Attachment A - Statement of Work.pdf

ATTACHMENT A

STATEMENT OF WORK (SOW)

1.0 BACKGROUND:

The Federal Housing Finance Agency (FHFA) was created by the Housing and Economic Recovery Act of 2008 (HERA) to regulate and supervise Fannie Mae, Freddie Mac, and the 11 Federal Home Loan Banks (jointly, the “regulated entities”).

HERA combined three organizations, the Office of Federal Housing Enterprise Oversight, the Federal Housing Finance Board, and a group from the Department of Housing and Urban Development, which collectively had previously regulated these regulated entities. These institutions play critical roles in supporting our nation’s housing finance system. Fannie Mae and Freddie Mac guarantee mortgage-backed securities (MBS) and hold mortgages and MBS’ for investment. The Federal Home Loan Banks lend money to banks and other financial institutions using mortgages as collateral and invest in mortgage-related assets. Following the bursting of the housing bubble, FHFA placed Fannie Mae and Freddie Mac in conservatorships, where they remain.

Among other responsibilities, the FHFA calculates independent estimates of the market value and market value sensitivity to interest rate and house price changes of the regulated entities’ mortgage-related assets (both whole loans and securitization exposures), consolidated obligations (debt), derivatives (swaps, swaptions, caps and floors), and advance positions. FHFA also calculates independent estimates of the income sensitivity of the regulated entities’ positions to interest rate and house price changes and conducts other types of scenario analysis. The calculation of the market value and income sensitivity of mortgage-related assets requires credit risk modeling because mortgage borrowers’ decisions to prepay or default are not independent.

FHFA also calculates independent estimates of mortgage credit losses in different scenarios including stress scenarios. FHFA requires a flexible, commercially available, off-the-shelf (COTS) software package for interest rate risk and credit risk modeling that at a minimum: (1) integrates into FHFA’s existing systems (the Windows operating system and Oracle and Sequel databases); (2) is fully integrated1 with mortgage security data and structured fixed-income cash flow models equivalent to Intex Solutions; (3) is fully integrated with a financial market data service equivalent to Bloomberg; and (4) is fully integrated with more than one (1) third-party single-family and multi-family prepayment and credit modeling software packages.

Additional information on FHFA and its mission can be found at:

http://www.fhfa.gov.

2.0 SCOPE:

The FHFA seeks to acquire a flexible COTS interest rate risk and credit risk modeling software package that can integrate into the FHFA’s existing systems (the Windows operating system and Oracle and Sequel databases). The FHFA inputs the indicative data for the regulated entities’ mortgage-related assets (both whole

1 Full integration means that the software has, jointly with the developers of the software listed above, built and tested the necessary linkages between the two frameworks.

http://www.fhfa.gov/ loans and securitization exposures), consolidated obligations (debt), derivatives and advance (loan) positions along with financial market data and stress scenarios to produce independent estimates of the market value and income sensitivity to interest rate changes and house price changes taking into account possible credit losses. FHFA also calculates independent estimates of mortgage credit losses in different scenarios including stress scenarios.

3.0 OBJECTIVES:

The objective is to acquire a COTS software package for modeling interest rate risk and credit risk that, at a minimum:

1) Integrates into FHFA’s existing systems (the Windows operating system and Oracle and Sequel databases);

2) Is fully integrated2 with mortgage security data and structured fixed-income cash flow models equivalent to Intex Solutions, Inc.;

3) Is fully integrated with a financial market data service equivalent to Bloomberg; and

4) Is fully integrated with more than one (1) third-party single-family and multi-family prepayment and credit modeling software packages.

The modeling staff at FHFA input the indicative data for the regulated entities’ mortgage-related assets (both whole loans and securitized or structured positions), debt positions, derivatives and advance (loan) positions, along with financial market data and stress scenarios to produce independent estimates of the market value and income sensitivity to changes in interest rates and house prices taking into account possible credit losses. Staff also calculates independent estimates of mortgage credit losses in different scenarios. The modeling staff use these model estimates to produce independent analysis for internal (non-public) supervisory use.

4.0 REQUIREMENTS:

1) Analytical Requirements

a. Analysis: the software needs to include tools for option-adjusted spread

(OAS) analysis, hedge analysis and key rate duration analysis. The OAS model framework needs to support the Secured Overnight Financing Rate (SOFR) and Overnight Indexed Swap (OIS) curves.

b. Scenario Analysis: the software needs to be able to calculate market value, income and cash flows in scenarios including, but not limited to, parallel and non-parallel shifts in yield curves, including user-defined and stochastic scenarios. The software also needs to be capable of

2 Full integration means that the software has, jointly with the developers of the software listed above, built and tested the necessary linkages between the two frameworks.

scenario analysis involving changes in spreads, option-adjusted spreads, house price indices, mortgage current coupon, prepayment, default and loss rates and volatility surfaces. The software also needs to be able to generate market-based, stochastic and user-defined yield curve scenarios, including Value-at-Risk.

c. User-Defined Assumptions: the software needs to be capable of incorporating static and dynamic user-defined mortgage prepayment, default and loss assumptions at the loan level and at the security level.

d. The Interest Rate (Yield Curve) Model capability needs to include:

i. At least three (3) interest rate term structure models for pricing mortgage-related instruments;

ii. Adjustment to the term structure model for mortgage analysis from lognormal to normal;

iii. Stochastic volatility implementation of the term structure model for mortgage pricing;

iv. At least three (3) interest rate term structure lattice models for the pricing of callable bonds and cancelable swaps which include a normal and lognormal model;

v. At least two (2) options models for the pricing of swaptions;

vi. Calibration of implied volatility to at-the-money, in-the-money and out-of-the-money swaptions, caps, and floors.

e. The software needs to model the following types of financial instruments: fixed-rate whole mortgage loans and pass-through mortgage securities; adjustable-rate mortgage (ARM) and Hybrid whole loan and mortgage securities (including Interest Only and Negative Amortization);

fixed and floating rate Agency and non-Agency structured transactions and collateralized mortgage obligations (CMOs) including Agency Credit Risk Transfers; Mortgage Servicing Rights; bonds with a fixed, floating or convertible rate; call or put options (one-time, discrete or continuous);

sinking fund provisions and amortization schedules; Treasury, Eurodollar and SOFR Futures; Interest rate swaps, asset swaps, and total return swaps;

Swaptions (American, European and Bermudan); Caps and Floors with various strikes; and options on futures, bonds and mortgages.

f. The software needs to include integrated income simulation capabilities, including path-dependent cash flow reporting.

2) Computational Requirements

a. Integration

i. The software needs to be fully integrated with mortgage security data and structured fixed-income cash flow models equivalent to Intex Solutions, Inc. FHFA prefers that the software is integrated with more than one (1) mortgage security data and structured fixed-income cash flow model to avoid key dependency.

ii. The software needs to be fully integrated with a financial market data service equivalent to Bloomberg.

iii. The software needs to be fully integrated with at least one (1) third-party single-family and multi-family prepayment and credit modeling software packages that can model the following:

Agency single-family and multi-family collateral; Agency-quality residential whole loans; Non-Agency securities with jumbo, prime, Alt-A and subprime collateral; and Agency and Non-Agency whole loans.

iv. FHFA prefers that the software can integrate with FHFA prepayment and loss models via an established, documented and tested Application Programming Interface (API).

Full integration means that the contractor has, jointly with the developers of the software listed above, built and tested the necessary linkages between the two frameworks.

b. Computation Efficiency

The software shall be able to model, at the instrument level (i.e. a mortgage loan, mortgage security (CMO) or Agency bond), large volumes of financial data efficiently. Current average model production requirements are quarterly computations of market value sensitivity to interest rates of 1000 Agency pass-through and CMO securities, 600 non-Agency (private label) CMO securities, 3000 whole loan mortgage pools, 3000 simple and complex GSE debt bonds and 4000 derivatives including but not limited to caps, swaps and swaptions. The capability to model the mortgage loans at the loan level, rather than in aggregated pools, is required. In particular, the software shall include distributed processing and batch processing capabilities and the capability to store input and output data in a database (Oracle and Sequel).

c. Graphical User Interface

The software needs to have a user-friendly interface similar to Microsoft Office™ applications user-friendly functions for importing and exporting data via Microsoft Excel™, Comma Separated Values (*.csv) and XML formats.

5.0 DELIVERABLES:

1) Software executable files, data files and license keys

The contractor must deliver software executable files and dynamic-linked libraries, associated data files and license keys five (5) business days after contract award. Delivery of license keys may follow the contractor’s usual frequency but must coincide with the contract award date and any option year award dates.

2) Software Installation and Implementation Services

a. The contractor must deliver support services for the initial implementation and installation of the software within FHFA’s existing network within 30 calendar days of the contract start date.

FHFA requires support services to produce reports within 60 calendar days of contract start date.

b. FHFA acquisition and installation of additional hardware support is outside the scope of this contract.

3) Software Maintenance and Support

a. The contractor shall deliver the most current version of the user manual and version release notes within five (5) business days of contract award. Electronic and searchable versions of the manual are required. The Contractor shall update the user manual and release notes regularly to reflect changes to the software. The Contractor shall also provide in-depth white papers on modeling techniques upon request.

b. The contractor shall update the software on a regular basis to keep pace with changes in industry standards and best practice modeling.

c. The contractor shall correct software deficiencies or malfunctions and the FHFA shall not be obligated to wait for new software version releases to correct malfunctions.

d. The contractor shall provide industry-standard support for FHFA users of the software. The contractor shall make experts available by phone, email and online meeting technology (as appropriate) to answer questions about the software. Such experts shall respond to questions within 24 hours.

e. The contractor shall provide liaison support between the contractor’s software and the integrated software and data providers listed in Section 4.2.a.

4) Training services

The Contractor shall provide training opportunities to the FHFA at least annually at the FHFA Washington, D.C. headquarters or at the Contractor’s office location. The training shall include: (1) introductory training for new users; (2) demonstration of the newest features of the software; and (3) topics identified by experienced users. The Contracting Officer’s Representative (COR) shall provide a final written training agenda to the Contractor at least one (1) week prior to the training date.

The Contractor’s firm fixed price shall include any contractor travel necessary to perform training services.

5) License Agreement Technical Requirements:

a. FHFA requires up to 10-20 concurrent user licenses of the software in the base year and option years;

b. Licensed users may include personnel from multiple divisions across the

FHFA;

c. FHFA requires software that can be installed primarily in a server environment at FHFA headquarters in Washington, D.C. and on a disaster recovery server. The server solution must support operations from Amazon Web Services (AWS) under an infrastructure as a Service (Iaas) model.

FHFA also requires additional installation of a license, for testing purposes, on a FHFA desktop or laptop;

d. FHFA requires user access to the server installation directly from the Washington, D.C. FHFA headquarters, as well as remotely by personnel who are telecommuting or traveling on official government business;

e. FHFA requires details on how new software level releases will be provided to the FHFA;

f. FHFA requires support for at least the second most recent general release of the software if FHFA elects to not accept the most recent version of the software;

g. Permits the FHFA to use the software to:

i. Produce position-level risk reports for internal (non-public) use that depict model estimates of market value and credit loss sensitivity to interest rates and house prices;

ii. Produce and publicly release summary aggregate risk reports that depict model estimates of market value and credit loss sensitivity to interest rates and house prices; and

h. Allows the FHFA to retain and use the reports and underlying output data created during the contract period of performance and after contract completion;

6) The contractor must ensure that written deliverables are in an electronic format (e-documents)—either in a Microsoft Office product format (Word/ PowerPoint/ Project/ Excel) or an Adobe Acrobat PDF format and are in compliance pursuant to Section 508 of the Rehabilitation Act of 1973, as amended (29 USC 794d), and its implementing standards and guidelines (36 CFR Part 1194).

7) FHFA will provide notification of acceptance or rejection of written deliverables within fourteen calendar days from receipt. If rejected, FHFA will provide details regarding the basis of rejection. In no way does FHFA waive its rights under any other inspection clause elsewhere within the contract.

6.0 GOVERNMENT-FURNISHED PROPERTY:

FHFA will not provide the Contractor with government-furnished property except when the Contractor staff visit FHFA headquarters to provide training services.

FHFA will provide the Contractor with conference room space equipped with video monitors and connection cables so that the Contractor can use their laptop to provide presentations and demonstrations of the software. FHFA will also provide the Contractor with guest Wi-Fi accounts during the training sessions.

7.0 PHYSICAL SECURITY:

Contractor staff are escorted to FHFA offices at DC headquarters, following the normal building security requirements, when delivering training services at FHFA offices.

8.0 INFORMATION TECHNOLOGY (IT) SECURITY

Requirements for solutions that are COTS:

a. The solution supports encryption of data at rest and data in transit using FIPS 140-2 approved algorithms;

b. The solution implements role-based access control to allow for a least privilege access model;

c. The solution audits user-activity and allows FHFA privileged users to view audit reports;

d. The solution supports single sign-on using FHFA’s system login credentials via Security Assertion Markup Language (SAML) 2.0 and function in a “Service Provider” or “Relying Party” type role where FHFA serves as the Identity Provider.

i. If the single sign-on is not supported, the solution shall require complex passwords that meet the following requirements:

1. 12 characters in length;

2. Requires both uppercase and lowercase letters;

3. Requires at least one number and one special character;

4. Cannot be identical to the last 24 passwords;

5. Are disabled every 60 days;

6. User accounts are locked after 5 failed logon attempts;

e. The solution supports the termination of user sessions after 15 minutes of inactivity or a time period to be defined by FHFA;

Additional requirements for COTS software supporting networked information technology:

a. The solution shall be capable of transmitting, receiving, processing, forwarding and storing digital information utilizing system packets that are formatted in accordance with commercial standards of Internet Protocol (IP) version 6 (IPv6) as set forth in the USGv6 Profile (NIST Special Publication 500-267) and corresponding declarations of conformance defined in the USGv6 Test program.

The solution shall also maintain interoperability with IPv4 systems and provide the same level of performance and reliability capabilities.

9.0 INFORMATION COMMUNICATION TECHNOLOGY (ICT) ACCESSIBILITY

(SECTION 508)

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities. As such, the following requirements apply to this requirement:

1) Products, platforms and services delivered as part of this work statement that are ICT, or contain ICT, must conform to the Revised 508 Standards, which are located at 36 C.F.R. § 1194.1 & Apps. A, C & D, and available at https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines

2) E102 / 702.10 – Web Content Accessibility Guidelines (WCAG) success criteria level A & AA are incorporated as a requirement. The referenced WCAG criteria is available at http://www.w3.org/TR/WCAG20/

3) E202 – No General Exceptions Authorized by FHFA

The following items are identified as containing ICT: COTS Software https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines http://www.w3.org/TR/WCAG20/

Applicable Functional Performance Criteria: All functional performance criteria apply when using an alternative design or technology that achieves substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4-6 of the Revised 508 Standards, or when Chapters 4-6 do not address one or more functions of ICT.

Applicable requirements for software and Web products:

• E207 – WCAG Level A & AA Success Criteria

• E302 – Functional Performance Criteria

• E502 – Interoperability with Assistive Technology

• E503 – Application

10.0 LICENSE AGREEMENT TERMS AND CONDITIONS

The following terms and conditions must be included in any related End User License Agreement (EULA), Terms of Use (ToU), or other comparable document for this work:

a. At the termination or expiration of the license agreement, FHFA shall have the right to maintain and use indefinitely print or electronic copies of its reports, presentations, or other content created in accordance with the license agreement.

b. Authorized Users may be from multiple divisions across FHFA and may concurrently access and use the software and related modeling data from their official duty stations or via remote access when such Users are conducting business for the benefit of FHFA. The number of Authorized Users is stipulated within the Schedule of the purchase order.

c. FHFA does not permit compliance audits; however, the license agreement may require that FHFA will provide written assurance of its compliance or other alternative agreed to in writing by the Contracting Officer.

d. The license agreement shall not include an indemnification of the contractor by the FHFA.

e. The license agreement shall be governed by, and construed in accordance with, the federal laws of the United States of America.

f. The Contractor shall represent and warrant that it makes commercially reasonable efforts to ensure that the software, data, or product as applicable is free of any viruses, worms, Trojan horses, malware, and/or other malicious code.

g. The license agreement shall not include terms that authorize assignment of the purchase order except in accordance with Federal Acquisition Regulation (FAR) Subpart 42.12.

h. Contractor shall acknowledge and agree that if there is a conflict between the terms and conditions of the license agreement and those of the purchase order, the purchase order governs.

i. The license agreement shall permit FHFA to use the software and its outputs for official Government purposes, including but not limited to reports, presentations, graphs, public releases, other publications, and examination of the regulated entities.

j. The license agreement may acknowledge that FHFA is a federal government agency and is exempt, by law, from the payment and collection of sales taxes.

11.0 TRAVEL

Travel may be required by the Contractor if FHFA requests on-site training. The COR shall provide written authorization for travel to the Contractor prior to any Contractor travel commencing. Any travel related to this contract will be in accordance with the Federal Travel Regulation (FTR) and is managed on an ad hoc, time-and-materials pricing basis.

12.0 PLACE OF PERFORMANCE:

The software license development, maintenance and client support services are performed from the contractor’s facility. Training opportunities may be at the FHFA Washington, D.C. headquarters, at the Contractor’s facility, or virtually through web-based meetings.

13.0 PERIOD OF PERFORMANCE:

The period of performance is 1 October 2025 through 30 September 2026 for the base year with a potential period of performance end date of 30 September 2030, if all options are exercised.