Draft PWS.pdf

Performance Work Statement (PWS)

Single Family Data Analysis and Reporting Tool

(SF-DART / P377)

June 24, 2026

Performance Work Statement (PWS), Single Family Data Analysis and Reporting Tool (SF-DART)

Vision Statement

1 General Information

1.1 Scope of Work

1.2 Background

1.3 Constraints

1.4 Non-Personal Services

1.5 Period of Performance

1.6 Place of Performance

1.7 Hours of Operation

1.8 Special Qualifications

1.9 Post Award/Kickoff Conference

1.10 Status Meetings

1.11 Contractor Travel

1.12 Transition In

1.13 Transition Out

2 Definitions and Acronyms

2.1 Definitions

2.2 Acronyms

3 Government-Furnished Property and Services

3.1 Government Services

3.2 Facilities

3.3 Equipment

3.4 Materials and Information

3.5 Quality Assurance (QA)

4 Contractor-Furnished Items and Services

4.1 Facilities

4.2 Equipment

4.3 Materials

4.4 Contractor Responsibilities

4.5 Contractor Personnel

4.6 Identification of Contractor Employees

5 Specific Tasks

5.1 Transition In

5.2 Project Management, Support, and Reporting

5.3 Data Analytic and Reporting Services

5.4 Servicer Performance – Tier Ranking Systems II (TRS II)

5.5 Training

5.6 Help Desk (Optional)

5.7 System Information Technology

5.8 Transition Out (Optional)

6 Deliverables

7 Related Documents

8 Performance Requirements Summary

Vision Statement

To acquire a business intelligence platform that supports the storage of both current and historical data, enabling customizable data analytics and reporting related to the servicing of FHA-insured mortgages.

1 General Information

1.1 Scope of Work

The Office of Single Family Asset Management (OSFAM), within the U.S. Department of

Housing and Urban Development’s (HUD), Office of Housing, is seeking to obtain a FedRAMP compliant Business Service Provider (BSP) Support Services to operate and provide a web-based system, maintain, and enhance flexible manipulation of data and system performance, and train

HUD users of the Single Family - Data Analysis and Reporting Tool (SF-DART). Services shall include:

• Transition In

• Project Management, Support, and Reporting

• Data Analytic and Reporting Services

• Servicer Performance – Tier Ranking Systems II (TRS II)

• Training

• Help Desk (Optional Task)

• System Information Technology

• Transition Out (Optional Task)

Detailed descriptions of specific tasks are provided in Section 5 – Specific Tasks and

Deliverables.

1.2 Background

HUD’s Federal Housing Administration (FHA) administers the single family mortgage insurance program. FHA insures approved lenders against the risk of loss on loans they finance for the purchase, and in some instance rehabilitation, of single family homes. When an FHA insured loan goes into default, the lender is required to evaluate each defaulted borrower for loss mitigation, and if loss mitigation is not feasible, the lender may proceed to foreclosure. After foreclosure, the lender conveys the foreclosed property to HUD and files a claim for insurance benefits.

The Office for Single Family Asset Management (OSFAM) is responsible for developing and implementing policies for mortgage servicing, claims, and property disposition that helps FHA assist homeowners in avoiding foreclosure whenever possible while mitigating losses to the Mutual

Mortgage Insurance Fund (MMIF). To support its goal and mission, OSFAM uses the Single Family

– Data Analysis and Reporting Tool (SF-DART / P377) to manage its day-to-day operations, monitor loan servicing activities of all FHA approved servicers, and assist with managing FHA portfolio and evaluating risk to the MMIF. OSFAM requires the BSP to provide support services to deliver secure and user-friendly web-based applications compliant with HUD requirements to assist the

Department, FHA Mortgagees, and borrowers.

SF-DART / P377 is an integrated analytics and Business Intelligence (BI) web-based application used to extract, mine, and stratify data from various HUD data repositories and other appropriate sources including the Single-Family Housing Enterprise Data Warehouse (SFHEDW) that stores information and historical data relating to approximately 8 million active insured Single-Family loans. SF-DART is also used for ad hoc report development and geo mapping capabilities to analyze and manage FHA single family insured loan data across space and time. Additionally, HUD intends to enable lenders to collect data, create reports, develop, and run queries, and monitor their reporting and performance in accordance with Tier Ranking System II Servicer Narrative.

The Contractor provides database and programming administration, backup processing, hardware and software acquisition, support, and maintenance. The Contractor provides administrative and security rights and access to the environments via the web portal or application. The Contractor provides customer support to assist and provide training to HUD users.

1.3 Constraints

The services identified in this PWS will adhere to the rules, regulations, laws, standards, and conventions identified by HUD and Federal Government. All HUD Handbooks, Forms, Housing Notices, Mortgagee Letters, and Federal guidelines are available on HUD's Client

Information Policy Systems (HUDCLIPS) at: https://www.hud.gov/hudclips

Document

Number Title & URL Released

Mandatory/

Advisory

Pub. L. 113-

283, 44 USC

§3551–3558

The Federal Information Security Modernization Act

(FISMA) of 2014 2014 M https://www.govinfo.gov/content/pkg/CRPT-

113srpt256/pdf/CRPT-113srpt256.pdf

44 USC §3601

et seq.

E-Government Act of 2002

2002 M https://www.govinfo.gov/content/pkg/USCODE-2010-title44/pdf/USCODE-2010-title44-chap36.pdf

Pub. L. 111-352, 31 USC §1101

GPRA Modernization Act of 2010 (GPRAMA)

2010 M https://www.congress.gov/111/plaws/publ352/PLAW-

111publ352.pdf

Pub. L. 104-106, 40 USC §1401 et seq.

Information Technology Management Reform Act of 1996

(Clinger-Cohen Act) 1996 M https://www.govinfo.gov/content/pkg/USCODE-1998-title40/pdf/USCODE-1998-title40-chap25.pdf

31 USC § 9101

ET SEQ.

Government Corporation Control Act

1948 M https://www.govinfo.gov/content/pkg/USCODE-2008-title31/pdf/USCODE-2008-title31-subtitleVI-chap91.pdf

HUD Reform Act, amending the National Housing Act 1989 M https://www.govinfo.gov/content/pkg/CRPT-113srpt256/pdf/CRPT-113srpt256.pdf https://www.govinfo.gov/content/pkg/CRPT-113srpt256/pdf/CRPT-113srpt256.pdf https://www.govinfo.gov/content/pkg/USCODE-2010-title44/pdf/USCODE-2010-title44-chap36.pdf https://www.govinfo.gov/content/pkg/USCODE-2010-title44/pdf/USCODE-2010-title44-chap36.pdf https://www.govinfo.gov/content/pkg/USCODE-1998-title40/pdf/USCODE-1998-title40-chap25.pdf https://www.govinfo.gov/content/pkg/USCODE-1998-title40/pdf/USCODE-1998-title40-chap25.pdf https://www.govinfo.gov/content/pkg/USCODE-2008-title31/pdf/USCODE-2008-title31-subtitleVI-chap91.pdf https://www.govinfo.gov/content/pkg/USCODE-2008-title31/pdf/USCODE-2008-title31-subtitleVI-chap91.pdf

Document

Number Title & URL Released

Mandatory/

Advisory

Pub. L. 101-235, 12 USC 1709(f-

16) https://www.govinfo.gov/content/pkg/USCODE-2011-title12/pdf/USCODE-2011-title12-chap13-subchapII-sec1709.pdf

Pub. L. 105-277

(112 STAT.

2681-749-751), 44 USC §3504

Government Paperwork Elimination Act

1998 M https://www.govinfo.gov/content/pkg/PLAW-

105publ277/pdf/PLAW-105publ277.pdf https://www.govinfo.gov/content/pkg/USCODE-2008-title44/pdf/USCODE-2008-title44-chap35-subchapI-sec3504.pdf

Pub. L. 105-

220, 29 USC

701 et seq.

Section 508 of the Rehabilitation Act of 1998

1998 M https://www.govinfo.gov/content/pkg/PLAW-

105publ220/pdf/PLAW-105publ220.pdf

Pub. L. 104-134, 31 USC §3701 et seq.

Debt Collection Improvement Act of 1996

1996 M https://www.govinfo.gov/content/pkg/USCODE-2010-title31/pdf/USCODE-2010-title31-subtitleIII-chap37.pdf

Pub. L. 113-101, 31 USC

§3716(c)(6)

Digital and Transparency Act of 2014

2014 M https://www.govinfo.gov/content/pkg/PLAW-

113publ101/pdf/PLAW-113publ101.pdf

Pub. L. 97-177, 31 USC §3901 et seq.

Prompt Payment Act

1982 M https://www.govinfo.gov/content/pkg/USCODE-2024-title31/pdf/USCODE-2024-title31-subtitleIII-chap39-sec3901.pdf

Pub. L. 112-248, 31 USC§3321

Improper Payments Elimination and Recovery Improvement

Act of 2012 2012 M https://www.govinfo.gov/content/pkg/PLAW-

112publ248/pdf/PLAW-112publ248.pdf

HSPD-12

Policy for a Common Identification Standard for Federal

Employees and Contractors, Homeland Security Presidential

Directive-12 2004 M https://www.dhs.gov/homeland-security-presidential-directive-12

NIST Special

Publication 800

Series

NIST Special Publications (800 Series) Latest

Version M https://csrc.nist.gov/publications/sp

NIST AI RMF

Playbook

NIST AI Risk Management Framework (RMF) Playbook Latest

Version A https://airc.nist.gov/docs/AI_RMF_Playbook.pdf

GAO/AIMD-

00-33

Information Security Risk Assessment Practices of Leading

Organizations Nov

A https://www.gao.gov/assets/aimd-00-33.pdf

IEEE 730-2026

IEEE Standard for Software Quality Assurance Processes Latest

Version M https://standards.ieee.org/ieee/730/10854/

IEEE 828-2012

IEEE Standard for Configuration Management in Systems and Software Engineering

Latest

Version M https://www.govinfo.gov/content/pkg/USCODE-2011-title12/pdf/USCODE-2011-title12-chap13-subchapII-sec1709.pdf https://www.govinfo.gov/content/pkg/USCODE-2011-title12/pdf/USCODE-2011-title12-chap13-subchapII-sec1709.pdf https://www.govinfo.gov/content/pkg/USCODE-2011-title12/pdf/USCODE-2011-title12-chap13-subchapII-sec1709.pdf https://www.govinfo.gov/content/pkg/PLAW-105publ277/pdf/PLAW-105publ277.pdf https://www.govinfo.gov/content/pkg/PLAW-105publ277/pdf/PLAW-105publ277.pdf https://www.govinfo.gov/content/pkg/USCODE-2008-title44/pdf/USCODE-2008-title44-chap35-subchapI-sec3504.pdf https://www.govinfo.gov/content/pkg/USCODE-2008-title44/pdf/USCODE-2008-title44-chap35-subchapI-sec3504.pdf https://www.govinfo.gov/content/pkg/USCODE-2008-title44/pdf/USCODE-2008-title44-chap35-subchapI-sec3504.pdf https://www.govinfo.gov/content/pkg/PLAW-105publ220/pdf/PLAW-105publ220.pdf https://www.govinfo.gov/content/pkg/PLAW-105publ220/pdf/PLAW-105publ220.pdf https://www.govinfo.gov/content/pkg/USCODE-2010-title31/pdf/USCODE-2010-title31-subtitleIII-chap37.pdf https://www.govinfo.gov/content/pkg/USCODE-2010-title31/pdf/USCODE-2010-title31-subtitleIII-chap37.pdf https://www.govinfo.gov/content/pkg/PLAW-113publ101/pdf/PLAW-113publ101.pdf https://www.govinfo.gov/content/pkg/PLAW-113publ101/pdf/PLAW-113publ101.pdf https://www.govinfo.gov/content/pkg/USCODE-2024-title31/pdf/USCODE-2024-title31-subtitleIII-chap39-sec3901.pdf https://www.govinfo.gov/content/pkg/USCODE-2024-title31/pdf/USCODE-2024-title31-subtitleIII-chap39-sec3901.pdf https://www.govinfo.gov/content/pkg/USCODE-2024-title31/pdf/USCODE-2024-title31-subtitleIII-chap39-sec3901.pdf https://www.govinfo.gov/content/pkg/PLAW-112publ248/pdf/PLAW-112publ248.pdf https://www.govinfo.gov/content/pkg/PLAW-112publ248/pdf/PLAW-112publ248.pdf https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12 https://csrc.nist.gov/publications/sp https://airc.nist.gov/docs/AI_RMF_Playbook.pdf https://www.gao.gov/assets/aimd-00-33.pdf https://standards.ieee.org/ieee/730/10854/

Document

Number Title & URL Released

Mandatory/

Advisory https://standards.ieee.org/ieee/828/5367/

IEEE 830-1998

IEEE Recommended Practice for Software Requirements

Specifications Latest

Version M https://standards.ieee.org/ieee/830/1222/

IEEE 1012-

IEEE Standard for Systems and Software Verification and

Validation Latest

Version M https://standards.ieee.org/ieee/1012/5609/

IEEE 16326-

ISO/IEC/IEEE International Standard Systems and Software

Engineering--Life Cycle Processes--Project Management Latest

Version M https://standards.ieee.org/ieee/16326/6769/

IEEE 12207-

Systems and software engineering -- Software life cycle processes Latest

Version M https://standards.ieee.org/ieee/12207/5672/

IEEE 15288-

ISO/IEC/IEEE International Standard - Systems and software engineering -- Systems life cycle processes Latest

Version M https://standards.ieee.org/ieee/15288/10424

IEEE 16326-

ISO/IEC/IEEE International Standard Systems and Software

Engineering--Life Cycle Processes--Project Management Latest

Version M https://standards.ieee.org/ieee/16326/6769/

IEEE 23026-

ISO/IEC/IEEE International Standard - Systems and software engineering - Engineering and management of websites for systems, software, and services information Latest

Version M https://standards.ieee.org/ieee/23026/10425/

IEEE 29148-

Systems and software engineering -- Life cycle processes --

Requirements engineering Latest

Version M https://standards.ieee.org/ieee/29148/6937/

IEEE 42010-

ISO/IEC Standard for Systems and Software Engineering -

Recommended Practice for Architectural Description of

Software-Intensive Systems Latest

Version M https://standards.ieee.org/ieee/42010/4228/

HUD

Handbook

1325.01

Privacy Act Handbook Latest

Version M https://www.hud.gov/sites/dfiles/OCHCO/documents/1325.1a dmnh.pdf

HUD

Handbooks

Chief Information Officer Handbooks Latest

Version M https://www.hud.gov/hudclips/handbooks/cio

HUD Handbook

2400.25

Information Technology Security Policy Latest

Version M https://www.hud.gov/hudclips/handbooks/cio#cio3

HUD

Handbook

3255.1

Enterprise Architecture Policy Latest

Version M https://www.hud.gov/sites/dfiles/OCHCO/documents/32551C

IOH.pdf

HUD Enterprise

Architecture

Enterprise Architecture Roadmap Latest

Version A https://www.hud.gov/stat/cio/new-ea

HUD Policy for IT Project Planning and Management (PPM) M https://standards.ieee.org/ieee/828/5367/ https://standards.ieee.org/ieee/830/1222/ https://standards.ieee.org/ieee/1012/5609/ https://standards.ieee.org/ieee/16326/6769/ https://standards.ieee.org/ieee/12207/5672/ https://standards.ieee.org/ieee/15288/10424 https://standards.ieee.org/ieee/16326/6769/ https://standards.ieee.org/ieee/23026/10425/ https://standards.ieee.org/ieee/29148/6937/ https://standards.ieee.org/ieee/42010/4228/ https://www.hud.gov/sites/dfiles/OCHCO/documents/1325.1admnh.pdf https://www.hud.gov/sites/dfiles/OCHCO/documents/1325.1admnh.pdf https://www.hud.gov/sites/dfiles/OCHCO/documents/32551CIOH.pdf https://www.hud.gov/sites/dfiles/OCHCO/documents/32551CIOH.pdf https://www.hud.gov/stat/cio/new-ea

Document

Number Title & URL Released

Mandatory/

Advisory

HUD

Handbook

3410.1 https://www.hud.gov/sites/documents/34101cioh.pdf Latest

Version

Tier Ranking

System (TRS &

TRS II)

Tier Ranking System (TRS & TRS II)

Latest

Version M https://www.hud.gov/program_offices/housing/sfh/nsc/trsovr vw

Servicer Narrative https://www.hud.gov/sites/dfiles/SFH/documents/spsnarrative

.pdf

Section 508 HUD Digital Accessibility Policy Latest

Version M https://www.ecfr.gov/current/title-36/chapter-XI/part-1194

Artificial

Intelligence (AI)

AI@HUD Technical Requirements Latest

Version A https://www.hud.gov/sites/default/files/Main/documents/AIT echnicalRequirements.pdf

1.3.1 Project Planning and Management

All HUD IT projects, including all information systems acquired, developed, enhanced, or maintained shall follow the policy, procedures, standards, and guidelines set forth within the IT

Management Framework using the Project Planning and Management (PPM) Life Cycle located at HUD’s PPM Life Cycle Website: https://www.hud.gov/stat/cio/ppmv20

PPM was designed based on the best practices from Capability Maturity Model Integration

(CMMI) for systems development and Poko for project management. While at the foundation, PPM is designed as a Waterfall methodology, HUD encourages tailoring the PPM to use the many modern solution development methodologies available to enable planning, development and delivery of useable functionality within 6 – 9-month increments.

Contractors are encouraged to propose a preferred methodology whether their solution(s) are for custom development, including prototypes or pilots, Commercial Off the Shelf (COTS) configuration, or Software as a Services. Working with the HUD Project Manager(s), the

Contractor will tailor PPM to take advantage of the contractor proposed expertise in using other methodologies in a manner that will provide HUD with the best value and address all work necessary for successful project completion, on time, within budget, and delivering intended functionality.

The decisions of PPM tailoring are captured in the Project Tailoring Agreement (PTA), which documents the specific agreement for creating, combining, referring, or omitting specific artifacts applicable to the project, as well as adjusting project control gate reviews to be consistent with the tailoring. All tailoring of PPM must be approved by HUD. As a default, any project without an approved project tailoring agreement is required to follow all PPM phases and artifacts as presented.

https://www.hud.gov/sites/documents/34101cioh.pdf https://www.hud.gov/program_offices/housing/sfh/nsc/trsovrvw https://www.hud.gov/program_offices/housing/sfh/nsc/trsovrvw https://www.hud.gov/sites/dfiles/SFH/documents/spsnarrative.pdf https://www.hud.gov/sites/dfiles/SFH/documents/spsnarrative.pdf https://www.hud.gov/sites/default/files/OCIO/documents/HUD_Digital_Accessibility_Policy.pdf https://www.ecfr.gov/current/title-36/chapter-XI/part-1194 https://www.hud.gov/stat/cio/ppmv20

1.3.2 Audit Record Retention

Electronic records shall be managed in accordance with 36 CFR 1236.20 & 1236.22 (ref. a), including but not limited to capabilities such as those identified in:

• DoD STD-5015.2 V3 (ref. b), Electronic Records Management Software Applications

Design Criteria Standard,

• NARA Bulletin 2008-05, July 31, 2008, Guidance concerning the use of e-mail archiving applications to store e-mail (ref. c),

• NARA Bulletin 2010-05 September 08, 2010, Guidance on Managing Records in Cloud

Computing Environments (ref 8).

1.3.3 Identification and Authentication (Organizational Users) Multifactor Authentication

The Contractor shall implement the solution to comply with HUD approved multi-factor authentication methods.

1.3.4 Sensitive Information Storage

Sensitive but Unclassified (SBU) information, data, and equipment used to store or transmit SBU data will be made available only to authorized personnel on a Need-To-Know basis. The

Contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected.

When no longer required, this information, data, and/or equipment shall be returned to

Government control, destroyed, or held until otherwise directed. Destruction of items shall be accomplished by following NIST Special Publication 800-88, Guidelines for Media Sanitization.

Disposition of all data will be at the written direction of the Contracting Officer’s Representative

(COR). This may include documents returned to Government control, destroyed, or held as specified until otherwise directed. Items returned to the Government shall be hand carried or sent by certified mail to the COR.

1.3.5 Enterprise Architecture Roadmap

All HUD IT systems shall follow the policy, procedures, standards, and guidelines set forth by the Office of the Chief Technology Officer (OCTO) within the Enterprise Architecture (EA)

Roadmap located at: https://www.hud.gov/sites/default/files/OCIO/documents/EA-Roadmap.pdf

The EA Roadmap defines a standardized, cloud-agnostic infrastructure foundation that enables secure, scalable, and resilient application delivery across HUD environments. The infrastructure layer is anchored in a hybrid, multi-cloud strategy leveraging Amazon Web Services (AWS) and

Azure. The decisions of EA tailoring or deviations are governed by the Technical Review

Committee in coordination with OCTO documenting requirements within HUD infrastructure.

https://www.hud.gov/sites/default/files/OCIO/documents/EA-Roadmap.pdf

1.4 Non-Personal Services

The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual Contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services.

If the Contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the Contractor's responsibility to notify the Contracting Officer (CO) immediately. These services shall not be used to perform the work of a policy, decision making or management nature, i.e., inherently Government functions. All decisions relative to programs supported by the Contactor shall be the sole responsibility of the Government.

1.5 Period of Performance

The period of performance shall be one base period of 12-month and four (4) 12-month option periods.

1.6 Place of Performance

The services to be performed under this contract shall be performed at the Contractor’s facility.

1.7 Hours of Operation

The Contractor shall provide Help Desk services between the hours of 7:00 a.m. to 7:00 p.m.

CST Monday thru Friday. HUD will not be available during scheduled holidays, inclement weather, weekends, and after duty hours.

The Contractor shall maintain an adequate workforce for the uninterrupted performance of all tasks defined within the contract when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce is essential.

1.8 Special Qualifications

The Contractor shall hold, as of the date of contract award and maintain throughout performance, a current and valid Capability Maturity Model Integration (CMMI) Maturity

Level 3 (Defined) Benchmark or higher (or Sustainment) appraisal rating covering the organizational unit that will perform the work under this contract. As evidence, the Contractor shall provide the appraisal record published in the Published Appraisal Results System (PARS), administered by ISACA (CMMI Institute), including the PARS appraisal ID and expiration date or, if the appraisal is not published in PARS, an official appraisal record issued by

ISACA/the Lead Appraiser identifying the appraisal ID, rating, and expiration date.

1.9 Post Award/Kickoff Conference

The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with HUD Acquisition Regulation (HUDAR) clause

2452.237-79 - Post Award Conference. The Contracting Officer will notify the Contractor of the specific date, location, and agenda within five business days after contract award.

1.10 Status Meetings

The CO, COR, and other Government personnel, as appropriate, may meet periodically with the

Contractor to also review Contractor performance, requirement status, etc. At these meetings, the

Contracting Officer will apprise the Contractor of how the Government views the Contractor's performance or progress of the requirement. The Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government. Post Award Conference and subsequent meetings may be held via teleconference at the Contracting Officer's discretion.

1.11 Contractor Travel

Prior to travel, the Contractor shall coordinate with and receive Government authorization from the COR for all travel. Reimbursement of travel costs will be in accordance with the Federal

Travel Regulation and in accordance with FAR 31.205-46.

1.12 Transition In

The Contractor shall, upon the Contracting Officer's written notice, furnish Transition In services as required. As a successor, the Contractor shall have sufficient personnel on board during the

180 calendar day Transition In period to ensure a smooth transition with the incumbent

Contractor. The Contractor shall provide an orderly transition of work acceptance and accomplishment such that any impact to the program is minimized. During the Transition In period, the Contractor shall become familiar with the requirements in order to commence full performance of services by the end of the contract Transition In period.

Additional Transition In tasks are located in Section 5.

1.13 Transition Out

To minimize any decrease in productivity and to prevent possible negative impacts on additional services, the Contractor shall have sufficient personnel on board during the 150 calendar day

Transition Out period. The incumbent Contractor shall ensure a smooth transition with the successor Contractor during the Transition Out period, prior to completion of contractual performance. The incumbent Contractor shall aid the successor in the development of plans, procedures, and methods for the assumption of all on going work. The Contractor shall provide an orderly transition of work acceptance and accomplishment, such that full control by the successor contractor is achieved by the end of the new contract Transition In period.

Additional Transition Out tasks are located in Section 5.

2 Definitions and Acronyms

2.1 Definitions

Business Day – Every official day of the week which are days between and including Monday to

Friday. This does not include federal holidays and weekends.

Contractor - A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Contracting Officer (CO) - A person with authority to enter into, administer, and/or terminate contracts and make related determinations and findings on behalf of the Government. Note: the only individual who can legally bind the Government.

Contracting Officer’s Representative (COR) – An employee of the Government appointed by the Contracting Officer to perform contract administration activities regarding technical issues.

This individual has authority to provide technical direction to the Contractor if direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have the authority to change the terms and conditions of the contract.

Defective Service - A service output that does not meet the standard of performance associated with the Performance Work Statement.

Government Furnished Property (GFP) - Government-furnished property is property in the possession of, or directly acquired by, the Government and subsequently furnished to the

Contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification.

Government-furnished property also includes contractor-acquired property if the contractor-acquired property is a deliverable under a cost contract when accepted by the Government for continued use under the contract.

Performance Standard - The Contractor’s performance level required by the Government.

Performance Work Statement (PWS) - A statement of work for performance-based acquisitions that describe the required results in clear, specific, and objective terms with measurable outcomes.

Quality Assurance (QA) - Policies and procedures adopted by the Government to ensure that supplies and services acquired under Government contracts conform to the contracts quality requirements.

Quality Assurance Surveillance Plan (QASP) - A plan describing how the agency will survey, observe, test, sample, evaluate and document the Contractor's performance in meeting critical performance standards identified in the contract.

Quality Control (QC) - All necessary measures taken by the Contractor to ensure that the quality of an end product of service shall meet contract requirements.

Subcontractor - Any person, other than the prime Contractor, who offers to furnish or furnishes any supplies, material, equipment, or services of any kind under a prime contract or a subcontract entered into in connection with such a prime contract, and any person who offers to furnish or furnishes general supplies to the prime contractor or a higher tier subcontractor. The

Government does not have privity of contract with a subcontractor.

2.2 Acronyms

AI – Artificial Intelligence

ATO – Authorization to Operate

AQL - Acceptable Quality Level

AWS – Amazon Web Services

BI – Business Intelligence

BSP – Business Service Provider

CBSA – Core Based Statistical Area

CCB – Change Control Board

CI/CD – Continuous Integration and Continuous Delivery

CISO – Chief Information Security Officer

CMMI – Capability Maturity Model Integration

CMP – Continuous Monitoring Plan

CO – Contracting Officer

COOP – Continuity of Operations Plan

COR – Contracting Officer’s Representative

COTS – Commercial Off the Shelf

CST – Central Standard Time

DR – Disaster Recovery

EA – Enterprise Architecture

ETL – Extract, Transform, and Load

FAR – Federal Acquisition Regulation

FedRAMP – Federal Risk and Authorization Management Program

FHA – Federal Housing Administration

FHAC – Federal Housing Administration Connection

FIPS – Federal Information Processing Standards

FISCAM – Federal Information System Controls Audit Manual

GFE – Government Furnished Equipment

GFP – Government Furnished Property

HECM – Home Equity Conversion Mortgage

HITS – HUD’s Information Technology Service

HOC – Home Ownership Center

HQ – Headquarters

HUD – U.S. Department of Housing and Urban Development

HUDAR – HUD Acquisition Regulations

ICD – Interface Control Document

IP – Implementation Plan

ISCM – Information Security Continuous Monitoring

IT – Information Technology

MMI – Mutual Mortgage Insurance

MWP – Management Work Plan

MSA – Metropolitan Statistical Area

NARA – National Archives and Records Administration

NIST – National Institute of Standards and Technology

NIST SP – National Institute of Standards and Technology Special Publications

OA – Ongoing Authorization

OCTO – Office of the Chief Technology Officer

OMB – Office of Management and Budget

OSFAM – Office of Single Family Asset Management

PII – Personal Identifiable Information

PIV – Personal Identity Verification

PKI - Public Key Infrastructure

POA&M – Plan of Action and Milestones

POC – Point of Contact

PPM – Project Planning and Management

PRS – Performance Requirement Summary

PTA – Project Tailoring Agreement

PWS – Performance Work Statement

QA - Quality Assurance

QAD – Quality Assurance Division

QASP – Quality Assurance Surveillance Plan

QC – Quality Control

QCP – Quality Control Plan

RMF – Risk Management Framework

ROB – Departmental Rules of Behavior

SA&A – Security Assessment & Authorization

SBU – Sensitive but Unclassified

SF-DART – Single Family Data Analysis and Reporting Tool

SFDMS – Single Family Default Monitoring System

SFHEDW – Single Family Housing Enterprise Data Warehouse

SOC – Security Operations Center

SSP – System Security Plan

ST&E – Security Test and Evaluation

TDD – Telecommunications Device for the Deaf

TRS II – Tier Ranking System II

UAT – User Acceptance Testing

UI – User Interface

URL – Uniform Resource Locator

US-CERT – United States Computer Emergency Readiness Team

VPN – Virtual Private Network

3 Government-Furnished Property and Services

The Contractor shall ensure accurate control and accountability of all Government-Furnished

Property in accordance with the terms and conditions of this contract. The Government will furnish, at no cost to the Contractor, the GFP shown below.

3.1 Government Services

The Government will provide IT resources for contractor use in performance of this contract:

• Training system to complete Annual Security Awareness Training o Required for all contractors issued HUD user credentials that use, operate, or manage a federal computer system.

• Web Hosting Environment: HUD will provide access to a cloud-based web hosting environment, including, o Server infrastructure (development, testing, staging, and production environments, as applicable) o Database services o SSL/TLS certificates o Domain and DNS management o Backup and disaster recovery infrastructure o Identity Services

• Project Management support systems (e.g., Atlassian’s Jira and Confluence) access will be provided by HUD as needed.

3.2 Facilities

Facilities will not be provided.

3.3 Equipment

HUD will issue GFE laptops for the Contractor staff for appropriate access to HUD's software development, test, and production environments. All GFE must be used to support performance of official Government business in support of this PWS and must be returned upon separation.

All GFE will remain the property of the Government.

The Contractor must not procure or implement duplicative systems that replicate the capabilities of Government-furnished platforms without prior written approval from the Government.

3.4 Materials and Information

See HUDAR 2452.227-70, Government Information.

The Government shall provide copies of required materials electronically. All materials will remain the property of the Government and will be returned to the COR upon request or at the end of the contract period.

3.5 Quality Assurance (QA)

The Government shall evaluate the Contractor's performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable quality level.

4 Contractor-Furnished Items and Services

The Contractor shall furnish, all facilities, equipment, and supplies required to perform the work under this contract that are not listed under Government-Furnished Property and Services.

4.1 Facilities

The Contractor shall furnish all facilities required to perform the services identified within the

PWS.

4.2 Equipment

The Contractor shall furnish all equipment including necessary licenses required to perform the services identified within the PWS.

4.3 Materials

The Contractor shall furnish all materials required to perform the services identified within the

PWS.

4.4 Contractor Responsibilities

The Contractor shall only conduct business with designated Government personnel listed as points of contact (POCs). Names of authorized personnel shall be provided to the Contractor by the Government, in writing, and updated as necessary throughout the contract period of performance.

Government records, copies of original results and reports, verified original data, corrected data, and corrected supporting final reports which are maintained by the Contractor remain the property of the Government. These files and results must be surrendered to the COR.

4.5 Contractor Personnel

See HUDAR clause 2452.237-70 - Key Personnel in the Key Personnel section of the contract.

The Contractor shall provide the specified Key Personnel that are essential to the work being a performed under this contract. The Contractor shall provide a Contract/Project Manager who shall be the main contact and responsible for the performance of work. An alternate shall also be designated to act in the absence of the Contract/Project Manager. These Contractor personnel (main point of contact and alternate point of contact) are considered Key Personnel by the Government. The

Contract/Project Manager and alternate shall have full authority to act on all contact matters relating to daily operations of this contract. Accordingly, at a minimum, the points of contact shall have the technical knowledge of the requirement and be in the position to receive assignment, guidance, and direction from the COR and CO per HUDAR 2452.237-73, "Conduct of Work and Technical

Guidance" and shall be allocated enough hours to the requirement to ensure successful performance.

These points of contact shall each be an employee of the Contractor. An employee of a subcontractor is not acceptable for either of these positions. The Contract/Project Manager or alternate shall be available between the hours of 7:00 am to 7:00 pm CST, Monday through Friday, except Federal

Holidays or when the Government facility is closed for administrative reasons.

4.6 Identification of Contractor Employees

All Contractor/subcontractor personnel shall wear company picture identification badges to distinguish themselves from Government employees. When conversing with Government personnel during business meetings, over the telephone, or via electronic mail, Contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees.

Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation. Where practicable, Contractor/subcontractors occupying collocated space with their

Government program customer shall identify their workspace area with their name and company affiliation, or at a minimum, "Contractor" after name.

5 Specific Tasks

The Contractor shall provide services to support the secure and remotely accessible SF-DART web application, including its operation & maintenance. The Contractor shall be responsible for transforming raw data extracted from SFHEDW into actionable, retrievable information and developing a front-end user interface for data collection and processing.

5.1 Transition In

The Transition In period is 180 calendar days from the Contract effective date. The Contractor shall deliver and demonstrate a fully operational web-based SF-DART system on or before the

180th calendar day from the Contract effective date. The Contractor shall complete all requirements to achieve an Authorization to Operate (ATO) prior to the completion of the

Transition In period. The ATO process can take approximately six (6) months. The Contractor shall complete Transition In activities including adapting physical and system infrastructure and migrating existing data into the new environment.

The Contractor shall attend training or knowledge transfer sessions provided by the incumbent. The

Contractor shall submit a list of attendees to the COR for approval no later than seven (7) business days prior to the scheduled training date. The Contractor shall submit to the COR a complete

Personal Identity Verification (PIV) Application prior to attending the training for each attendee.

After this initial training, the training of additional employees is the responsibility of the Contractor.

Throughout the Transition In period, the Contractor shall keep the COR informed on the transition in progress via weekly summary reports, meetings, and/or telephone calls, as needed.

During the Transition In period, the Contractor shall accomplish the following milestones.

• The Contractor shall submit complete PIV packages within five (5) business days after post award/kick-off to the COR. The package will include the documents listed below:

o Departmental Rules and Behaviors (ROB) o HUD provided non-disclosure form

• Within 10 business days after receipt of PIV cards, all Contractor personnel shall complete the Annual Security Awareness Training. The Contractor shall provide a copy of the certificate of completion to the COR.

• At the post award/kickoff conference the Contractor shall provide and present the draft

Transition In plan. The Transition In plan shall include:

• A thorough assessment of the current systems and processes

• Identifying key stakeholders who will form the transition in team

• Develop a detailed transition roadmap that describes the Contractor’s required ramp-up time, milestone, and approach to initiating project execution including staffing and training for project start.

• Map the dependencies among deliverables specified in the PWS and provide a resource-loaded Work Breakdown Structure (WBS) and timeline for each deliverable and its impacts on the others

• Include site-specific actions that clearly define the processes, methodologies, schedules, milestones, risk analysis and data requirements. Provide a detailed operational readiness checklist which will be used by the Government for transition. Identify potential risks during the Transition In period and propose appropriate mitigation strategies.

• Within five (5) business days after receipt of COR’s comments, the Contractor shall submit the final transition in plan. Upon acceptance of the finalized transition in plan the

Contractor shall meet all milestones identified within the Transition In plan, including milestones identified in the transition roadmap.

Performance Standards

a) Standard: Submit complete PIV packages within five (5) business days after post award/kick-off meeting

AQL: Zero deviation

b) Standard: Within ten (10) business days after receipt of the PIV card each Contractor employee shall complete the Annual Security Awareness Training

AQL: Zero deviation

c) Standard: Draft transition in plan shall be delivered and presented at the post-award/kick off meeting

AQL: Zero deviation

d) Standard: Deliver the final transition plan no later than five (5) business days after receipt of the COR’s comments.

AQL: Zero deviation

Deliverables

A001 Completed PIV package

A002 Completion Certificate of Annual Security Awareness Training

A003 Draft Transition In Plan

A004 Final Transition In Plan

5.1.1 System Readiness

The Contractor shall support the SF-DART system according to HUD's IT infrastructure and security requirement listed throughout this PWS within thirty (30) calendar days from the effective date of the contract.

The Contractor shall obtain all licenses, permits and qualifications required to transact business in the contract and implement the information technology and support necessary to perform the requirements contained in this PWS.

The Contractor shall provide equipment and software that meet HUD's system requirements.

All personal computer configurations shall be in accordance with HUD's personal computer system configurations beginning on the effective date of the contract.

The Contractor shall provide support services to assist HUD IT resource in the implementation and execution of the EA Roadmap.

The Contractor shall convert and migrate all application and system code in compliance with

Section 508 requirements including TRS II and existing databases from the existing environment to the newly established and secure environment.

Performance Standard

a) Standard: Establish HUD’s IT infrastructure and security requirement within thirty (30) calendar days from the effective date of the contract.

5.1.2 User Acceptance Testing

The User Acceptance Testing of the system shall be conducted in the Testing and Staging environment. The Contractor shall deliver the UAT results to the COR for review and acceptance to demonstrate a high likelihood of success for delivery of the system identifying any deficiencies evidenced in documentation and as a result user acceptance testing. The Contractor shall provide UAT instructions, including testing approach, UAT test results and validation to assist users during UAT period as necessary within three (3) business days. With the COR’s approval, the Contractor shall track and resolve all defects and deficiencies found within three (3) business days.

The Contractor shall validate all system functionality and complete configuration of the system infrastructure in accordance with HUD IT security requirements.

The Contractor shall prepare for system conversion and provide full implementation services after UAT has been completed and approved by the COR.

a) Standard: Provide UAT instructions, including testing approach, UAT test results and validation within three (3) business days.

AQL: Zero deviation

b) Standard: Track and resolve all defects and deficiencies found within three (3) business days.

A005 UAT Instructions

A006 UAT Results

5.1.3 Training of the System

The Contractor shall provide six (6) training classes, for a duration of up to four (4) hours per class but not less than one (1) hour per training. The training shall take place sixty (60) calendar days prior to go live and no later than thirty (30) calendar days after going live. At a minimum, the training shall cover logging in and navigation; core functionality and workflows; and system functionality based on user roles and permissions.

The Contractor shall provide a training plan to the COR for approval no later than ninety (90) calendar days after the effective date of the contract. At a minimum the training plan shall include: the training schedule, training agenda, and class duration.

The Contractor shall provide User Manual, Training Materials, a Quick Reference Guide, and

User Manual to all training participants three (3) calendar days prior to the scheduled training.

The Contractor shall provide technical training to assist HUD resource to support the SF-DART developed and used during Business & IT Modernization migration.

The Contractor shall record and provide a video training for future use. The Contractor shall provide the recoded training video no later than 20 calendar days.

The Contractor shall provide a list of participants to the COR at the completion of each training class. The list shall include: attendee’s contact information, role, and date of training.

a) Standard: Six (6) training classes shall be provided during the period of sixty (60) calendar days prior to going live and no later than thirty (30) calendar days after going live.

b) Standard: Training plan shall be delivered to COR no later than ninety (90) calendar days after effective date of the contract.

AQL: Zero deviation

c) Standard: User Guide including training materials, quick reference guide, and user manual shall be available to all participants no later than three (3) calendar days prior to the scheduled training.

AQL: Zero deviation

d) Standard: Recorded training video shall be available to the COR no later than 20 calendar days.

AQL: Zero deviation

e) Standard: A list of all participants shall be provided to the COR at the completion of each training.

A007 Training Plan

A008 Training Materials

A009 Quick Reference Guide

A010 User Manual

A011 Recorded Training Video

A012 List of participants at the completion of each Training

5.1.4 Parallel Conversion

The Contractor shall perform a parallel conversion to migrate, convert, and upgrade the existing database infrastructure from the incumbent Contractor to the new environment during the conversion period. The parallel conversion period shall begin from the effective date of the contract through completion of the Transition In.

5.1.5 Completion of System Conversion

Unless otherwise notified by the COR, all functions of the SF-DART system configuration shall be completed and fully operational no later than 180 calendar days from the effective date of contract and ready to go live by the next calendar day. The Contractor shall demonstrate to the

COR that the SF-DART system is fully operational no later than 14 calendar days prior to the expiration of the transition in period. This demonstration shall include all web-applications, reports, functions and connectivity.

Within thirty (30) calendars days following the completion and acceptance of the Transition In period, the Contractor shall submit to the COR a Conversion Acceptance Memo. At a minimum, the Conversion Acceptance Memo shall outline the following:

• Notification and evidence of the live systems,

• Status of the system,

• Accomplishments,

• Obstacles,

• Significant changes and revisions,

• Risks,

• Corrected action (if any), and

• All other related concerns and issues during the Transition In period.

a) Standard: Demonstrate to the COR that the system including all web-applications, reports, and functions are fulling functioning no later than 14 calendar days prior to the expiration of the Transition In period.

AQL: Zero deviation

b) Standard: System including all web-applications, reports, and functions shall be live and fully operational at 180 calendar days from the effective date of the contract.

AQL: Zero deviation

c) Standard: Submit to the COR a Conversion Acceptance Memo Within thirty (30) calendars days following the completion and acceptance of the Transition In period and successful completion of all Transition In activities.

A013 Access to fully functional SF-DART System

A014 Conversion Acceptance Memo

5.2 Project Management, Support, and Reporting

5.2.1 Project Plan

The Contractor shall thoroughly review, validate, and update, and address all existing support documents and/or coding of internal business rules of the new system. The Project Plan shall consist of the following:

A. Implementation Plan (IP)

B. Management Work Plan (MWP)

C. Continuity of Operations Plan (COOP)

D. Configuration Management Plan

The Contractor shall submit the draft Project Plan to the COR for review and approval not later than twenty (20) business days from the effective date of the contract. The Contractor shall revise and resubmit the documents based on the result of review.

The Contractor shall submit final Project Plan to the COR for approval no later than five (5) business days from the receipt of the COR's comments. The final Project Plan shall incorporate

COR's comments and revisions to reflect the current state of the system to ensure accuracy, compliance, and completeness.

The Contractor shall notify the COR of any pending updates to the Project Plan. The Contractor shall provide the revised Project Plan to the COR for approval no later than five (5) business days of any change.

Annually the Contractor shall update and deliver the Project Plan for acceptance no later than thirty (30) business days from the effective date of each option period, assuming the option period is exercised.

Upon acceptance of the Project Plan, the Contractor shall execute all components of the Project

Plan. Project Plan may be revised and updated upon COR’s request.

5.2.1.1 Implementation Plan (IP)

The Implementation Plan (IP) provides an overview of activities, schedules, resources, and support-planning efforts to be employed to accomplish the conversion from the current environment built and maintained by the incumbent Contractor to the receiving Contractor. The

Contractor shall work closely with the incumbent contractor and the Contracting Officer's

Representative (COR) to implement and provide a seamless…