DRAFT-RCSA Recompete PWS.docx

U.S. Department of Housing and Urban Development Washington, D.C. 20410

OFFICE OF THE CHIEF PROCUREMENT OFFICER

DRAFT - Performance Work Statement (PWS) Risk & Controls Self-Assessment Program Contents

Performance Work Statement (PWS) Risk & Controls Self-Assessment (RCSA) Program

Vision Statement Ginnie Mae’s vision is to strengthen its Risk and Controls Self-Assessment (RCSA) Program and promote an enterprise-wide holistic view of its operational and information technology risk profile with the comprehensive participation of each Office and Division in the identification, assessment, and mitigation of risk to ensure a risk-informed approach to internal controls that enhances decision-making, improves program performance, and ensures integrity of operations.

1 General Information

1.1 Scope of Work

The successful contractor shall provide program management support for the continued enhancement and execution of the performed across the enterprise. The Risk and Controls Self-Assessment (RCSA) Program identifies, assesses, reports and monitors risks and controls associated with operational processes, people, systems, and external events. Ginnie Mae’s risk management framework and governance structure provides comprehensive control and ongoing management of the major inherent and residual risk associated with its business activities.

The Contractor will review, analyze and assess governance documentation, manuals, and other materials provided by all eight (8) of Ginnie Mae’s Offices, update Process Flow Charts, Risk Register Control Matrices, Narratives for each Office and other RCSA documents on an annual basis. This includes templates, Process and SOP inventories, and other similar documentation.

The support services shall include but not be limited to:

· Project Work Plan

· Transition Services

· RCSA Program Execution

· RCSA Annual Maintenance

· Special Projects

Detailed descriptions of specific tasks are provided in Section 5 Specific Tasks and Deliverables.

1.2 Background

In the critical role that Ginnie Mae plays in the secondary mortgage market, it faces numerous enterprise-wide operational risks that must be proactively monitored and mitigated. Some risks are consistently present, highly visible, inherent, and broadly understood; others may be recognized at some level but may not be highly visible and fully understood; yet other risks may evolve over time or emerge suddenly.

RCSA is responsible for assisting Ginnie Mae’s business units to recognize, understand, and establish appropriate strategies to mitigate identified risks.

Ginnie Mae will be most successful in managing risks if a high level of risk awareness exists within its eight (8) business offices. The RCSA Program supports Divisions within these Offices in defining tolerances for specific risks and considers the cost and benefit of associated internal controls to manage risks. The RCSA Program enables Ginnie Mae to better connect and integrate risk across the organization while seeking to streamline internal controls across the agency to enhance their value to Ginnie Mae’s corporate governance.

Ginnie Mae’s strategic vision for the RCSA program is not just compliance, but also risk culture, risk awareness, risk ownership, and risk advisement through the inclusion of risks as an integral part of day-to-day program management. While the RCSA Program’s primary review focus is operational and information technology risks, it also seeks to monitor current and emerging risks including, but not limited to, credit, governance, legal, reputational, and strategic risks.

The ORAD works in partnership with the Offices and Divisions to implement the RCSA Program through a three-prong review with a five-step iterative methodology to identify, assess, analyze, and remediate known risks, control gaps, potential emerging issues, and other threats as determined during the review.

The Contractor will perform individual assessments and reviews in eight (8) Offices within Ginnie Mae and support ORAD to determine risks, gaps, mitigation strategies and continuous RCSA improvement activities, in addition to its program management duties.

1.3 Constraints

The services identified in this PWS will adhere to the rules, regulations, laws, standards, and conventions identified by HUD as well as within the Federal Government. Constraints include the following:

a. Federal Managers’ Financial Integrity Act of 1982 (https://www.congress.gov/97/statute/STATUTE-96/STATUTE-96-Pg814.pdf)

b. Government Performance Results Act Modernization Act of 2010 (https://www.congress.gov/111/statute/STATUTE-124/STATUTE-124-Pg3866.pdf)

c. Federal Information Security Modernization Act of 2014 (https://www.congress.gov/113/statute/STATUTE-128/STATUTE-128-Pg3073.pdf)

d. Payment Integrity Information Act of 2019 (https://www.congress.gov/116/statute/STATUTE-134/STATUTE-134-Pg113.pdf)

e. Federal Agency Performance Act of 2024 (https://www.congress.gov/118/plaws/publ190/PLAW-118publ190.pdf)

f. OMB Circular A-123, Managements Responsibility for Internal Control https://www.whitehouse.gov/wp-content/uploads/2026/03/OMB-Circular-No.-A-123-2026.pdf)

g. OMB Circular A-11, Preparation, Submission, and Execution of the Budget, ()

h. CFO Council, Playbook: Enterprise Risk Management for the US Federal Government, https://cfo.gov/wp-content/uploads/2016/07/FINAL-ERMPlaybook.pdf

i. OMB Circular A-136, Financial Reporting Requirements, (https://www.whitehouse.gov/wp-content/uploads/2019/06/OMB-Circular-A-136.pdf)

j. Committee of Sponsoring Organizations’ (COSO), Enterprise Risk Management Framework, (https://www.coso.org/erm-framework)

k. Government Accountability Office (GAO), Standards for Internal Controls in the Federal Government (The Green Book), (https://www.gao.gov/assets/gao-25-107721.pdf)

l. GAO, Federal Information Systems Controls Audit Manual (FISCAM) (https://www.gao.gov/assets/80/77142.pdf)

m. U.S. Department of Housing and Urban Development HUDAR, (https://www.acquisition.gov/hudar)

n. Federal Acquisition Regulation (https://www.acquisition.gov/browse/index/far)

o. National Institute of Standards and Technology, Cybersecurity Framework (CSF) 2.0, (https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf)

p. NIST, Security and Privacy Controls for Information Systems and Organizations (NIST SP 800-53) Rev. 5, (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf)

q. U.S. Department of Housing and Urban Development, Information Technology Security Policy, HUD Handbook 2400.25 Rev. 5.0, (https://www.hud.gov/sites/dfiles/OCHCO/documents/240025CIOH.pdf)

Services will also adhere to the Electronic Funds Transfer Act, Fair Debt Collection Practices Act, Real Estate Settlement Procedures Act and Foreign Corrupt Practices Act, among others.

1.4 Non-Personal Services

The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual Contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services.

If the Contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the Contractor's responsibility to notify the Contracting Officer (CO) immediately. These services shall not be used to perform work of a policy, decision making or management nature, i.e., inherently Government functions. All decisions relative to programs supported by the Contactor shall be the sole responsibility of the Government.

1.5 Period of Performance

The period of performance shall be for a 12-month base period with four 12-month option periods.

1.6 Place of Performance

The services to be performed under this contract shall be performed at the Contractor’s facility.

1.7 Hours of Operation

The Contractor is responsible for providing services between the hours of 8:00am to 5:00pm Monday thru Friday except for Federal holidays. The Government reserves the right to change hours of operation or restrict contractor access. Government agencies will not be available during scheduled holidays, administrative closings, weekends, after duty hours and similar Government directed facility closings.

When the Government facility is not closed for the above reasons, the Contractor shall maintain an adequate workforce for the uninterrupted performance of all tasks defined within the contract. Contractor shall keep in mind that the stability and continuity of the workforce is essential.

1.8 Special Qualifications

The Primary and/or Sub-Contractor must possess through their employees the following knowledge, skills, experience, risk and compliance industry certifications. No employee is required to have obtained all certifications:

· Certified Public Accountant (CPA)

· Certified Information Systems Auditor (CISA)

· Certified Internal Auditor (CIA)

· Certified Fraud Examiner (CFE)

· Committee of Sponsoring Organizations (COSO)

· Certified Government Financial Manager (CGFM)

· Project Management Professional (PMP) certification

· Certified Information Systems Security Professional (CISSP)

· Certified Information Security Manager (CISM)

· Certified Cloud Service Provider (CCSP)

· Certified in Risk and Information Systems Controls (CRISC)

· Certified Operational Risk Professional (CORP)

· Cybersecurity risk-related certification

1.9 Post Award/Kickoff Conference

The Contractor must attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5 and HUD Acquisition Regulation (HUDAR) clause 2452.237-79 - Post Award Conference.

1.10 Status Meetings

The Contracting Officer, Contracting Officer’s Representative (COR), and other Government personnel as appropriate, may meet periodically with the Contractor to review Contractor performance. At these meetings, the Contracting Officer will apprise the Contractor of how the Government views the Contractor's performance or progress of the requirement. The Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government. Post Award Conference and subsequent meetings may be held via teleconference at the Contracting Officer's discretion.

1.11 Contractor Travel

Travel costs will not be provided.

1.12 Transition-In

The Contractor shall, upon the Contracting Officer's written notice, furnish transition-in services as required. As a successor, the Contractor shall have sufficient personnel on board during the 30-day transition-in period to ensure a smooth transition with the incumbent Contractor. The Contractor shall provide an orderly transition of work acceptance and accomplishment such that any impact to the program is minimized. During the transition-in period, the Contractor shall become familiar with the requirements in order to commence full performance of services by the end of the contract transition-in period. Transition-in is not required if the successor Contractor is the incumbent Contractor.

1.13 Transition-Out

To minimize any decrease in productivity and to prevent possible negative impacts on additional services, the Contractor shall have sufficient personnel on board during the 30-day transition-out period. The incumbent Contractor shall ensure a smooth transition with the successor Contractor during the transition-out period, prior to completion of contractual performance. The incumbent Contractor shall aid the successor in the development of plans, procedures, and methods for the assumption of all on going work. The Contractor shall provide an orderly transition of work acceptance and accomplishment, such that full control by the successor contractor is achieved by the end of the new contract transition-in period.

2 Definitions and Acronyms

2.1 Definitions

Business Day – Every official day of the week which are days between and including Monday to Friday. This does not include federal holidays and weekends.

Contractor - A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Contracting Officer (CO) - A person with authority to enter into, administer, and/or terminate contracts and make related determinations and findings on behalf of the Government. Note: the only individual who can legally bind the Government.

Contracting Officer’s Representative (COR) – An employee of the U.S. Government appointed by the Contracting Officer to perform contract administration activities regarding technical issues. This individual has authority to provide technical direction to the Contractor if direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have the authority to change the terms and conditions of the contract.

Defective Service - A service output that does not meet the standard of performance associated with the Performance Work Statement.

Deliverable - Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

Government Furnished Property (GFP) - Government-furnished property is property in the possession of, or directly acquired by, the Government and subsequently furnished to the Contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification. Government-furnished property also includes contractor-acquired property if the contractor-acquired property is a deliverable under a cost contract when accepted by the Government for continued use under the contract.

Performance Standard - The Contractor’s performance level required by the Government.

Performance Work Statement (PWS) - A statement of work for performance-based acquisitions that describe the required results in clear, specific, and objective terms with measurable outcomes.

Quality Assurance (QA) - Policies and procedures adopted by the Government to ensure that supplies and services acquired under Government contracts conform to the contracts quality requirements.

Quality Assurance Surveillance Plan (QASP) - A plan describing how the agency will survey, observe, test, sample, evaluate and document the Contractor's performance in meeting critical performance standards identified in the contract.

Quality Control (QC) - All necessary measures taken by the Contractor to assure that the quality of an end product of service shall meet contract requirements.

Subcontractor - Any person, other than the prime Contractor, who offers to furnish or furnishes any supplies, material, equipment, or services of any kind under a prime contract or a subcontract entered into in connection with such prime contract, and any person who offers to furnish or furnishes general supplies to the prime contractor or a higher tier subcontractor. The Government does not have privity of contract with a subcontractor.

2.2 Acronyms

3 Government-Furnished Property and Services

The Contractor shall ensure accurate control and accountability of all Government-Furnished Property in accordance with the terms and conditions of this contract. The Government will furnish, at no cost to the Contractor, the GFP shown below.

3.1 Government Services

Government services will not be provided.

3.2 Facilities

Facilities will not be provided.

3.3 Equipment

Equipment will not be provided.

3.4 Materials and Information

See HUDAR 2452.227-70, Government Information

The Government shall provide ERM Program artifacts (e.g., governance documents, tools, templates, risk registers, reports, matrices, etc.) to the Contractor to enable completion of all tasks and deliverables required from this PWS, after the award.

3.5 Quality Assurance (QA)

The Government shall evaluate the Contractor's performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable quality level.

4 Contractor-Furnished Items and Services The Contractor shall furnish, all facilities, equipment, and supplies required to perform the work under this contract that are not listed under Government-Furnished Property and Services.

4.1 Facilities

The Contractor shall furnish all off-site facilities to perform the services identified within this PWS.

4.2 Equipment

The Contractor shall furnish all equipment required to perform the services identified within the PWS.

4.3 Materials

The Contractor shall furnish all materials required to perform the services identified within the PWS.

4.4 Contractor Responsibilities

The Contractor shall only conduct business with designated Government personnel listed as points of contact (POCs). Names of authorized personnel shall be provided to the Contractor by the Government, in writing, and updated as necessary throughout the contract period of performance.

U.S. Government records, copies of original results and reports, verified original data, corrected data, and corrected supporting final reports which are maintained by the Contractor remain the property of the U.S. Government. These files/results must be surrendered to the COR.

4.5 Contractor Personnel

See HUDAR clause 2452.237-70 - Key Personnel in the Key Personnel section of the contract.

4.6 Identification of Contractor Employees

When conversing with Government personnel during business meetings, over the telephone, or via electronic mail, Contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees.

Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation.

5 Specific Tasks The RCSA Framework is a five-part dynamic and iterative-phased methodology which includes but is not limited to:

1. Project Work Plan (PWP) and Scope Assessment

2. Reviewing and Analyzing Procedural Documentation and Information Provided

3. Identifying and Assessing Risks; Examining Control Effectiveness

4. Analyzing Controls and Mitigation Strategies

5. Reporting Assessment Results, the Closure Meetings and Corrective Action Planning

5.1 Task One – Program Management

The Contractor shall provide program management support under this contract. This includes the management and oversight of all activities performed by contractor personnel, including subcontractors, to satisfy the requirements identified in this contract.

5.1.1 Program Management Plan

5.1.1.1 Project Work Plan

The Contractor shall develop and maintain, throughout the contract period of performance, a Project Work Plan (PWP) that shall be used as a foundation for information, scheduling, and resource management planning. The PWP is an evolutionary document that shall be updated monthly at a minimum, or as needed. The Contractor shall develop and submit an initial PWP for all PWS tasks including subsections for each of the Offices and Divisions identified for that year’s rotational review and assessment in accordance with the tasks and deliverables schedule. The Contractor shall deliver the initial PWP to the Government within seven (7) business days after the requirements contract award.

The Contractor shall update the initial PWP as needed throughout the year based on additional input and feedback from Ginnie Mae on the specific scheduling requirements. Given that the RCSA annual review has many dependencies on Ginnie Mae key stakeholders’ schedules and availability, that portion of the PWP and associated project schedule will be updated as needed throughout the annual RCSA review and assessment process. Provisions will be established to update the PWP at appropriate junctures, as directed by the COR/PM. The Contractor shall work from the latest Government-approved version of the PWP.

The Project Work Plan will identify information such as, but not limited to:

1. Purpose of the RCSA review and assessment

2. Scope of the RCSA review and assessment for Office-level Reviews, Process-Focus Reviews and Continuous Cybersecurity/Technology-related Monitoring

3. Assessment and evaluation methodology

4. Personnel and Level of Effort

5. Materials required

6. Key participants and roles and responsibilities

7. Performance criteria

8. Communication, project risk management and Quality Control

9. Project timelines and milestones for each task and subtask to include scheduling in an overall WBS with associated responsibilities.

The project timeline should identify each of the milestones to be accomplished to meet the requirements of the PWS. Each milestone will have a projected completion date, a summary of the required activities and identification of any input required from the Government. The project timelines and milestones should include the end-to-end RCSA process for completing the annual RCSA Assessment Report for each Office and the Assessment Report for the senior leadership:

a. Documentation Review and Analysis and Updating Flowcharts

b. Stakeholder Questionnaire

c. Assessing and Examining Effectiveness

d. Testing

e. Analysis and Implementation Strategies

f. Final Assessment Reports

At the end of the review period, the contractor shall provide the finalized PWP with all of the final completion dates for each deliverable.

Performance Standards

a. Standard: The Project Work Plan is accurate, kept up to date and accessible.

b. Standard: The Project Work Plan includes all significant activities and/or milestones related to each contract deliverable.

AQL: Zero deviation, unless discussed and agreed to by all parties.

Deliverables A001 Initial Project Work Plan

A002 Project Work Plan of the completed review period

5.1.1.2 Scope Assessment

To determine and appropriately size the RCSA review and assessment, the Contractor will support Ginnie Mae staff to assess known risks and controls for each Office/Division, in-scope business processes, and key metrics to be monitored.

1. All eight (8) Offices within Ginnie Mae will undergo review annually

2. Several Offices and Divisions will participate in a more in-depth review of in-scope processes. The contractor will assess the functions and processes within scope to understand each process and conduct the review.

3. Continuous Cybersecurity/Technology-related Monitoring scope will include but not be limited to inherent risk, control design and operating effectiveness, and residual risk against the organization’s defined cyber risk appetite. It will include internal systems, key third-party services, and relevant end-user processes, focusing on confidentiality, integrity, and availability impacts over 12 months.

The Contractor will review policies, procedures, control evidence, incidents, and metrics to validate control performance and identify gaps, assumptions, and dependencies, providing documented findings and recommendations for remediation and risk treatment decisions.

Performance Standards

c. Standard: Scope assessments are thorough, accurate and contain all required information, and completed within specified deadlines in accordance with the PWP.

d. Standard: Product conforms to established requirements with minimal revisions for spelling and grammatical changes.

AQL: Zero deviation from standard Deliverables A003 Scope Assessment and Plans, including all data and/or information required to recreate and/or modify deliverables for eight (8) offices (OIPM, OER, OEDTS, OCM, OMO, OSO, OCFO, and OOTP) and for Processes within the review scope.

5.1.2 Weekly Contract Status Meetings & Reports

The COR/PM will meet weekly with the Contractor to review engagement status, contract requirements, contractor performance, etc.

The Contractor shall inform the COR of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. The Contractor shall provide the COR/PM minutes of these meetings, including attendance, issues discussed, decisions made, and action items assigned, within two (2) business days following the meeting.

By the first day of each work week, the Contractor PM shall develop and provide a Weekly Status Report using Microsoft Office Suite applications to the COR/PM. The Weekly Status Report shall include, at a minimum:

1. Activities during reporting period, by task (on-going activities, new activities, activities completed; progress to date on all above-mentioned activities).

2. Problems, risks, issues, and corrective actions taken or proposed resolutions to address them.

3. Personnel gains, losses, and status (security clearance, etc.).

4. Government actions required.

5. Schedule (show major tasks, milestones, and deliverables; planned and actual start and completion dates for each).

6. Accumulated invoiced cost for each CLIN up to the previous month.

7. Projected cost of each CLIN for the current month.

Additionally, the COR/PM and other Government personnel, as appropriate, may meet periodically with the Contractor as needed to discuss ad hoc reports, special projects, and other matters that may arise. These meetings shall be at no additional cost to the Government.

Performance Standards

e. Standard: The Weekly Contract Status Reports and Minutes are completed and delivered in accordance with the PWP.

f. Standard: The Weekly Contract Status Reports and Minutes are accurate and up to date as well as actionable, when necessary.

AQL: Zero deviation, unless discussed and agreed to by all parties.

Deliverables A004 Weekly Contract Status Reports and Meeting minutes

5.2 Task Two – RCSA Execution (Office / Division Reviews)

The Contractor shall participate in risk identification, risk assessments, gap analysis, ratings, assessment report preparation, and assess the first line of defense for office level using the assessment and evaluation methodology stated in RCSA procedures (e.g., tools and template document) for performing risk assessments.

5.2.1 Documentation and Information

5.2.1.1 Documentation and Information Gathering

5.2.1.1.1 Documentation / Information

The Contractor shall receive, review, and analyze governance documentation for all eight (8) Offices and the respective divisions, such as but not limited to policies, Standard Operating Procedures (SOPs), management / oversight reporting, and application and infrastructure materials. If additional documentation is identified during the review, the contractor shall request documentation to further the analysis. The Contractor shall leverage and incorporate this documentation in the review process.

The review should also incorporate any findings and information from other resources, including but not limited to the OMB A-123 review, the U.S. Government Accountability Office (GAO), OMB, Office of Inspector General (OIG), and Operational Incidents that have occurred since the last RCSA Assessment.

5.2.1.1.2 Stakeholder Questionnaires and Interviews

The Contractor will participate in an initial interview between the COR and stakeholders for each office and for each process being reviewed. The Contractor shall assist in the development of initial interview questionnaires based on available materials and stakeholder information provided previously. The Contractor will assist in initial discussions with Office/Division leadership and Subject Matter Experts (SME) as required by the COR/PM. During the meeting, the Contractor will take detailed notes on the Stakeholder’s responses to the questionnaire to be used in further analysis of Offices and Processes. The Contractor will produce and provide detailed meeting minutes to the COR/PM or designee within three (3) business days of the interview and/or business process review.

Performance Standards

g. Standard: Questionnaires used in Office-level reviews are populated by contractors during Office initial interviews, are accurate, contain all provided information and are delivered with the Initial interview meeting minutes within 5 days of the initial interview in accordance with the PWP.

h. Standard: Product conforms to established requirements with minimal revisions for spelling and grammatical changes.

AQL: Zero deviation, unless discussed and agreed to by all parties.

Deliverables A005 Information gathering for eight (8) offices (OIPM, OER, OEDTS, OCM, OMO, OSO, OCFO, and OOTP, including all data and/or information gathered in its entirety.

A006 Updated Governance Documentation (charters, policies, SOPs)

A007 Updated Process Inventory

A008 Interview questionnaires and meeting minutes with detailed stakeholder responses and information.

5.2.1.2 Document Business Processes

The Contractor must have a thorough understanding of the Offices’ business processes and controls (i.e., manual and automated, key and non-key) which are required as the basis for the RCSA. To meet these requirements, the Contractor shall update the business process hierarchies and flowcharts by capturing information for business processes, policies, SOPs, and information technology (IT) systems. The Contractor shall:

1. Analyze materials to identify key controls, control descriptions, control evidentiary material, IT systems, control ownership role, process hand-offs and control gaps, as well as tracking any known corrective actions for mitigating risks to Ginnie Mae.

2. Update or create flowcharts of current or new business processes

3. Review and update Risk Register Controls Matrices (RRCMs) including but not limited to risk descriptions, risk rating, risk impact, probability of occurrence, inherent and residual risk scores, KRIs, Risk Taxonomy, and identify risk universe for all Offices

a. Business Process Descriptions

b. Risk Description / Definition

c. Associated Risks and Controls

d. Control Description or, if there is no control, Gap Description in addition to control details including:

i. Key or Non-Key,

ii. Preventive or Detective,

iii. Manual or Automated,

iv. Risk/Control Owner,

v. IT system(s) associated with control,

vi. Control evidential matter/test criteria.

4. Inherent & Residual Risk Ratings

Performance Standards

i. Standard: Business process flowcharts, narratives and risk register control matrices, and associated activities, are accurate, contain all required information, and completed in accordance with the PWP.

j. Standard: Product conforms to established requirements with minimal revisions for spelling and grammatical changes.

AQL: Zero deviation, unless discussed and agreed to by all parties.

Deliverables A009 Business Process Flowcharts / Narratives, including all data and/or information required to recreate and/or modify deliverables in their entirety, for eight (8) offices (OIPM, OSO, OEDTS, OCM, OMO, OER, OCFO, and OOTP).

A010 Risk Register Control Matrices (RRCMs), including all data and/or information required to fully measure and assess the inherent and residual risks across Ginnie Mae for eight (8) offices (OIPM, OSO, OEDTS, OCM, OMO, OER, OCFO, and OOTP).

5.2.2 Assessment and Analysis

5.2.2.1 Assess Risks and Examine Effectiveness of Controls

The Contractor shall perform risk identification, risk assessments, gap analysis, risk ratings, assessment reporting, and propose recommendations for remediation of control deficiencies, gaps and areas of significant risk to the organization. Any recommendations provided should be well defined, provide adequate reasoning, identify the appropriate stakeholder, and prioritize the recommended remediation and risk.

The Contractor shall use the assessment and evaluation methodology stated in RCSA procedures (e.g., tools and template document) for performing risk assessments and as directed. The documented assessment and evaluation methodology, process, and Assessment Plans must be approved by COR/PM or designee prior to any assessments being performed. The Contractor shall utilize quantitative and qualitative techniques and measures to assess impact and document results and risk impacts.

The Contractor will review one to three Offices each quarter based on established PWP. Reviews must be completed no later than the end of the third quarter of the contract period.

The Contractor shall:

1. Utilize quantitative and qualitative techniques and measures to assess impact and document results and risk impacts.

2. Analyze risks and controls and make recommendations to mitigate identified gaps / risks.

3. Prepare Risk Assessment and Evaluation Report for each Office. Report should highlight key people, processes, technology of the Office as well as risks, gaps, and opportunities for improvement. Report shall be documented in Microsoft Word. The Contractor shall submit the report to COR/PM for review and make updates as required.

4. Prepare Executive Report of Risk Assessment and Evaluation for each Office which summarize Office level assessment that shall be shared with senior leadership. Report shall be documented in Microsoft PowerPoint.

The Office-level review currently does not require the Test of Design (ToD) or Test of Effectiveness (ToE) of identified controls except under limited circumstances where a prior control failure or gap has been identified and testing is requested.

Performance Standards

k. Standards Office and Executive Risk Assessment and Evaluation Reports and Presentations, and associated activities, are accurate, contain all required information, and completed in accordance with the PWP.

l. Standards Product conforms to established requirements with minimal revisions for spelling and grammatical changes.

AQL: Zero deviation, unless discussed and agreed to by all parties.

Deliverables A011 Office Risk Assessment and Evaluation Report and Presentation for each Office.

A012 Executive Risk Assessment and Evaluation Report and Presentation.

A013 Office-level Testing Assessment, test materials, PBCs and responses and Testing results including all data and/or information required to recreate and/or modify deliverables as needed.

A014 Inventory of current Governance Documentation, Business Processes, and Flow Chart

A015 Inventory of Identified Gaps / Opportunities for Process Improvement and Recommended Corrective or Other Actions

5.2.2.2 Office-level Review Exit Conference

The Contractor shall participate in Office-level review exit conference with the COR and stakeholders. The Contractor shall support the presentation of the Office-level Risk Assessment and Evaluation Reports to Stakeholders. During this meeting, the Stakeholders will have the opportunity to provide responses. The Contractor will make notes of those comments and make updates/corrections to the Reports. These meetings occur throughout the review year, with office reviews staggered with up to three (3) offices being reviewed in a quarter. Each office-level exit conference shall be held within 30 days of the Office level review being completed.

Performance Standards

m. Standard: Office-level Exit Conference Minutes are completed and delivered in accordance with the PWP.

n. Standard: Office-level Exit Conference Minutes are accurate and utilized to finalize its respective Risk Assessment and Evaluation Report with minimal revisions for spelling and grammatical changes.

AQL: Zero deviation from standard Deliverables A016 - RCSA Office-level Review Exit Conference Minutes for eight (8) offices (OIPM, OER, OEDTS, OCM, OMO, OSO, OCFO, and OOTP) and for Processes within the review scope

5.3 Task Three – Process Level Reviews

5.3.1 Documentation / Information Gathering

During each one-year review period, Contractor shall assess several primary/significant functional areas and related processes. The processes in-scope for review will be determined annually with the objective of achieving a full review of all Office/Division significant functions/processes over the course of three years. For example, reviews may involve up to 50 processes and subprocesses. The number of processes in scope for a given period will depend on the risk and complexity of current processes. The number of controls in scope for testing will vary. The list of functional areas and the review rotation are subject to update by the COR/PM.

The Process-Level review must utilize the Office-level review process documentation and analysis as the starting point to eliminate redundancies to the extent possible. The Process-Level reviews will be more in-depth reviews of the functions and processes that are within scope and could span multiple Offices/Divisions, including any information technology and/or security aspects.

1. Contractor shall prepare:

a. For process walkthroughs with stakeholders,

b. Process level flow charts,

c. Questionnaire for process-level walkthroughs, and

d. Initial list of PBC documentation for testing key controls.

2. Contractor shall participate in process level walk-through and take detailed notes. Following walk-through, Contractor will send out meeting minutes to the COR/PM or designee within three (3) business days of the business process walk-through. Contractor will also update process flow documentation and Risk Register Control Matrices (RRCM) based on walk-throughs.

Performance Standards

o. Standard: Questionnaires, forms and documents used in Process-level reviews are populated by contractors during Process-level walkthrough meetings, are accurate, contain all provided information and are delivered with the walkthrough meeting minutes within 5 days of the walkthrough in accordance with the PWP.

p. Standard: Product conforms to established requirements with minimal revisions for spelling and grammatical changes.

AQL: Zero deviation from standard Deliverables A017 Process-Level discussion questionnaires, Process questionnaire forms and templates for processes that are within review scope

A018 Detailed meeting minutes from Process-Level discussions and walkthroughs with Stakeholders.

5.3.2 Process-level Control Testing

The Contractor shall assist with independently analyzing and assessing the design and operating effectiveness of controls in place to mitigate risks in place for in-scope processes. Control testing should be evidence-based, consistent with RCSA methodology, fully documented, and where applicable include recommendations aligned to Ginnie Mae’s risk appetite and policies.

The Contractor shall:

1. Based on updated RRCM and walk-through, controls to be tested will be determined. Contractor shall prepare and send out control confirmation forms to appropriate stakeholders to confirm control language prior to testing.

2. Following confirmation of controls, Contractor will prepare and send PBC documentation request to perform testing.

3. Perform ToD testing primarily of identified key controls using quantitative and qualitative techniques. Test of Effectiveness (ToE) may be performed based on identified potential gaps in controls or depending on changes to processes/controls. As part of testing, Contractor shall:

a. Evaluate the control design for alignment to risk, placement in the process, frequency, ownership, and evidence of execution.

b. Evaluate control operating effectiveness using available evidence (logs, tickets, approvals, alerts, test results, incident history).

c. Assess mitigation strategies for coverage, depth, and redundancy.

d. Analyze control and mitigation coverage for single points of failure, control gaps, and over-reliance on compensating controls.

e. Provide strategies and recommendations to mitigate and/or eliminate control weaknesses and significant risks and recommendations for remediation.

4. Prepare Process Risk Assessment and Evaluation Report and submit to COR/PM for review and make updates as required. Report should include at minimum:

a. Overview of process

b. Key stakeholders including counterparties and third-party vendors involved in process

c. Technology utilized or relied upon for process

d. Risks and control gaps identified

e. Recommended process improvement opportunities identified

Performance Standards

q. Standard: Flowcharts, risk register control matrices, and narratives that pertain to Process-level reviews that are within scope are updated in accordance with the PWP.

r. Standard: Testing documentation and related work papers are developed and completed in accordance with the PWP and test results are analyzed with final results, analysis and deficiencies added to the respective risk register control matrices.

s. Standard: Process-level Risk Assessment and Evaluation Reports and Presentations, and associated activities, are accurate, contain all required information, and completed in accordance with the PWP.

t. Standard: Product conforms to established requirements with minimal revisions for spelling and grammatical changes.

AQL: Zero deviation from standard Deliverables A019 Updated process flow charts / narratives

A020 Updated Risk Register Control Matrices (RRCM)

A021 Test of Design (TOD) and Test of Effectiveness (TOE), where applicable, including associated workpapers.

A022 Process-level Assessment and Evaluation Reports and presentations

5.3.3 Process-level Review Exit Conference

The Contractor shall participate in process-level review exit conference with the COR and stakeholders. The Contractor shall support the presentation of the Process-level Risk Assessment and Evaluation Reports to Stakeholders. During the exit conference, the Stakeholders will have the opportunity to provide responses. The Contractor will make notes of those comments and make updates/corrections to the Reports. Exit conferences occur at the end of the review of each process within scope for assessment. The end of a process review may occur at any time during the year. The process-level review exit conferences shall be held within 30 days of the review being completed.

Performance Standards

u. Standard: Process-level Exit Conference Minutes are completed and delivered in accordance with the PWP.

v. Standard: Process-level Exit Conference Minutes are accurate and utilized to finalize its respective Risk Assessment and Evaluation Report with minimal revisions for spelling and grammatical changes.

AQL: Zero deviation, unless discussed and agreed to by all parties.

Deliverables A023 RCSA Process-level Review Exit Conference Minutes from meeting with Stakeholders participating in Processes within the review scope.

5.4 Task Four – RCSA Annual Maintenance

5.4.1 RCSA Tools, Questionnaires, and Templates

In preparation of each contract year, the Contractor shall update RCSA templates including but not limited to Risk Registers, appendices, process narratives, questionnaires, assessment and evaluation reports template. Contractor may also provide recommendations for tools, questionnaires and templates. All such recommendations should be documented and provided to COR/PM. Comment by Terreault, Brenda J: Some of these are part of the review process. Some of these may be ERM’s The Contractor shall also provide support for RCSA activities including reports, automation, Operational Incidents, and other activities as it pertains to the overall maturity of Ginnie Mae’s RCSA Program.

The Contractor may identify and develop improvements and efficiencies to/for the RCSA Program. Any improvements/efficiencies identified by the contractor shall be presented and approved by the COR/PM before being accepted and acted upon.

Performance Standards

w. Standard: All tools, templates and questionnaires are updated within 30 days of the start of the review period.

x. Standard: All tools, templates and questionnaires conform to established requirements with minimal revisions for spelling and grammatical changes.

AQL: Zero deviation from standard Deliverables A024 RCSA Tools, Questionnaires, and Templates. Include all data and/or information, if any, required to recreate and/or modify deliverables in their entirety, without contractor assistance.

5.4.2 Updating RCSA Governance Documents

The Contractor shall provide on COR’s request recommended updates to Ginnie Mae’s RCSA governance documents (policy, procedures, flowcharts, RACI, etc.) annually. Currently Ginnie Mae RCSA has one (1) SOP and one (1) Policy related to these tasks.

y. Standard: RCSA governance documentation is updated as needed within specified deadlines, are accurate, contain all required information, and conforms to established requirements with minimal revisions for spelling and grammatical changes.

AQL: Zero deviation from standard Deliverables A025 RCSA Policy and SOP

5.4.3 Corrective Action Plans

As instructed by COR/PM, the Contractor shall assist ORAD in the development, preparation, and update of RCSA monitoring and tracking of Corrective Actions, mitigation plans, and related activities for the eight (8) Offices and their respective Divisions. This may include conducting interviews, preparing, and evaluating corrective action plans, preparing questionnaires, updating the RCSA risk rating scores templates, and any Follow-up Reviews and Reports, as needed and requested.

Performance Standards

z. Standard: Corrective Action and Mitigation Plans are prepared and maintained in a way that assists and adds value to risk owner.

aa. Standard: Corrective Action and Mitigation Plans, and associated activities, are prepared in accordance with the PWP.

AQL: Zero deviation, unless discussed and agreed to by all parties.

Deliverables A026 Monitoring and Tracking Reports of Corrective Actions and Mitigation Plans, as needed for eight (8) offices (OIPM, OER, OEDTS, OCM, OMO, OSO, OCFO, and OOTP), which may include all data and/or information required to recreate and/or modify deliverables in their entirety.

5.4.4 RCSA Consolidated Risk Register

Once annual reviews are completed and the RRCMs reflect all updated information for each Division, the Division RRCMs will be consolidated into one RRCM. This Consolidated Risk Register has a defined format that the Contractor must maintain to ensure that the document is accurate and able to be utilized. The contractor shall submit the consolidated risk register via email to the COR within 30 days of the completion of all reviews or before the review year for which it was created, whichever comes first.

Performance Standards

ab. Standard: The Consolidated Risk Register Control Matrix comprehensively integrates risk information from internal and external sources timely and routinely.

ac. Standard: The Consolidated Risk Register Control Matrix includes all data and/or information required to re-create and/or modify deliverables, without contractor assistance.

AQL: Zero deviation, unless discussed and agreed to by all parties.

Deliverables A027 Consolidated Risk Register Control Matrix

5.5…