Credit Reporting SOW-DRAFT.docx

US Department of Agriculture (USDA)

Statement of Work Single Family Housing Direct Loan Division Credit Report Services DRAFT-Revised 4/20/2022

Contents

Project

Credit Reports for Home Loan Applications

General Information

1.0 Scope of Work

The Single-Family Housing Direct Loan Division (SFHDLD) is a program area under the United States Department of Agriculture-Rural Development (RD), Rural Housing Service (RHS) mission area. Under the Direct Loan program which is governed by 7 code of Federal Regulations (CFR) 3550, individuals or families in rural areas receive financial assistance directly from the RHS in the form of a home loan at an affordable interest rate.

The reports obtained from this contract will be used by SFHDLD to determine eligibility of applicants for RD programs.

2.0 Background

2.1 Applicants may obtain 100% financing to purchase an existing dwelling, purchase a site and construct a dwelling, repair a dwelling, or purchase newly constructed dwellings located in rural areas. Mortgage payments are based on the household's adjusted income; these loans are commonly referred to as Section 502 Direct Loans.

2.2 Applicants for Section 502 direct loans from RHS must have very low or low incomes. Since RHS is able to make loans to those who will not qualify for a conventional loan, the RHS Direct Loan program enables many more people to buy homes than might otherwise be possible. Applicants must be without adequate housing, but be able to afford the mortgage payments, including taxes and insurance. However, payment subsidy is available to applicants to enhance repayment ability.

2.3 Applicants who are very-low-income homeowners may receive assistance to repair, improve or modernize their homes. Elderly very-low-income applicants who are homeowners may also receive assistance to remove health and safety hazards. This type of SFH direct program assistance is referred to as Section 504 Housing Repair Loans and Grants.

2.4 SFH direct loan applicants must be unable to obtain credit elsewhere yet have reasonable credit histories. To aid in the determination of the applicant's ability to repay a loan, a credit report is ordered based on the stage of the loan process. Although the loan making decision is not solely based on the results of the credit report review, it is an integral part of the underwriting process. This Statement of Work (SOW) will clearly outline the necessary requirements, performance standards and expected results of the vendor who will provide credit services to RHS/SFHDLD.

2.5 Applications for the SFH direct program are initiated through UniFi Pro Mortgage, which is a commercial off-the-shelf (COTS) software developed by Fiserv Lending Solutions that has been customized to support the RD SFH direct program application process. As part of the application process, UniFi Pro Mortgage has been customized to handle credit bureau files generated through the credit report process that are returned to UniFi Pro Mortgage and parsed into the application system. In addition, the credit bureau files are copied and used for the underwriting through a Government-developed web service that uses FICO Blaze rules engine to automate validation of the business rules. Fiserv Lending Solutions discontinued its support of UniFi, which is now “owned” by the Rural Development Technology Office (RDTO). The system has a code freeze in place which prohibits any changes being made.

Contractor Requirements

3.0 Technical Requirements / Tasks

3.1 The credit bureau services required under this contract will assist RD in determining borrower eligibility for SFH Direct Programs under the authority of the RD.

3.2 The Contractor shall provide the following services:

3.2(a) Single repository consumer credit reports (a.k.a. "infiles") from an acceptable repository with a credit score, if one exists, or no score “null” when there is no score (at no additional cost).

3.2(b) Tri-merged credit reports (TMCRs) meeting the Federal Housing Administration (FHA)/Fannie Mae standards with Equifax Beacon® 5.0, Experian Fair Isaac Risk Model V2SM and TransUnion FICO® Risk Score Classic 04 credit scores. The TMCRs must include all credit and legal information reported for the applicant from the three repositories in-file credit reports not considered obsolete under the Fair Credit Reporting Act (FCRA) such as all credit, residence history, and public records information available; updated verifications on all trade lines with a balance (no more than 90 days old); and a court records check to include adverse items (bankruptcies, law suits, foreclosures, and tax liens, etc.) for the last seven years. The report must clear all financial institutions and local references listed on the application. The report must also provide the results of a check against the Office of Foreign Assets Control's database and identify invalid or illegally used social security numbers.

The acceptable repositories mentioned throughout this section are:

1. Equifax, Inc.;

2. Experian Information Solutions, Inc. and

3. TransUnion LLC.

3.2(c) For each debt listed, the report must minimally show the date the account was opened, the high credit amount, the required payment, the unpaid balance, the trended data, and the payment history. Each report must be in human readable, easily understandable format and raw credit bureau level data format. When available, information regarding satisfied debts (collections, charge-offs, etc.) will be reported to include the date satisfied.

3.2(d) In cases where the Contractor attempts to complete a credit report request but cannot due to the applicant's credit being frozen, the Contractor will return the request with a notation that the applicant's credit information is frozen at the named repository or repositories. The Contractor may charge the Agency the cost of a cancellation fee (50% of the report cost per the contract price for TMCRs) for each TMCR request resulting in the discovery of frozen credit.

3.2(e) Test Files and Test Environment: The Contractor shall develop and maintain for RD an on-hand supply (a minimum of 50) of new diverse credit test reports, e.g. various credit standings for utilization with testing of RD systems/applications. Due to the frequently unique and diverse credit circumstances of RD applicants, customized test reports are required.

3.2(f) The Contractor shall provide a toll-free number for use by the Government’s applicants in order that they may request a free copy of their credit report (when applicable) and/or to dispute the accuracy of the information within the credit report provide.

3.2(g) The Contractor shall notify the COR and the RD Help Desk Contact (see Section 4.3) when communications/requests are not received for periods of 30 minutes or more during normal business hours. RD will notify the Contractor when its loan making system is down and/or credit report requesting is disabled for 30 minutes or more during normal business hours.

3.2(h) The Contractor shall maintain completed credit files for 120 calendar days. If RD requires a duplicate of the original completed report within the retention time period, the Contractor will supply that same report at no additional cost unless the following information has changed:

3.2(i) The 120 calendar days begin on the date of credit origination and not on the date of completion of the credit report. On day 121, the Contractor shall archive the credit report in accordance with their data archiving procedure. If an additional request is made on an applicant with the identical file or personally identifiable information after the 120th day in the Contractor's database, the request will be completed as a new request.

3.2(j) The Contractor shall support a master username and password at the lender level.

3.2(k) The Contractor shall support the communication channel via HTTPS using MISMO as the data format.

3.2(l) The Contractor shall support the interface for synchronous communication models.

3.2(m) The Contractor shall support Credit Report Type Actions (Submit, Reissue).

3.2(n) The Contractor shall provide, in detail, business processes and standard operating procedures of how the requirements of this contract will be met to include how the vendor will communicate with UniFi Pro Mortgage; actual examples of infiles, TMCRs and test files; samples of credit report pdf, raw data files; and technical support timeframes/hours.

4.0 Government Furnished

The Government will not be providing the vendor any support, data, property or facilities for this contract. The Government will provide the connection to the FiServ Loan Origination System.

5.0 Deliverables / Schedule

5.1 Reports shall be delivered in accordance with Attachment (1) Performance Requirements Summary (PRS) and Quality Assurance Surveillance Plan (QASP).

5.2 In the event that there is a UniFi Pro Mortgage system failure and credit report files are lost, the Contractor will re-send to UniFi Pro Mortgage, at no charge, any reports not more than 30 days older than the original report request date.

5.3 Invoices shall be submitted to the COR monthly for payment of reports delivered the previous month. The invoice must be submitted to the COR no later than the 10th of each month.

6.0 Travel

There is no authorized travel anticipated for this contract.

7.0 Contractor’s Key Personnel

· There shall be no Contractor’s Key Personnel requirement for this contract Comment by Chase, Shannon - RD, National Office: Wouldn’t someone like Celeste be a ‘Key Personnel’ of the contractor? Comment by Repine, Tammy - RD, National Office: Yes – that’s why I included a daily operations contact. Celeste is currently that person. This statement of work is sent to the vendor and asks them to tell us who it will be, so I didn’t fill in who it is now. I believe we need to defer to the vendor to tell us that.

· 7.1 Contract Manager/Contact – the person who will be responsible for making any changes to the contract with the Contracting Officer.

· 7.2 Daily Operations Contact – the person who will be responsible to work with the COR on billing issues and general questions, help desk issues, etc.

8.0 Security Requirements

Interconnections to Facilities and/or Information Technology Systems Performance Standards

8.1 The Contractor shall meet all requirements mandated by the Government and NIST SP 800- 47, "Security Guide for Interconnecting Information Technology Systems" for planning, establishing, maintaining, and terminating of interconnection(s) that are provided or obtains direct interconnection from the contract service(s) facilities and/or systems, under the direct control, to an internal information technology systems or facilities in conjunction with the United States Department of Agriculture (USDA) Chief Information Officer (CIO) and the Rural Development (RD) Security Office. Per NIST 800-47, an interconnection is the direct connection of two or more IT systems for the purpose of sharing data and other information resources through a pipe, such as ISDN, T1, T3, DS3, VPN, etc.

8.2 Interconnection agreements shall be submitted as appendices to the System Security Plan.

8.3 The Contractor shall execute an Interconnection Security Agreement (ISA) with the Government, which specifies the technical and security requirements of the interconnection, and a Memorandum of Understanding/Agreement (MOU/A) to define the responsibilities of the participating contract service(s) or organization(s).

8.4 The Contractor shall conduct all software design, development, testing, and deployment using servers for storage, such that the Government can monitor all Contractor software artifacts and preserve them via system backup. All Contractor intermediate development products, (code, scripts, schemas, data bases and files, etc.) shall reside on server storage and are the Government's property.

8.5 The owners of System A and System B agree to designate and provide contact information for technical leads for their respective system, and to facilitate direct contacts between technical leads to support the management and operation of the interconnection.

8.6 To safeguard the confidentiality, integrity, and availability of the connected systems and the data they store, process, and transmit, the agencies agree to provide notice of specific events within the time frames indicated below:

8.6 (1) Security Incidents: Technical staff will immediately notify their designated counterparts by telephone or e-mail when a security incident(s) is detected, so the other agency may take steps to determine whether its system has been compromised and to take appropriate security precautions. The system owner will receive formal notification in writing within five (5) business days after detection of the incident(s).

8.6 (2) Disasters and Other Contingencies: Technical staff will immediately notify their designated counterparts by telephone or e-mail in the event of a disaster or other contingency that disrupts the normal operation of one or both of the connected systems.

8.6 (3) Material Changes to System Configuration: Planned technical changes to the system architecture that affect the Agency will be reported to technical staff at least 30 days before such changes are implemented. The initiating USDA agency agrees to conduct a risk assessment based on the system architecture changes.

8.6 (4) New Interconnections: The initiating party will notify the other party at least one month before it connects its IT system with any other IT system that impact the Agency, including systems that are owned and operated by third parties.

8.6 (5) Personnel Changes: All parties agree to provide notification of the separation or long-term absence of their respective system owner or technical lead. In addition, all parties will provide notification of any changes in point of contact information. All parties also will provide notification of changes to user profiles, including users who resign or change job responsibilities.

1.

8.7 Formal Security Policy and Standards. The Executive and Legislative branches, Federal departments and agencies issue the security policies, standards, and laws.

This interconnection must comply with the following Federal requirements:

8.7 (1) Federal Information Security Management Act (FISMA) as part of the E-Government Act of 2002

8.7 (2) Office of Management and Budget (0MB) Circular A-130, Appendix Ill, Security of Federal Automated Information Resources

8.7 (3)NIST Special Publication 800-47, Security Guide for Interconnecting Information Technology systems

8.7 (4) RD Cybersecurity - RD Application Security Baseline Requirements (attached)

8.8 Performance Standards

8.8 (1) The Contractor shall submit a Quality Assurance Surveillance Plan (QASP) that will identify and correct deficiencies in the quality of services before the level of performance becomes unacceptable. The government will review, recommend changes, and accept the plans prior to contract award. The Contractor's performance shall be governed by these standards.

8.8 (2) The Contractor will provide the services as outlined in this SOW and is able to: Interface with the Government's UniFi Pro Mortgage Loan Origination software via the Internet in order to receive orders and transmit completed reports.

8.8 (3) Provide the Government access to their production website via one master subscriber code and password.

1. Provide the Government a test environment to ensure compatibility with our software application systems. This test environment must have the ability to interface with RD development, testing, acceptance and certification regions during normal business hours. There may be a need to support special projects. This will be coordinated with the Contractor and COR.

2. Categorize all billings by State and then list each report separately by organizational code, authorized ordering official, applicant name, applicant's social security number, and price.

3. Transmit via a secure connection over the Internet using HTTPS protocol and Mortgage Industry Standards Maintenance Organization (MISMO) XML format, which includes raw data and Adobe pdf file of the credit report. Reference the RD Cybersecurity document attached.

9.0 Data Rights

If data is to be produced, furnished, acquired, or used in meeting contract requirements, delineate the respective rights and obligations of the government and the Contractor regarding the use, production, and disclosure of that data.

Insert Data Rights Here

10.0 Section 508 – Electronic and Information Technology Standards

All services and Electronic Information Technology (EIT) delivered as result of deliverables placed under this contract must comply with accessibility standards in accordance with Federal Information Technology Accessibility as required by Section 508 of the Rehabilitation Act (29 U.S.C. 794d), as amended.

Attachment If applicable, include an Attachment stating Evaluation Factors and significant Subfactors representing the key areas of importance and emphasis to be considered in the source selection decision.

ATTACHED DOCUMENTS INCORPORATED BY REFERENCE

The following attachments constitute part of this contract:

RD Cybersecurity Expectations of Security and Privacy for Contractor Jan 2022.

image1.png image2.png image20.png