Draft Performance Work Statement.pdf

Performance Work Statement (PWS)

Operations and Maintenance (O&M) Support for HUD’s Enterprise Talent Management

System (ETMS)

05/02/2026

1. Table of Contents

VISION STATEMENT

1. GENERAL INFORMATION

1.1. Scope of Work

1.2. Background

1.2.1. Administrative Environment

1.2.2. Technical Environment

1.2.3. Consolidated Business Requirements

1.3. Constraints

1.3.1. OCHCO Program Office Constraints

1.3.2. Additional Constraints

1.3.3. Project Planning and Management

1.4. Non-Personal Services

1.5. Period of Performance

1.6. Place of Performance

1.7. Hours of Operation

1.8. Special Qualifications

1.9. Post Award/Kickoff Conference

1.10. Status Meetings

1.11. Contractor Travel

1.12. Transition-In

1.13. Transition-Out

2. DEFINITIONS AND ACRONYMS

2.1. Definitions

2.2. Acronyms

3. GOVERNMENT-FURNISHED PROPERTY AND SERVICES

3.1. Government Services

3.2. Facilities

3.3. Equipment

3.4. Materials and Information

3.5. Quality Assurance (QA)

4. CONTRACTOR-FURNISHED ITEMS AND SERVICES

4.1. Facilities

4.2. Equipment

4.3. Materials

4.4. Contractor Responsibilities

4.5. Contractor Personnel

4.6. Identification of Contractor Employees

5. SPECIFIC TASKS

5.1. Project Management

5.1.1. Project Management Plan

5.1.2. Project Schedule

5.1.3. Communication Management Plan (CMMP)

5.1.4. Risk Management Plan (RMP)

5.2. Enterprise Licensing Subscription and Support

5.2.1. Cloud Hosting and SaaS Requirements

5.3. Operations and Maintenance (O&M) Services

5.3.1. Integration Analysis and Interface Control Document (ICD)

5.3.2. Section 508 Compliance

5.3.3. Security and Privacy

5.4. Help Desk Support

5.4.1. Weekly Division Help Desk Status Report

5.5. ETMS Documentation

5.5.1. Standard Operating Procedures (SOP)

5.5.2. Divisional Job Aids

5.5.3. Recurring Reports

5.5.4. Ad-Hoc Reports

5.6. Training Support Services

5.7. DATA TRANSITION AND MIGRATION

5.7.1. Application Programming Interface (API)

5.7.2. Content Migration

5.7.3. Infrastructure and Security

5.8. Transition Services

5.8.1. Transition-In

5.8.2. Transition-Out

6. DELIVERABLES

6.1. Quality Control Plan

6.2. Acceptance Criteria

7. RELATED DOCUMENTS

8. PERFORMANCE REQUIREMENTS SUMMARY

Performance Work Statement (PWS) Operations and Maintenance Support for HUD’s Enterprise Talent Management

System (ETMS)

Vision Statement

Effectively implement and manage the U.S. Department of Housing and Urban Development’s (HUD) talent assessment and development and workforce analytics management system for strategically managing and continuously developing the skills and capabilities of the HUD workforce.

1. General Information

1.1. Scope of Work

The HUD Office of the Chief Information Officer (OCIO), in support of the Office of the Chief Human Capital Officer (OCHCO) and Office of the Inspector General (OIG) requires the Contractor to provide licenses, configuration, implementation, and ongoing operations and maintenance (O&M) support for HUD’s Enterprise Talent Management System (ETMS). The solution must support workforce planning, competency tracking, employee and leadership development, and data-driven decision-making.

Contractor services shall include:

• Project Management

• Enterprise Licensing Subscription and Support

• Operations and Maintenance (O&M) Services

• Help Desk Support

• ETMS Documentation

• Training Support Services

• Development, Modernization, and Enhancements (DME) (Optional Task)

• Transition Services (Optional Tasks)

Detailed descriptions of specific tasks are provided in PWS Section 5 – Specific Tasks.

1.2. Background

OCHCO is responsible for assessing, developing, implementing, and managing the policies and procedures associated with HUD’s administrative and human capital management including the development and training requirements while ensuring that the employees’ personally identifiable information (PII) is secured, protected, integrated, and accessible within the system. The Chief Human Capital Officer (CHCO) advises the Secretary and senior management regarding administrative management and human resource matters.

1.2.1. Administrative Environment

The Contractor shall provide services that deliver automated, configurable, positive customer/user experience (CX/UX), role-based access controlled (RBAC) capabilities to administer, manage, maintain, report, integrate, implement, synchronize the ETMS features and functions. Figure 1 ETMS Stakeholder Background contains the ETMS stakeholders’ descriptions and responsibilities.

FIGURE 1 ETMS Stakeholder Background

Division Full Name

Common Name (Acronym)

Description

OCHCO Talent Development & Workforce Planning (Learning Solutions)

Learning Solutions (LS)

The Learning Solutions Division (LSD) includes administering, documenting, tracking, reporting of training and survey completions, training solutions, platforms, and training support. LSD delivers a variety of training programs including and learning and development programs via self-paced and instructor led courses. LSD maintains auditable systems of record for the agency to ensure compliance for tracking, records management, and knowledge management functions. LSD provides training-evaluation support and analysis of trainings conducted.

OCHCO Talent Development & Workforce Planning (Strategic Workforce Planning & Analytics)

Workforce Analytics

(WA)

The Strategic Workforce Planning & Analytics Division (SWPA) is responsible for department-wide planning efforts. SWPA provides competency models, competency gap analysis, individual development plans, and career path planning to assist employees realize future career goals and aspirations. SWPA supports creating, managing, maintaining, and sharing various types of documents and artifacts related to a specific business function or general to the agency.

OCHCO Talent Development & Workforce Planning (Talent Assessment & Data Analytics)

Talent Assessment (TA)

The Talent Assessment and Data Analytics (TADA) is responsible for selection systems development, maintenance, and implementation to include the design, development, and validation of tests and other assessment instruments. TADA ensures all assessments are developed and implemented according to legal and professional standards, defends assessments against legal challenges, and advises management on the appropriateness of assessment scenarios. In addition, TADA manages the visualization and analysis of workforce data to support hiring decisions and align Human Capital strategies with Agency goals and priorities.

Division Full Name

Common Name (Acronym)

Description

OIG Human Capital Management Division Talent Development & Workforce Analytics Branch

Talent Development & Workforce Analytics

(TDWA)

The Talent Development & Workforce Analytics team (TDWA) is responsible for department-wide learning and development planning and implementation efforts. TDWA overseas the administration, documentation, tracking and reporting of training programs, survey completions, training solutions, and platform support. TDWA delivers a variety of training programs including and learning and development programs via self-paced and instructor led courses. TDWA maintains auditable systems of record for the agency to ensure tracking, records management, and knowledge management compliance. TDWA provides evaluation support and analysis of completed training programs. Provides competency models, competency gap analysis, individual development plans, and career path planning to assist employees realize future career goals and aspirations. TDWA supports creating, managing, maintaining, and sharing various types of documents and artifacts related to a specific business function or general to the agency. TDWA manages systems development, maintenance, and implementation to include the design, development, and validation of tests and other assessment instruments. Ensures all assessments are developed and implemented in alignment with industry standards and remain defensible against challenges and advises management on the appropriateness of scenario-based assessments. In addition, the TDWA manages the visualization and analysis of workforce data to inform hiring decisions and align Human Capital strategies with Agency goals and priorities.

1.2.2. Technical Environment

The current OCHCO managed ETMS (also known as InCompass) and OIG’s managed Learning Management System (LMS) are independent, integrated talent management systems that are respectively serviced by Cornerstone on Demand (CSOD) and SAP SuccessFactors solutions. Both solutions support automated cross-program collaboration for Human Resource (HR) programs.

HUD maintains these talent management solutions through Software-as-a-Service (SaaS) licensing subscriptions, providing access to approximately 7,000 HUD workforce users.

The consolidated and refreshed Enterprise Talent Management System (ETMS) will be a unified, standards-based platform designed to modernize HUD’s talent lifecycle by centralizing workforce data, learning, and succession planning. ETMS will enable data-driven talent decisions, streamline cross-system workflows, and strengthen compliance and equity reporting across the Department.

1.2.2.1. Key objectives

• Workforce visibility and compliance: Integrate demographic and MD-715 reporting, maintain auditable records, and surface trends in performance and awards.

• Enable Seamless System Integration: Provide robust APIs and integrations with HUD’s financial, learning, and HR systems to streamline workflows and data exchange.

• Competency-driven development: Centralize competency frameworks, enable self-assessment and supervisor assessments, and link training to career paths and position requirements.

• Empower Employees & Supervisors: Offer intuitive interfaces for self-assessment, development planning, and competency tracking, with tools for supervisors to guide and evaluate growth.

• Support Strategic Workforce Planning: Deliver advanced capabilities for succession planning, position alignment, and competency gap analysis to ensure organizational readiness.

• Ensure Data Integrity & Accessibility: Implement secure data storage, archiving, and quality controls to maintain historical records and support auditability.

• Modern learning delivery: Support mobile, SCORM/OLSA-compatible content, blended modalities, and searchable competency-tagged catalogs.

1.2.2.2. Strategic benefits

• Improved agility through faster identification of talent and internal mobility opportunities.

• Reduced administrative burden by automating approvals, reporting, and learning assignments.

• Stronger equity and compliance via integrated demographic reporting and historical archives for trend analysis.

• Better decision quality from consolidated, timely analytics and scenario forecasting.

• Deliver Flexible Learning Solutions: Support mobile, blended, and standards-compliant training delivery with competency-linked content and catalog integration.

• Drive Insightful Reporting & Analytics: Provide AI-powered dashboards, forecasting tools, and customizable reports to inform decision-making and track progress across time and business units.

1.2.2.3. Implementation priorities

• Establish core integrations (financial systems, LMS, HR data) and a secure API layer.

• Deploy competency framework and assessment workflows to enable immediate development planning.

• Implement archival, audit trail, and data quality controls to meet compliance and historical reporting needs.

• Roll out dashboards and prebuilt reports for supervisors and HR leaders to accelerate adoption.

1.2.2.4. Strategic Impact

By implementing ETMS, HUD will gain a powerful, data-driven platform that not only supports individual employee growth but also strengthens organizational agility and resilience. The system will enable proactive talent management, reduce administrative burden, and provide the insights needed to shape a future-ready federal workforce.

1.2.3. Consolidated Business Requirements

1.2.3.1. Compliance & Demographic Data

The system shall support compliance reporting and workforce equity analysis by enabling:

• Integration of MD-715 Tables A and B to track participation in Career Development Programs by demographic categories.

• Management of professional development competencies.

• Reporting on performance appraisals, awards, and workforce trends.

1.2.3.2. System Integration & APIs

The system shall ensure seamless interoperability with internal and external platforms through:

• Enterprise-wide API support for data exchange across HUD systems and external partners.

• Integration of eSF-182 budget approvals with HUD financial systems.

• Real-time performance monitoring via integration with HUD’s LMS, including IDP creation.

• Capture and synchronization of personnel transactions (e.g., details, internships, fellowships).

1.2.3.3. User Interaction & Interfaces

The system shall provide a configurable, user-friendly interface that supports:

• UI customization and white labeling.

• Employee search by competencies and self-assessment of proficiency levels.

• Sharing and publishing assessments.

• Manager tools to assign competency-aligned work and suggest SMART goals.

• Prompt Supervisors for quarterly assessments and organizational competency planning.

• Learning and development planning prompts for employees and supervisors.

• Identification of internal roles for developmental opportunities.

• Push notifications and employee-controlled messaging cadence.

• Resource scheduling (e.g., rooms, collaboration tools).

• Document uploads to user profiles.

• External course enrollment requests.

• Onboarding prompts for new employees and supervisors.

1.2.3.4. Position, Workforce & Succession Planning

The system shall support strategic workforce development through:

• Workforce and succession planning workflows.

• Identification of high-potential employees for new roles.

• Synchronization of employee profiles with position descriptions and attributes.

• Career path modeling and development reporting.

• Linking position data to vacancies and recruitment.

• Task creation and alignment with position descriptions.

• Competency gap analysis at individual, role, and organizational levels.

• RBAC-based action planning and competency modeling.

• Recommendations for training and recruitment to close skill gaps.

• Downloadable, filterable reports (Excel, Word, PowerPoint, PDF) with detailed workforce and competency data.

1.2.3.5. Data Storage, Archiving & Quality

The system shall ensure secure, auditable, and high-quality data management by:

• Supporting data archiving for historical analysis and workforce studies.

• Enabling survey-based data collection and export.

• Providing data quality tools to ensure consistency across outputs.

• Maintaining audit trails and compliance with data retention policies.

• Storing historical profiles for employees, positions, and organizations.

• Supporting records for non-HUD employees.

• Hosting centralized knowledge and data repository.

• Managing competency frameworks, proficiency levels (up to five per competency), certifications, and organizational attributes.

• Storing and aligning vacancy assessments and employee-position affiliations.

• Enabling competency-based search for training activities via icons and keywords.

1.2.3.6. Training Delivery & Content

The system shall deliver flexible, standards-compliant learning experiences through:

• Mobile-compatible eLearning and video delivery.

• Support for live, on-demand, synchronous, asynchronous, and blended learning.

• Compatibility with SCORM and OLSA standards.

• Hosting of scalable, easily updatable content.

• Integration of multiple training catalogs.

• Competency-tagged training content for search and alignment with employee roles.

1.2.3.7. Reporting, Analytics & Dashboards

The system shall provide robust analytics and reporting capabilities, including:

• Tracking training and deliverables.

• Auto-assignment of learning plans based on user attributes.

• AI-driven insights for learning, planning, and career pathing.

• Cascading dashboards with drill-down capabilities.

• Competency and proficiency gap reports at all organizational levels.

• Forecasting tools for attrition and workforce planning.

• Survey analytics and timely decision support.

• Prebuilt and custom reports with time stamps and export options (Excel, Word, PowerPoint, PDF).

• Multi-year, cross-unit, and historical reporting.

• Supervisor tools for quarterly assessments and team development planning.

• Visual summaries of competency gaps and training recommendations.

• Support for QA/QC, unique identifiers, and system availability metrics

1.3. Constraints

The services identified in this PWS will adhere to the rules, regulations, laws, standards, and conventions identified by HUD as well as within the Federal Government. Constraints include the following:

Document Number

Title Released Mandatory / Advisory

44 USC §3541 et seq.

Federal Information Security Management Act (FISMA, supersedes the Computer Security Act of 1987) https://www.govinfo.gov/content/pkg/USCODE- 2008-title44/pdf/USCODE-2008-title44-chap35-subchapIII.pdf

2002 M

44 USC §3601 et seq.

E-Government Act of 2002 https://www.govinfo.gov/content/pkg/PLAW- 107publ347/pdf/PLAW-107publ347.pdf

2002 M

Pub. L. 97-255, 31

USC §3512

Federal Managers’ Financial Integrity Act (FMFIA) https://obamawhitehouse.archives.gov/omb/fina ncial_fmfia1982

1982 M

Pub. L. 103-62, 31

USC 1101

Government Performance and Results Act (GPRA) https://www.cio.gov/handbook/it-laws/gpra/

1993 M

Pub. L. 103-356, 31 USC 3301

Federal Financial Management Act of 1994 https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memo randa/2009/m09-06.pdf

1994 M https://www.gpo.gov/fdsys/search/pagedetails.action?collectionCode=USCODE&browsePath=Title+44%2FChapter+35%2FSubchapter+III%2FSec.+3541&granuleId=USCODE-2003-title44-chap35-subchapIII-sec3541&packageId=USCODE-2003-title44&collapse=true&fromBrowse=true https://www.gpo.gov/fdsys/search/pagedetails.action?collectionCode=USCODE&browsePath=Title+44%2FChapter+35%2FSubchapter+III%2FSec.+3541&granuleId=USCODE-2003-title44-chap35-subchapIII-sec3541&packageId=USCODE-2003-title44&collapse=true&fromBrowse=true https://www.gpo.gov/fdsys/search/pagedetails.action?collectionCode=USCODE&browsePath=Title+44%2FChapter+35%2FSubchapter+III%2FSec.+3541&granuleId=USCODE-2003-title44-chap35-subchapIII-sec3541&packageId=USCODE-2003-title44&collapse=true&fromBrowse=true https://www.govinfo.gov/content/pkg/USCODE-2008-title44/pdf/USCODE-2008-title44-chap35-subchapIII.pdf https://www.govinfo.gov/content/pkg/USCODE-2008-title44/pdf/USCODE-2008-title44-chap35-subchapIII.pdf https://www.govinfo.gov/content/pkg/USCODE-2008-title44/pdf/USCODE-2008-title44-chap35-subchapIII.pdf https://www.gpo.gov/fdsys/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf https://www.govinfo.gov/content/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf https://www.govinfo.gov/content/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf https://obamawhitehouse.archives.gov/omb/financial_fmfia1982 https://obamawhitehouse.archives.gov/omb/financial_fmfia1982 https://www.cio.gov/handbook/it-laws/gpra/ https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2009/m09-06.pdf https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2009/m09-06.pdf https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2009/m09-06.pdf

Document Number

Title Released Mandatory / Advisory

Pub. L. 104-208, 31 USC 3512

Federal Financial Management Improvement Act of 1996 https://www.whitehouse.gov/wp-content/uploads/2023/01/M_23-06-Appendix- D_final.pdf

1996 M

Pub. L. 104-106, 40 USC §1401 et seq.

Information Technology Management Reform Act of 1996 (Clinger-Cohen Act) https://www.cio.gov/handbook/it-laws/clinger-cohen-act/

1996 M

31 USC § 9101 et seq.

Government Corporation Control Act https://www.govinfo.gov/content/pkg/USCODE- 2011-title31/pdf/USCODE-2011-title31-subtitleVI-chap91-sec9101.pdf

1948 M

Pub. L. 101-235, 12 USC 1709(f-16)

HUD Reform Act, amending the National Housing Act https://www.govinfo.gov/content/pkg/CFR-2017-title24-vol1/xml/CFR-2017-title24-vol1-part4.xml

1989 M

Pub. L. 105-277, 44 USC §3504

Government Paperwork Elimination Act https://www.cio.gov/handbook/it-laws/gpea/#:~:text=The%20Government%20Pape rwork%20Elimination%20Act,range%20of%20ele ctronic%20signature%20alternatives.

1998 M

Pub. L. 105-220, 29 USC 701 et seq.

Section 508 of the Rehabilitation Act of 1998 https://www.section508.gov/manage/laws-and-policies/

1998 M

Pub. L. 97-365, 31 USC §3301et seq

Debt Collection Act of 1982 https://www.govinfo.gov/content/pkg/STATUTE- 96/pdf/STATUTE-96-Pg1749.pdf

1982 M

Pub. L. 104-134, 31 USC §3701 et seq.

Debt Collection Improvement Act of 1996 https://www.govinfo.gov/app/details/CFR-2011-title31-vol2/CFR-2011-title31-vol2-part285

1996 M https://www.whitehouse.gov/wp-content/uploads/2023/01/M_23-06-Appendix-D_final.pdf https://www.whitehouse.gov/wp-content/uploads/2023/01/M_23-06-Appendix-D_final.pdf https://www.whitehouse.gov/wp-content/uploads/2023/01/M_23-06-Appendix-D_final.pdf https://www.cio.gov/handbook/it-laws/clinger-cohen-act/ https://www.cio.gov/handbook/it-laws/clinger-cohen-act/ https://www.gpo.gov/fdsys/pkg/USCODE-2011-title31/pdf/USCODE-2011-title31-subtitleVI-chap91-sec9101.pdf https://www.govinfo.gov/content/pkg/USCODE-2011-title31/pdf/USCODE-2011-title31-subtitleVI-chap91-sec9101.pdf https://www.govinfo.gov/content/pkg/USCODE-2011-title31/pdf/USCODE-2011-title31-subtitleVI-chap91-sec9101.pdf https://www.govinfo.gov/content/pkg/USCODE-2011-title31/pdf/USCODE-2011-title31-subtitleVI-chap91-sec9101.pdf https://www.gpo.gov/fdsys/pkg/CFR-2017-title24-vol1/xml/CFR-2017-title24-vol1-part4.xml https://www.gpo.gov/fdsys/pkg/CFR-2017-title24-vol1/xml/CFR-2017-title24-vol1-part4.xml https://www.govinfo.gov/content/pkg/CFR-2017-title24-vol1/xml/CFR-2017-title24-vol1-part4.xml https://www.govinfo.gov/content/pkg/CFR-2017-title24-vol1/xml/CFR-2017-title24-vol1-part4.xml https://www.cio.gov/handbook/it-laws/gpea/#:~:text=The%20Government%20Paperwork%20Elimination%20Act,range%20of%20electronic%20signature%20alternatives.

https://www.cio.gov/handbook/it-laws/gpea/#:~:text=The%20Government%20Paperwork%20Elimination%20Act,range%20of%20electronic%20signature%20alternatives.

https://www.cio.gov/handbook/it-laws/gpea/#:~:text=The%20Government%20Paperwork%20Elimination%20Act,range%20of%20electronic%20signature%20alternatives.

https://www.cio.gov/handbook/it-laws/gpea/#:~:text=The%20Government%20Paperwork%20Elimination%20Act,range%20of%20electronic%20signature%20alternatives.

https://www.cio.gov/handbook/it-laws/gpea/#:~:text=The%20Government%20Paperwork%20Elimination%20Act,range%20of%20electronic%20signature%20alternatives.

https://www.section508.gov/manage/laws-and-policies https://www.section508.gov/manage/laws-and-policies/ https://www.section508.gov/manage/laws-and-policies/ https://www.gpo.gov/fdsys/pkg/STATUTE-96/pdf/STATUTE-96-Pg1749.pdf https://www.govinfo.gov/content/pkg/STATUTE-96/pdf/STATUTE-96-Pg1749.pdf https://www.govinfo.gov/content/pkg/STATUTE-96/pdf/STATUTE-96-Pg1749.pdf https://www.gpo.gov/fdsys/granule/CFR-2011-title31-vol2/CFR-2011-title31-vol2-part285/content-detail.html https://www.govinfo.gov/app/details/CFR-2011-title31-vol2/CFR-2011-title31-vol2-part285 https://www.govinfo.gov/app/details/CFR-2011-title31-vol2/CFR-2011-title31-vol2-part285

Title Released Mandatory / Advisory

Pub. L. 97-177, 31 USC §3901 et seq.

Prompt Payment Act https://www.govinfo.gov/app/details/USCODE- 2011-title31/USCODE-2011-title31-subtitleIII-chap39-sec3901

1982 M

Pub. L. 107-300, 31 USC §3321

Improper Payments Information Act of 2002 https://www.govinfo.gov/content/pkg/USCODE- 2012-title31/pdf/USCODE-2012-title31-subtitleIII-chap33-subchapII-sec3321.pdf

2002 M

OMB Circular A-11 Preparation, Submission and Execution of the Budget https://www.whitehouse.gov/wp-content/uploads/2018/06/a11.pdf

Latest version

M

OMB Circular A-

Management of Reporting and Data Integrity Risk https://www.whitehouse.gov/wp-content/uploads/2018/06/M-18-16.pdf

Latest version

M

OMB Circular A-

Policies and Standards for Financial Management Systems https://www.whitehouse.gov/wp-content/uploads/2017/11/Interim-Final-Revision-of-OMB-Circular-A-125-July11999.pdf

Latest version

M

OMB Circular A-

"Security of Federal Automated Information Resources" (Appendix III) https://obamawhitehouse.archives.gov/omb/circ ulars_a130_a130appendix_iii

M

OMB Circular A-

Management of Federal Information Resources https://obamawhitehouse.archives.gov/omb/circ ulars_a130_a130appendix_iii

M https://www.gpo.gov/fdsys/granule/USCODE-2011-title31/USCODE-2011-title31-subtitleIII-chap39-sec3901 https://www.govinfo.gov/app/details/USCODE-2011-title31/USCODE-2011-title31-subtitleIII-chap39-sec3901 https://www.govinfo.gov/app/details/USCODE-2011-title31/USCODE-2011-title31-subtitleIII-chap39-sec3901 https://www.govinfo.gov/app/details/USCODE-2011-title31/USCODE-2011-title31-subtitleIII-chap39-sec3901 https://www.gpo.gov/fdsys/pkg/USCODE-2012-title31/pdf/USCODE-2012-title31-subtitleIII-chap33-subchapII-sec3321.pdf https://www.govinfo.gov/content/pkg/USCODE-2012-title31/pdf/USCODE-2012-title31-subtitleIII-chap33-subchapII-sec3321.pdf https://www.govinfo.gov/content/pkg/USCODE-2012-title31/pdf/USCODE-2012-title31-subtitleIII-chap33-subchapII-sec3321.pdf https://www.govinfo.gov/content/pkg/USCODE-2012-title31/pdf/USCODE-2012-title31-subtitleIII-chap33-subchapII-sec3321.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/a11.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/a11.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/a11.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/a11.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/M-18-16.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/M-18-16.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/M-18-16.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/M-18-16.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/M-18-16.pdf https://www.whitehouse.gov/wp-content/uploads/2017/11/Interim-Final-Revision-of-OMB-Circular-A-125-July11999.pdf https://www.whitehouse.gov/wp-content/uploads/2017/11/Interim-Final-Revision-of-OMB-Circular-A-125-July11999.pdf https://www.whitehouse.gov/wp-content/uploads/2017/11/Interim-Final-Revision-of-OMB-Circular-A-125-July11999.pdf https://obamawhitehouse.archives.gov/omb/circulars_a130_a130appendix_iii https://obamawhitehouse.archives.gov/omb/circulars_a130_a130appendix_iii https://obamawhitehouse.archives.gov/omb/circulars_a130_a130appendix_iii https://obamawhitehouse.archives.gov/omb/circulars_a130_a130appendix_iii https://obamawhitehouse.archives.gov/omb/circulars_a130_a130appendix_iii https://obamawhitehouse.archives.gov/omb/circulars_a130_a130appendix_iii https://obamawhitehouse.archives.gov/omb/circulars_a130_a130appendix_iii

Title Released Mandatory / Advisory

OMB Circular A-

"Security of Federal Automated Information Resources" (Appendix III) (see also 34 FR 6428) https://obamawhitehouse.archives.gov/omb/circ ulars_a130_a130appendix_iii

Latest version

M

OMB

Memorandum 99-

"Security of Federal Automated Information Resources" https://www.whitehouse.gov/wp-content/uploads/2017/11/1999-M-99-20- Security-of-Federal-Automated-Information- Resources.pdf

1999 M

OMB

Memorandum 06-

“Safeguarding Personally identifiable Information” https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memo randa/2006/m-06-15.pdf

2006 M

OMB

Memorandum 06-

“Protection of Sensitive Agency Information” https://www.commerce.gov/sites/default/files/o pog/omb_m-06-16.pdf

2006 M

OMB

Memorandum 06-

“Reporting Incidents Involving PII” https://www.govinfo.gov/content/pkg/GAOREPO RTS-GAO-08-343/html/GAOREPORTS-GAO-08- 343.htm

2006 M

OMB

Memorandum 06-

“Reporting Instructions for the Federal Information Security Act and Agency Privacy Management” https://obamawhitehouse.archives.gov/sites/def ault/files/omb/assets/omb/memoranda/fy2006/ m06-20.pdf

2006 M

PDD-63 “Critical Infrastructure Protection,” Presidential Decision Directive-63 ttps://www.govinfo.gov/content/pkg/FR-1998-08- 05/pdf/98-20865.pdf

1998 M https://obamawhitehouse.archives.gov/omb/circulars_a130_a130appendix_iii https://obamawhitehouse.archives.gov/omb/circulars_a130_a130appendix_iii https://obamawhitehouse.archives.gov/omb/circulars_a130_a130appendix_iii https://obamawhitehouse.archives.gov/omb/circulars_a130_a130appendix_iii https://www.whitehouse.gov/wp-content/uploads/2017/11/1999-M-99-20-Security-of-Federal-Automated-Information-Resources.pdf https://www.whitehouse.gov/wp-content/uploads/2017/11/1999-M-99-20-Security-of-Federal-Automated-Information-Resources.pdf https://www.whitehouse.gov/wp-content/uploads/2017/11/1999-M-99-20-Security-of-Federal-Automated-Information-Resources.pdf https://www.whitehouse.gov/wp-content/uploads/2017/11/1999-M-99-20-Security-of-Federal-Automated-Information-Resources.pdf https://www.whitehouse.gov/wp-content/uploads/2017/11/1999-M-99-20-Security-of-Federal-Automated-Information-Resources.pdf https://www.whitehouse.gov/wp-content/uploads/2017/11/1999-M-99-20-Security-of-Federal-Automated-Information-Resources.pdf https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2006/m-06-15.pdf https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2006/m-06-15.pdf https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2006/m-06-15.pdf https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2006/m-06-15.pdf https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2006/m-06-15.pdf https://www.commerce.gov/sites/default/files/opog/omb_m-06-16.pdf https://www.commerce.gov/sites/default/files/opog/omb_m-06-16.pdf https://www.govinfo.gov/content/pkg/GAOREPORTS-GAO-08-343/html/GAOREPORTS-GAO-08-343.htm https://www.govinfo.gov/content/pkg/GAOREPORTS-GAO-08-343/html/GAOREPORTS-GAO-08-343.htm https://www.govinfo.gov/content/pkg/GAOREPORTS-GAO-08-343/html/GAOREPORTS-GAO-08-343.htm https://www.govinfo.gov/content/pkg/GAOREPORTS-GAO-08-343/html/GAOREPORTS-GAO-08-343.htm https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2006/m06-20.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2006/m06-20.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2006/m06-20.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2006/m06-20.pdf https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/omb/memoranda/fy2006/m06-20.pdf https://www.gpo.gov/fdsys/pkg/FR-1998-08-05/pdf/98-20865.pdf https://www.gpo.gov/fdsys/pkg/FR-1998-08-05/pdf/98-20865.pdf

Title Released Mandatory / Advisory

HSPD-12 “Policy for a Common Identification Standard for Federal Employees and Contractors,” Home Security Presidential Directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12

2004 M

NIST Special Publication 800-

"An Introduction to Computer Security: The NIST Handbook" https://csrc.nist.gov/pubs/sp/800/12/final

June 2017 M

NIST Special Publication 800-

"Generally Accepted Principles and Practices for Securing Information Technology Systems" https://csrc.nist.gov/pubs/sp/800/14/final

Sep 1996 M

NIST Special Publication 800-

"Guide for Developing Security Plans for Federal Information Systems" https://csrc.nist.gov/pubs/sp/800/18/r1/final

Dec 1998 A

NIST Special Publication 800-

"Security Self-Assessment Guide for Information Technology Systems" https://csrc.nist.gov/pubs/sp/800/26/final

Nov 2001 M

NIST Special Publication 800- 26, Rev. 1

"Guide for Information System Assessments and Program Reporting " https://csrc.nist.gov/pubs/sp/800/26/final

Nov 2001 A

NIST Special Publication 800-

"Risk Management Guide for Information Technology Systems" https://nvlpubs.nist.gov/nistpubs/legacy/sp/nists pecialpublication800-30r1.pdf

Sep 2012 M

NIST Special Publication 800-

"Contingency Planning Guide for Federal Information Technology Systems" https://csrc.nist.gov/pubs/sp/800/34/r1/upd1/fin al

May 2010 M https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12 https://csrc.nist.gov/publications/detail/sp/800-12/archive/1995-10-02 https://csrc.nist.gov/publications/detail/sp/800-12/archive/1995-10-02 https://csrc.nist.gov/pubs/sp/800/12/final https://csrc.nist.gov/publications/detail/sp/800-14/archive/1996-09-03 https://csrc.nist.gov/publications/detail/sp/800-14/archive/1996-09-03 https://csrc.nist.gov/pubs/sp/800/14/final https://csrc.nist.gov/publications/detail/sp/800-18/rev-1/final https://csrc.nist.gov/publications/detail/sp/800-18/rev-1/final https://csrc.nist.gov/pubs/sp/800/18/r1/final https://csrc.nist.gov/publications/detail/sp/800-26/archive/2001-11-01 https://csrc.nist.gov/publications/detail/sp/800-26/archive/2001-11-01 https://csrc.nist.gov/pubs/sp/800/26/final https://csrc.nist.gov/publications/detail/sp/800-26/archive/2001-11-01 https://csrc.nist.gov/publications/detail/sp/800-26/archive/2001-11-01 https://csrc.nist.gov/pubs/sp/800/26/final https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-30r1.pdf https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-30r1.pdf https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-30r1.pdf https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-30r1.pdf https://csrc.nist.gov/publications/detail/sp/800-34/rev-1/final https://csrc.nist.gov/publications/detail/sp/800-34/rev-1/final https://csrc.nist.gov/pubs/sp/800/34/r1/upd1/final https://csrc.nist.gov/pubs/sp/800/34/r1/upd1/final

Title Released Mandatory / Advisory

NIST Special Publication 800-

"Guide to Information Technology Security Services" https://nvlpubs.nist.gov/nistpubs/legacy/sp/nists pecialpublication800-35.pdf

Oct 2003 M

NIST Special Publication 800-

"Guide for the Security Certification and Accreditation of Federal Information Systems" https://csrc.nist.gov/pubs/sp/800/37/final

May 2004 M

NIST Special Publication 800-

"Security Guide for Interconnecting Information Technology Systems" https://csrc.nist.gov/pubs/sp/800/47/final

Aug 2002 A

NIST Special Publication 800-

"Recommended Security Controls for Federal Information Systems" https://csrc.nist.gov/projects/cprt/catalog#/cprt/f ramework/version/SP_800_53_5_1_1/home

Feb 2005 A

NIST Special Publication 800- 53, Rev. 4

"Recommended Security Controls for Federal Information Systems" https://csrc.nist.gov/pubs/sp/800/53/r4/upd3/fin al

Apr 2013 A

NIST Special Publication 800-

"Security Metrics Guide for Information Technology Systems" https://csrc.nist.gov/pubs/sp/800/55/final

Jul 2003 A

NIST Special Publication 800-

"Guide for Mapping Types of Information and Information Systems to Security Categories" https://csrc.nist.gov/pubs/sp/800/60/v1/r1/final

Jun 2004 A

NIST Special Publication 800- 64 Rev 2

"Security Considerations in the Information System Development Life Cycle" https://csrc.nist.gov/pubs/sp/800/64/r2/final

Oct 2008 A

NIST Special Publication 800-

"Integrating IT Security into the Capital Planning and Investment Control Process" https://csrc.nist.gov/pubs/sp/800/65/final

Jan 2005 A https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-35.pdf https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-35.pdf https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-35.pdf https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-35.pdf https://csrc.nist.gov/publications/detail/sp/800-37/archive/2004-05-20 https://csrc.nist.gov/publications/detail/sp/800-37/archive/2004-05-20 https://csrc.nist.gov/pubs/sp/800/37/final https://csrc.nist.gov/publications/detail/sp/800-47/final https://csrc.nist.gov/publications/detail/sp/800-47/final https://csrc.nist.gov/pubs/sp/800/47/final https://nvd.nist.gov/800-53 https://nvd.nist.gov/800-53 https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final https://csrc.nist.gov/pubs/sp/800/53/r4/upd3/final https://csrc.nist.gov/pubs/sp/800/53/r4/upd3/final https://csrc.nist.gov/publications/detail/sp/800-55/archive/2003-08-01 https://csrc.nist.gov/publications/detail/sp/800-55/archive/2003-08-01 https://csrc.nist.gov/pubs/sp/800/55/final https://csrc.nist.gov/publications/detail/sp/800-60/vol-1-rev-1/final https://csrc.nist.gov/publications/detail/sp/800-60/vol-1-rev-1/final https://csrc.nist.gov/pubs/sp/800/60/v1/r1/final https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/final https://csrc.nist.gov/pubs/sp/800/64/r2/final https://csrc.nist.gov/publications/detail/sp/800-65/archive/2005-01-01 https://csrc.nist.gov/publications/detail/sp/800-65/archive/2005-01-01 https://csrc.nist.gov/pubs/sp/800/65/final

Title Released Mandatory / Advisory

NIST Draft Special Publication 800-

“Guide for Developing Performance Metrics for Information Security” https://csrc.nist.gov/pubs/sp/800/80/ipd#:~:text= This%20publication%20focuses%20on%20devel oping,agency%2Dlevel%20strategic%20planning %20processes.

May 2006 A

NIST Draft Special Publication 800- 82 Rev 2

"Guide to Industrial Control Systems (ICS) Security" https://csrc.nist.gov/pubs/sp/800/82/r2/final

May 2015 A

NIST Special Publication 800-

"Guide to Test, Training and Exercise Programs for IT Plans and Capabilities" https://csrc.nist.gov/pubs/sp/800/84/final

Sep 2006 M

NIST Special Publication 800-

"Information Security Handbook: A Guide for Managers” https://csrc.nist.gov/pubs/sp/800/100/upd1/final

Oct 2006 A

US SGL United States Standard General Ledger https://fiscal.treasury.gov/ussgl/

Fed-GAAP Federal-based GAAP Compliant Summary Transactions https://www.investopedia.com/terms/g/gaap.asp

M

SF-224 Statement of Transactions Report https://help.sap.com/docs/SAP_S4HANA_ON- PREMISE/5866bce8a9694933b4ef1f50f7acd83f/1 2f4cc53a8b77214e10000000a174cb4.html

General Accounting Office, GAO-02-45

HUD MANAGEMENT: Progress Made on Management Reforms, but Challenges Remain https://www.gao.gov/products/gao-02-45

October

A

GAO/AIMD-00-33 "Information Security Risk Assessment Practices of Leading Organizations" https://www.gao.gov/products/aimd-00-33

Nov 1999 A https://csrc.nist.gov/pubs/sp/800/80/ipd#:~:text=This%20publication%20focuses%20on%20developing,agency%2Dlevel%20strategic%20planning%20processes.

https://csrc.nist.gov/pubs/sp/800/80/ipd#:~:text=This%20publication%20focuses%20on%20developing,agency%2Dlevel%20strategic%20planning%20processes.

https://csrc.nist.gov/pubs/sp/800/80/ipd#:~:text=This%20publication%20focuses%20on%20developing,agency%2Dlevel%20strategic%20planning%20processes.

https://csrc.nist.gov/pubs/sp/800/80/ipd#:~:text=This%20publication%20focuses%20on%20developing,agency%2Dlevel%20strategic%20planning%20processes.

https://csrc.nist.gov/pubs/sp/800/80/ipd#:~:text=This%20publication%20focuses%20on%20developing,agency%2Dlevel%20strategic%20planning%20processes.

https://csrc.nist.gov/pubs/sp/800/80/ipd#:~:text=This%20publication%20focuses%20on%20developing,agency%2Dlevel%20strategic%20planning%20processes.

https://csrc.nist.gov/publications/detail/sp/800-82/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-82/rev-2/final https://csrc.nist.gov/pubs/sp/800/82/r2/final https://csrc.nist.gov/publications/detail/sp/800-84/final https://csrc.nist.gov/publications/detail/sp/800-84/final https://csrc.nist.gov/pubs/sp/800/84/final https://csrc.nist.gov/publications/detail/sp/800-100/final https://csrc.nist.gov/publications/detail/sp/800-100/final https://csrc.nist.gov/pubs/sp/800/100/upd1/final https://fiscal.treasury.gov/ussgl/ https://fiscal.treasury.gov/ussgl/ https://fasab.gov/concepts.htm https://fasab.gov/concepts.htm https://www.nfc.usda.gov/reporting/financial/abstracttrans/financialabstracttrans.htm https://www.gao.gov/products/GAO-02-45 https://www.gao.gov/products/GAO-02-45 https://www.gao.gov/products/gao-02-45 https://www.gao.gov/products/AIMD-00-33 https://www.gao.gov/products/AIMD-00-33 https://www.gao.gov/products/aimd-00-33

Title Released Mandatory / Advisory

FedRAMP Security Assessment Framework, Version 2.4 https://www.fedramp.gov/documents/ https://www.fedramp.gov/documents-templates/

Jun 2017 M

HUD Handbook 2400.25, Rev. 4.1 (or latest revision)

Information Technology Security Policy https://www.hud.gov/sites/dfiles/OCHCO/docum ents/240025CIOH.pdf

Nov 2018 M

HUD Handbook

1325.01, REV-01

Privacy Act Handbook https://www.hud.gov/program_offices/administra tion/hudclips/handbooks/admh/1325.1

Sept 1995 M

HUD Enterprise Architecture

HUD Enterprise Architecture Policy www.hud.gov/offices/cio/ea/index.cfm

Current version

M

HUD Project Planning and Management

(PPM)

Project Planning and Management (PPM) Framework https://www.hud.gov/program_offices/cio/ppm/P

PMV20HOME

Current version

M

HUD Project Planning and Management

(PPM)

‘Project Leader Help Guide’ http://portal.hud.gov/hudportal/documents/hudd oc?id=34101CIOH.pdf

Current version

A

1.3.1. OCHCO Program Office Constraints

Document Number

Title Released Mandatory

(M) / Advisory (A)

31 CFR 1.28 Training, rules of conduct, penalties for non-compliance https://www.ecfr.gov/current/title-31/subtitle- A/part-1/subpart-C/section-1.28

Latest Version

M

32 CFR

117.12(g)(2)

Security training and briefings https://www.ecfr.gov/current/title-32/part- 117/section-117.12#p-117.12(g)(2)

Latest Version

M https://www.fedramp.gov/documents/ https://www.fedramp.gov/documents-templates/ https://www.hud.gov/sites/dfiles/OCHCO/documents/240025CIOH.pdf https://www.hud.gov/sites/dfiles/OCHCO/documents/240025CIOH.pdf https://www.hud.gov/sites/dfiles/OCHCO/documents/240025CIOH.pdf http://portal.hud.gov/hudportal/HUD?src=/program_offices/administration/hudclips/handbooks/admh/1325.1 https://www.hud.gov/program_offices/administration/hudclips/handbooks/admh/1325.1 https://www.hud.gov/program_offices/administration/hudclips/handbooks/admh/1325.1 http://www.hud.gov/offices/cio/ea/index.cfm https://www.hud.gov/program_offices/cio/ppm https://www.hud.gov/program_offices/cio/ppm/PPMV20HOME https://www.hud.gov/program_offices/cio/ppm/PPMV20HOME http://portal.hud.gov/hudportal/documents/huddoc?id=34101CIOH.pdf http://portal.hud.gov/hudportal/documents/huddoc?id=34101CIOH.pdf https://www.ecfr.gov/current/title-31/subtitle-A/part-1/subpart-C/section-1.28 https://www.ecfr.gov/current/title-31/subtitle-A/part-1/subpart-C/section-1.28 https://www.ecfr.gov/current/title-32/part-117/section-117.12#p-117.12(g)(2) https://www.ecfr.gov/current/title-32/part-117/section-117.12#p-117.12(g)(2)

Title Released Mandatory

(M) / Advisory (A)

5 CFR 2638.705 Annual ethics training for other employees https://www.govinfo.gov/content/pkg/CFR-2016-title5-vol3/pdf/CFR-2016-title5-vol3-sec2638- 705.pdf

Latest Version

M

5 CFR 410.202 Responsibilities for evaluating training https://www.ecfr.gov/current/title-5/chapter- I/subchapter-B/part-410/subpart-B/section- 410.202

Latest Version

M

5 CFR

410.302(b)(2)

Responsibilities of the head of an agency https://www.ecfr.gov/current/title-5/part- 410/section-410.302#p-410.302(b)(2)

Latest Version

M

5 CFR 410.601(b) Reporting https://www.ecfr.gov/current/title-5/part- 410/section-410.601#p-410.601(b)

Latest Version

M

5 CFR 430.313 Training and evaluation https://www.ecfr.gov/current/title-5/chapter- I/subchapter-B/part-430/subpart-C/section- 430.313

Latest Version

M

5 CFR 724.203 Training obligations https://www.ecfr.gov/current/title-5/chapter- I/subchapter-B/part-724/subpart-B/section- 724.203

Latest Version

M

5 CFR 930.301 Information systems security awareness training program https://www.ecfr.gov/current/title-5/chapter- I/subchapter-B/part-930/subpart-C/section- 930.301

Latest Version

M

5 USC 552A Records maintained on individuals https://www.govinfo.gov/content/pkg/USCODE- 2023-title5/pdf/USCODE-2023-title5-partI-chap5-subchapII-sec552a.pdf

Latest Version

M https://www.govinfo.gov/content/pkg/CFR-2016-title5-vol3/pdf/CFR-2016-title5-vol3-sec2638-705.pdf https://www.govinfo.gov/content/pkg/CFR-2016-title5-vol3/pdf/CFR-2016-title5-vol3-sec2638-705.pdf https://www.govinfo.gov/content/pkg/CFR-2016-title5-vol3/pdf/CFR-2016-title5-vol3-sec2638-705.pdf https://www.ecfr.gov/current/title-5/chapter-I/subchapter-B/part-410/subpart-B/section-410.202 https://www.ecfr.gov/current/title-5/chapter-I/subchapter-B/part-410/subpart-B/section-410.202 https://www.ecfr.gov/current/title-5/chapter-I/subchapter-B/part-410/subpart-B/section-410.202 https://www.ecfr.gov/current/title-5/part-410/section-410.302#p-410.302(b)(2) https://www.ecfr.gov/current/title-5/part-410/section-410.302#p-410.302(b)(2) https://www.ecfr.gov/current/title-5/part-410/section-410.601#p-410.601(b) https://www.ecfr.gov/current/title-5/part-410/section-410.601#p-410.601(b) https://www.ecfr.gov/current/title-5/chapter-I/subchapter-B/part-430/subpart-C/section-430.313 https://www.ecfr.gov/current/title-5/chapter-I/subchapter-B/part-430/subpart-C/section-430.313 https://www.ecfr.gov/current/title-5/chapter-I/subchapter-B/part-430/subpart-C/section-430.313 https://www.ecfr.gov/current/title-5/chapter-I/subchapter-B/part-724/subpart-B/section-724.203 https://www.ecfr.gov/current/title-5/chapter-I/subchapter-B/part-724/subpart-B/section-724.203 https://www.ecfr.gov/current/title-5/chapter-I/subchapter-B/part-724/subpart-B/section-724.203 https://www.ecfr.gov/current/title-5/chapter-I/subchapter-B/part-930/subpart-C/section-930.301 https://www.ecfr.gov/current/title-5/chapter-I/subchapter-B/part-930/subpart-C/section-930.301 https://www.ecfr.gov/current/title-5/chapter-I/subchapter-B/part-930/subpart-C/section-930.301 https://www.govinfo.gov/content/pkg/USCODE-2023-title5/pdf/USCODE-2023-title5-partI-chap5-subchapII-sec552a.pdf https://www.govinfo.gov/content/pkg/USCODE-2023-title5/pdf/USCODE-2023-title5-partI-chap5-subchapII-sec552a.pdf https://www.govinfo.gov/content/pkg/USCODE-2023-title5/pdf/USCODE-2023-title5-partI-chap5-subchapII-sec552a.pdf

Title Released Mandatory

(M) / Advisory (A)

HUD Handbook 1325.1

HUD Privacy Handbook https://www.hud.gov/sites/dfiles/OCHCO/docum ents/1325.1admnh.pdf

Latest Version

M

HUD Handbook 1750.1

National Security Information https://www.hud.gov/hudclips/handbooks/adm- 1750-1

Latest Version

M

HUD Handbook 455.1

Departmental Supervisory, Management and Executive Training Policy https://www.hud.gov/sites/documents/455.1chc h.pdf

Latest Version

M

Public Law 108- 447 Section 111 of Title I, Division J

Consolidated Appropriations Act https://www.govinfo.gov/app/details/PLAW- 108publ447/summary https://www.govinfo.gov/content/pkg/PLAW- 108publ447/html/PLAW-108publ447.htm

Latest Version

M

Public Law 111-

Plain Writing Act https://www.govinfo.gov/content/pkg/PLAW- 111publ274/pdf/PLAW-111publ274.pdf

Latest Version

M

1.3.2. Additional Constraints

The Contractor Hosted Cloud environment must be dedicated (non-shared with other agencies/clients) and allow for development, testing, staging, and production. The proposed environments shall support development, integration, acceptance testing, training, staging, troubleshooting and all pre-production, as well as production activities. The staging and production environments shall mirror each other and include, but not limited to, 508 compliance, access control, etc. The testing environment shall be 508 compliant capable of processing through the staging and production environments. The Contractor Hosted Cloud environment shall contain all required security, service delivery and hosting capabilities necessary to effectively support the development, testing, quality assurance, and production needs.

1.3.2.1. Software-as-a-Service (SaaS)

The Software-as-a-Service (SaaS) must be designed and delivered as a Contractor-based solution that shall support the following objectives:

https://www.hud.gov/sites/dfiles/OCHCO/documents/1325.1admnh.pdf https://www.hud.gov/sites/dfiles/OCHCO/documents/1325.1admnh.pdf https://www.hud.gov/hudclips/handbooks/adm-1750-1 https://www.hud.gov/hudclips/handbooks/adm-1750-1 https://www.hud.gov/sites/documents/455.1chch.pdf https://www.hud.gov/sites/documents/455.1chch.pdf https://www.govinfo.gov/app/details/PLAW-108publ447/summary https://www.govinfo.gov/app/details/PLAW-108publ447/summary https://www.govinfo.gov/content/pkg/PLAW-108publ447/html/PLAW-108publ447.htm https://www.govinfo.gov/content/pkg/PLAW-108publ447/html/PLAW-108publ447.htm https://www.govinfo.gov/content/pkg/PLAW-111publ274/pdf/PLAW-111publ274.pdf https://www.govinfo.gov/content/pkg/PLAW-111publ274/pdf/PLAW-111publ274.pdf

• Provide a trusted secure communication channel to support the Governments PIV Card authentication (multi-factor method) of remote access in accordance with OMB M-11-11.

• Provide network storage, server, and virtualization layer management plan to include performance of internal technology and refresh cycles applicable to the environment.

• Provide and document patch management appropriate to all components within the provider’s Trusted Internet Connections (TIC) and to adhere to HUD OCIO standards.

• Provide automated monitoring of performance, resource utilization, and other events such as failure of service, degraded service, availability of the network, storage, database systems, operating systems, applications, including Application Program Interface (API) access within the provider’s TIC and Security Content Automation Protocol (SCAP) automation capabilities via a service dashboard or by other electronic methods.

• Comply with technology refresh requirements as required by HUD to ensure security requirements and Acceptable Quality Levels (AQLs) are met.

• Comply with HUD IT requirements and ensure the application is never more than two versions behind.

1.3.2.2. FIPS 140-2 Validated Cryptography for Secure Communications

The Contractor must use only cryptographic mechanisms that comply with FIPS…