4.0 Contractor-Furnished Items and Services

The Contractor shall furnish, all facilities, equipment, and supplies required to perform the work under this contract that are not listed under Government-Furnished Property and Services.

4.1 Facilities

The Contractor must furnish its own facilities.

4.2 Equipment

The Contractor must furnish its own equipment except for what is stated in section 3.3 of this PWS.

4.3 Material

The Contractor must furnish its own materials.

4.4 Contractor Responsibilities

The Contractor shall only conduct business with designated Government personnel listed as points of contact (POCs). Names of authorized personnel shall be provided to the Contractor by the Government, in writing, and updated as necessary throughout the contract period.

U.S. Government records, copies of original results and reports, verified original data, corrected data and corrected supporting final reports which are maintained by the Contractor remain the property of the U.S.

Government. These files/results must be surrendered to the COR.

4.5 Contractor Personnel

The Contractor shall provide a Contract/Program Manager who shall be responsible for the performance of work. An alternate shall also be designated to act in the absence of the Contract/Project Manager.

These Contractor personnel (main point of contact and alternate point of contact) are considered Key Personnel by the Government and shall be listed as such in accordance with HUDAR 2452.237-70, "Key Personnel. The Contract/Program Manager and alternate shall have full authority to act on all contact matters relating to the daily operations of this contract. Accordingly, at a minimum, the points of contact shall have the technical knowledge of the requirement and be in the position to actually receive assignment, guidance, and direction from the COR, PM and CO per HUDAR 2452.237-73, "Conduct of Work and Technical Guidance" and shall be allocated enough hours to ensure successful performance.

These points of contact shall each be an employee of the Contractor. An employee of a subcontractor is not acceptable for either of these positions. The Contract/Program Manager or alternate shall be available between the hours of 8:00am to 4:30pm Monday through Friday EST, except Federal Holidays or when the Government facility is closed for administrative reasons.

4.6 Identification of Contractor Employees

All Contractor/subcontractor personnel shall wear company picture identification badges to distinguish themselves from Government employees. When conversing with Government personnel during business meetings, over the telephone, or via electronic mail, Contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees. Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation. Where practicable, Contractor/subcontractors occupying collocated space with their Government program customer shall identify their workspace area with their name and company affiliation, or at a minimum, "Contractor" after name.

4.7 Quality Control

The Contractor shall establish and maintain a complete quality control program that shall ensure services are performed in accordance with this contract. The Contractor shall develop and implement procedures to identify, prevent, and ensure non reoccurrence of defective services. The Contractor's quality control program is how the Contractor assures themself that their work complies with the requirements of the contract. The Contractor shall provide the associated Quality Control Plan to the Government as directed.

The Contractor’s Quality Control program shall comply with the requirements of the contract.

4.7.1 Quality Control Plan

The Contractor shall develop, maintain, enforce, and document a Quality Control Plan (QCP). The QCP shall ensure the Government receives the level of quality that is consistent with the requirements specified in this contract. The QCP shall be sufficiently detailed to provide the Contractor's methodology for identifying and recruiting qualified personnel. The QCP shall also provide the Contractor's methodology for resolving problems identified by the Government during reviews conducted in accordance with its Quality Assurance Surveillance Plan (QASP). The QCP shall also provide the Contractor's methodology for establishing an internal feedback system for support personnel, and for resolving problems identified by that feedback system. The QCP shall demonstrate and validate that the services or deliverables to be provided under the contract are completed with a level of quality that meets the minimum performance threshold established in the Government's QASP. The QCP shall address Quality Management Approach, Quality Assurance, Quality Control and Quality Standards.

5.0 Specific Tasks

The Contractor shall perform the following specific requirements:

5.1 Task 1 – Transition-In

The Contractor must ensure that there will be minimal service disruption to vital Government business operations and no service degradation during and after transition. All transition activities will be completed within six (6) months (180 days) after the start date of the contract. Transition activities consist of the program management, coordination, and execution of all activities necessary to provide uninterrupted and continuing Cloud Services to include the following:

1. Participate in planning sessions with Ginnie Mae and incumbent partners and provide updates to its project management plan(s) to address any specific changes because of these discussions.

2. All activities are required to be transitioned in a manner considering a prudent balance between timeliness, cost efficiency and ensuring that all monthly core processes, schedules, application uptimes and performance measures are maintained as well as met.

3. The Contractor is encouraged to suggest innovative solutions, taking into consideration its organizational capabilities and experience while aligning these capabilities with Ginnie Mae’s requirements to execute a timely and cost-effective transition.

The contractor shall submit a draft Transition-In Plan five (5) business days after contract award. The plan shall include:

1. A description of all activities necessary to ensure continuity of operations and limits disruption to services and daily operations until operational responsibility is completely assumed.

2. A description of the technical approach, organizational resources and management controls to be employed to meet the cost, performance and schedule requirements to transition-in the services required by the Contract.

3. The technical approach, Planned transition activities, Transition activity timelines and milestones, Transition resource requirements, Transition security requirements, Transition risks and mitigation or avoidance strategies, Transition communication plan

4. A Work Breakout Structure (WBS) in Microsoft Project format addressing schedule and work products.

5. Contractors shall be responsible for providing an Account/Enrollment Transfer Plan. This includes:

o Describe the process for how the new Contractor shall transition the existing Ginnie Mae

Amazon AWS enrollments, accounts and marketplace product offerings for AWS from the incumbent Contractor.

o Describe the process for how the new Contractor shall ensure maximum system availability in the AWS environment in the Ginnie Mae Cloud during transition.

o Identify the process for how the new Contractor will capture historic data from the previous AWS accounts and/or enrollments and maintain cloud-based usage statistics/spend.

6. The Transition In Plan will include the Account/Enrollment Transfer Plan

Contractors shall be responsible for providing an Account/Enrollment Transfer Plan which includes:

Describe the process for how the new Contractor shall transition the existing Amazon AWS enrollments, accounts and marketplace product offerings for AWS from the incumbent Contractor.

Describe the process for how the new Contractor shall ensure maximum system availability in the

AWS environment through transition.

Identify the process for how the new Contractor will capture historic data from the previous AWS accounts and/or enrollments and maintain cloud based usage statistics.

Contractor process to ensure no disruption in operational services in AWS Ginnie Mae cloud environments.

The contractor shall submit a final Transition-In Plan within fifteen (15) business days of receiving GNMAs comments on the draft plan.

The contractor shall submit an inventory report 45 calendar days after contract award. The inventory report shall include:

Complete inventory of all Cloud Services Accounts to be transitioned

Complete inventory of all Cloud Service Providers and associated service accounts

Report any potential gaps so that any deficiencies can be addressed prior to completion of the transition period.

The contractor shall participate in weekly planning sessions with GNMA and the incumbent contractors and provide updates during the meeting to its transition plan(s) to address any specific changes because of these discussions. The incumbent contractor shall transition all required information.

The contractor shall coordinate with the incumbent contractor to complete the necessary forms or documentation, support requests etc. for the transference of Payer Accounts, Billing Accounts, Commercial and GovCloud Accounts, Administrative Accounts, Service Accounts, Root and all other associated credentials, services, direct connects and all associated cloud services needed to support the requirements and tasks. The contractor will work with the incumbent contractor to obtain consent from AWS to transfer and assign account ownership from the Incumbent to Ginnie Mae. The contractor will work with the incumbent contractor to transition AWS Professional Services/Enterprise Support to Ginnie Mae.

The contractor shall send an email to the COR within 5 business days after the completion of the transference of each of the services. The email shall include the transference account information, account POC, account number, provider information, period of performance, cost of service, confirmation from provider of the completed transference.

The contractor shall submit a Transition In Completion Report 10 Business Days after transition-in is complete via email to the COR. The report shall include the final status of all transitions in tasks and activities to include the completion date as annotated in the transition in plan and work breakdown structure.

Performance Standards Task 1

a. Standard: Submit a draft transition plan 5 business days after contract award

b. AQL: Five (5) business day deviation from standard

a. Standard: Submit a final transition plan 15 business days after receiving Government Comments

b. AQL: Five (5) business day deviation from standard

a. Standard: Submit an Inventory Report 45 calendar days after contract award

b. AQL: Five (5) business day deviation from standard

a. Standard: Send a Transference of Services email 5 business days after completion of the transference of service

b. AQL: Five (5) business day deviation from standard

a. Standard: Submit a Transition-In Completion 10 business days after completion of transition-in activities

b. AQL: Five (5) business day deviation from standard

Deliverables Task 1 A001 Draft Transition In Plan A002 Final Transition In Plan A003 Inventory Report A004 Transference of Services Emails A005 Transition In Completion Report

5.2 Task 2 – Program Management

The contractor shall provide program/project management support under this effort. This includes the management and oversight of all activities performed by contractor personnel, including subcontractors, to satisfy the requirements identified in this Performance Work Statement (PWS).

The Contractor shall identify a Program Manager (PM) by name that shall provide management, direction, administration, quality assurance, and leadership of the execution of this effort.

The Contractor shall provide all necessary personnel, material, equipment, administrative, financial, and managerial resources necessary for the support of this effort.

The Contractor shall facilitate Government and contractor communications; use the best industry standards and proven methodologies to track and document requirements and activities to allow for continuous monitoring and evaluation by the Government; and ensure all support and requirements performed are accomplished in accordance with the PWS/SOW. The Contractor shall notify the Contracting Officer Representative (COR) and Technical Point of Contract (TPOC) of any technical, financial, personnel, also general managerial problems encountered throughout the period of performance (PoP).

The Contractor shall recommend the overall communication management structure to provide collaborative, responsive interfacing with the Government and a mechanism to facilitate rapid problem resolution and approval of contractor recommendations by the required authority. The Contractor shall ensure that Information Technology Infrastructure Library (ITIL) methodologies are incorporated into the Program management structure and guide the overall execution of the requirements. The Contractor shall follow sound program management practices and comply with the HUD PPM process.

5.2.1 Program Management Plan

The Contractor shall develop and submit to the COR a draft Program Management Plan (PMP)10 business days after the contract Post Award/ Kick-off Conference. At a minimum, the plan shall include the following:

● Description of proposed management approach, timelines, and tools to be used in the execution of the contract services;

● Detailed Standard Operating Procedures (SOPs) for all tasks including milestones, tasks, and subtasks required;

● Describe the Contractors approach to risk management for the effort

● Quality Management for the Task Deliverables

● Overall Work Breakdown Structure (WBS); and

● The PMP must comply with the HUD PPM process and Ginnie Mae's IT governance program.

● A communications plan annotating:

o Key Stakeholders o Primary Client Contact o Contact Information o Contractor Team Personnel o Roles and Responsibilities o Contact Information o Management Structure o Escalation Path for issue Resolution o Communications Method o Communications Type o Meeting Schedule

● Risk Management Plan included in the Program Management Plan annotating:

o How Risks will be identified, managed and mitigated o Key Stakeholders and responsibilities o Monitoring and Review Processes

A final PMP shall be submitted to the COR within ten business days of receipt of COR comments.

The PMP is an evolutionary document that shall be updated annually at a minimum and as project/program changes occur.

The Contractor shall attend periodic (at a minimum monthly) status meetings with the Ginnie Mae and

Service Provider Program/Project Managers and other Ginnie Mae staff.

Development and submittal to the COR a Monthly Status Report (MSR) via email by the first business day of each month for the prior month. The MSR shall include the following:

● Activities during the report period, by task (include a brief description of each task, on-going activities, new activities, activities completed; and progress to date on all activities); each task shall have its own section

● Names of all contractor employees who are active, pending hire, have departed or have had a legal name change within the quarter. (The list will include Name, Position/Title, Start/Departure

Date)

● Problems and corrective actions taken to include any technical, financial, personnel, or problems with performance to include issues or concerns and proposed resolutions to address them.

● Personnel gains, losses, and status (security clearance, etc.)

● Government actions required.

● Schedule (show major tasks, milestones, and…