Draft Statement of Obj_SOOMaster Subservicing IDIQ.pdf

Statement of Objectives (SOO)

Master Subservicing Support Services

Multiple Award Indefinite Delivery Indefinite Quantity (MA-IDIQ) Contract

Solicitation # TBD

Contents

1. Purpose/ Objective

2. Background

3. Scope

4. Tasks/Performance Objectives

4.1 Pool 1: Single Family Master Subservicing

4.2 Pool 2: Multi-Family Master Subservicing (Optional LIN)

4.3 Pool 3: Manufactured Housing Master Subservicing (Optional LIN)

5. Operating constraints

6. Place of Performance

7. Period of Performance

8. Deliverables/delivery schedule

9. Security

10. Government Furnished Information (GFI)/ Government Furnished Property (GFP)

11. Packaging, packing, and shipping instructions

12. Key Personnel

June 2025

Statement of Objectives – Master Subservicing IDIQ

1. Purpose/ Objective

The Government National Mortgage Association (Ginnie Mae) seeks to obtain qualified contractors that can provide Master Subservicer Loan support services for the Single Family, Multi-Family, and

Manufactured Housing portfolios. Services should include servicing Ginnie Mae loans from terminated

Issuers and providing support services to Ginnie Mae in terminating Issuers from Ginnie Mae’s MBS program and extinguishing their interests in the pools of mortgages backing MBS.

Single Family

Single-family homes offer privacy and long-term appreciation but may have limited rental income potential.

• Examples: A detached house on its own lot.

Multi-Family

Multi-family properties, like apartments or duplexes, generate rental income from multiple units, offering higher income potential but potentially less privacy.

• Examples: Apartment buildings, hospitals, and residential care facilities such as nursing homes, assisted-living facilities, and board and care facilities

Manufactured Housing

Manufactured homes are built in factories and transported to the site, offering affordability and flexibility, but may have different financing options and community rules.

• Examples: A mobile home or modular home.

2. Background

An Issuer termination occurs when an Issuer violates the requirements of the Guaranty Agreements between the Issuer and Ginnie Mae, the form of which is set out in the Ginnie Mae Guide 5500.3 https://www.ginniemae.gov/Issuers/program_guidelines/Pages/mbs_guide.aspx. Upon the determination to terminate the Issuer for the program, Ginnie Mae may remove its Issuer active status and require its

Contractor to seize its active pooled portfolio and the corresponding loan and transaction-level data and documentation. The Contractor shall transfer the pools and underlying loans to the Contractors servicing system, service them in accordance with the respective agency guidance, submit operational and financial reporting to Ginnie Mae and/or sell/transfer them under the terms set forth by Ginnie Mae.

A termination may also occur when an Issuer asks to have its Issuer status removed or if Ginnie Mae enters into a third-party purchase and sales agreement wherein Ginnie Mae must repurchase/transfer loans after the fact but in conjunction with an Issuer termination. This would be considered a termination and non-seizure where the termination occurred, but no loans were immediately seized.

There may be the termination of one or more of our large Issuers (i.e., 400,000+ loans) and the Contractor may be required to retain staff, systems, and facilities at the terminated Issuers location(s) for a period to orderly transfer the pools. Additionally, there may be occasions where the Contractor may need to be onsite at multiple subservicer locations to exercise a seizure where the terminated Issuer utilizes component servicing. This includes being onsite at one or more terminated Issuer Document Custodian sites and/or locations where origination/credit files may be stored.

There may be occasions, at Ginnie Mae's discretion, the Contractor will be required to perform special services on a select group of loans. The loans may be delinquent and/or in various stages of default or have specific and outside of the normal servicing agency reporting requirements. The Contractor may need to provide enhanced services for collection and loss mitigation functions. Additionally, there may be occasions where, at Ginnie Mae’s discretion, we will terminate and not seize a portfolio but will require the Contractor to provide oversight and consultative services to effectuate an orderly transfer.

Ginnie Mae holds a terminated and seized HECM portfolio totaling approximately $18 billion. To date, there has been one (1) termination and seizure of $20 billion. The future level of termination and seizure activity is uncertain and dependent upon various Issuer, program, and economic factors. In difficult economic times, Ginnie Mae must be prepared to handle a large volume of termination and seizures to ensure it can fulfill its guaranteed obligations. There are periods where the Contractor will be called upon to effectuate the seizure of multiple Issuers in a single year and there are occasions where a seizure may not happen for many months.

Ginnie Mae plays a vital role by guaranteeing pools of loans that are federally insured or guaranteed by the Federal Housing Administration (FHA) and/or the U.S. Department of Agriculture (USDA) Rural

Development Program (RD). Through this program, holders of Mortgage-Backed Securities (MBS) receive a monthly “pass-through” of Principal and Interest (P&I) payments made by borrowers on the mortgages backing the securities, minus amounts to cover servicing fees and Ginnie Mae guarantee fees.

Ginnie Mae guarantees the registered holders of these securities the timely payments of scheduled monthly P&I payments, loan prepayments, and early recoveries of principal on the underlying mortgages.

If borrowers fail to make timely payments, Issuers are required to use their own resources to ensure the payments are made to the registered holders.

Through its MBS program, Ginnie Mae creates a pathway for channeling global capital into the nation’s housing market. The full faith and credit guarantee provided by Ginnie Mae makes these securities widely accepted in capital markets, ensuring that funds are available to finance the mortgage market. The funds raised from the sale of these securities are then used by lenders to fund new mortgage loans. This process increases the overall availability of credit for loans and helps ensure that loans are provided at a reasonable interest rate.

By guaranteeing MBS, Ginnie Mae supports its mission of fostering affordable housing and promoting stable communities. A key element of this mission is facilitating the construction and renovations which include apartment buildings, hospitals, nursing homes, assisted-living facilities, and other essential housing options. By backing MBS that are sold to investors in the global capital markets, Ginnie Mae enables lenders to offer lower mortgage interest rates to borrowers contributing to the growth of the affordable housing sector.

3. Scope

The Government National Mortgage Association (Ginnie Mae) seeks to obtain qualified contractors with demonstrated experience and the necessary management capabilities to effectively service pools of loans obtained from Issuers whose portfolios have been subject to Termination, Extinguishment, and Seizure

(T/E/S) under the MBS program. The contractor will be responsible for ensuring the proper servicing of these loan pools (i.e., Single Family, Multi-Family, and/or Manufactured Housing), in compliance with

Ginnie Mae’s policies and guidelines.

Additionally, the contractor will be responsible for loan servicing (current and delinquent loans); pooled and non-pooled reporting; loss mitigation services; bankruptcy and foreclosure services; management and disposition of acquired properties; and preparation/submission of insurance or guarantee claims. There will be an emphasis on supporting Ginnie Mae in its annual Financial Statement audits where data, documentation and support will be required.

The following are the titles of Pools & Task Areas:

Pool 1: Single Family Master Subservicing

• Task Area 1: Program Management

• Task Area 2: Issuer Services

• Task Area 3: T/E/S Support Services

• Task Area 4: Loan Servicing

• Task Area 5: Forward Mortgage Operations

• Task Area 6: Reverse Mortgage Operations

• Task Area 7: Property Preservation

• Task Area 8: Legal Services

• Task Area 9: Analytical & Research Services

• Task Area 10: Asset Sale & Securitization Support Services

• Task Area 11: Transition-In

• Task Area 12: Transition-Out

Pool 2: Multi-Family Master Subservicing (Optional T&M LIN)

• Task Area 2: T/E/S Support Services

• Task Area 3: Servicing

• Task Area 4: Asset Management

• Task Area 5: Asset Sales/ Portfolio Transfers/ Rapid Relocation Support

• Task Area 6: Reporting & Research

• Task Area 7: Legal Services

• Task Area 8: Transition-Out

Pool 3: Manufactured Housing Master Subservicing (Optional T&M LIN)

• Task Area 2: T/E/S Support Services

• Task Area 3: Servicing

• Task Area 4: Asset Management

• Task Area 5: Asset Sales/ Portfolio Transfers/ Rapid Relocation Support

• Task Area 6: Reporting & Research

• Task Area 7: Legal Services

• Task Area 8: Transition-Out

4. Tasks/Performance Objectives

The contract holder (CH) will use the required performance objectives listed below to determine the best solution to accomplish the objectives and will provide their solutions in the form of a detailed SOW or

PWS in response to task order request instructions. State any deliverables, e.g., non-disclosure forms, progress reports, quality assurance surveillance plan (QASP) – is used by the government’s official to monitor the quality of the contractor’s performance. A draft QASP may be submitted in response to the

SOO, which can be finalized through discussion or soon after contract award and government acceptance.

The government is pursuing three broad objectives for this assessment:

4.1 Pool 1: Single Family Master Subservicing

Note: Ginnie Mae shall reimburse the Contractor for all filing and recording costs incurred pursuant to the assignment of the loan.

4.1.1 Program Management

The contractor shall provide program management support under this requirement. This includes the management and oversight of all activities performed by contractor personnel, including subcontractors, to satisfy the requirements identified in this Statement of Objectives (SOO). The contractor shall identify a Program Manager (PM) by name who shall provide management, direction, administration, quality assurance, and leadership of the execution of all subsequent task orders as a result of this SOO.

4.1.1.1 Coordinate a Project Kick-Off Meeting

The contractor shall schedule and coordinate a Project Kick-Off Meeting at the location approved by the

Government. The meeting will provide an introduction between the contractor personnel and

Government personnel who will be involved with the TO. The meeting will provide the opportunity to discuss technical, management, and security issues, and travel authorization and reporting procedures. At a minimum, the attendees shall include Key Contractor Personnel, representatives from the directorates, other relevant Government personnel, and the COR. The contractor shall provide the following at the

Kick-Off meeting:

a. Transition-In Plan (if applicable)

b. Project Management Plan

c. Draf Quality Control Plan (QCP)

4.1.1.2 Project Management Plan (PMP)

The contractor shall document all support requirements in a PMP. The PMP shall:

a. Describe the proposed management approach.

b. Contain detailed Standard Operating Procedures (SOPs) for all tasks.

c. Include milestones, tasks, and subtasks required by the task order(s) as a result of this

IDIQ.

d. Provide for an overall Work Breakdown Structure (WBS) and associated responsibilities and partnerships between Government organizations.

e. Include the contractor’s Quality Control Plan (QCP).

The contractor shall provide the Government with a draft PMP on which the Government will make comments, 30 calendar days after the award of the task order, or next business day if 30th falls on a weekend or holiday. Upon receipt of the Governments comments, the contractor shall provide a final

PMP 30 calendar days after receipt of comments. The final PMP shall incorporate the Government’s comments.

The PMP is an evolutionary document that shall be updated annually at a minimum. The contractor shall work from the latest Government-approved version of the PMP.

4.1.1.3 Contract Quality Control Plan (QCP)

The Contractor shall submit a Contract QCP within thirty (30) days after the award of the contract that will outline and detail how the Contractor shall comply with the contract requirements and the underlying deliverables. This plan shall be updated in the event a Key Personnel, a critical Contractor process, a

Subcontractor changes or major system change occurs within thirty (30) days.

The Contractor shall develop, maintain, enforce, and document a Quality Control Plan (QCP). The QCP shall ensure the Government receives a level of quality that is consistent with the requirements specified in this contract. The QCP shall be sufficiently detailed to provide the Contractor's methodology for identifying and recruiting qualified personnel. The QCP shall also provide the Contractor's methodology for resolving problems identified by the Government during reviews conducted in accordance with its

Quality Assurance Surveillance Plan (QASP).

The QCP shall also provide the Contractor's methodology for establishing an internal feedback system for support personnel and for resolving problems identified by that feedback system.

The QCP shall demonstrate and validate that the services or deliverables to be provided under the contract are completed with a level of quality that meets the minimum performance threshold established in the

Government's QASP. The QCP shall address Quality Management Approach, Quality Assurance, Quality

Control, and Quality Standards.

Deliverable(s)

A00X Contract Quality Control Plan

Performance Standard(s)

1. Standard: Contract Quality Control Plan 30 calendar days after the award of the contract, or next business day if 30th falls on a weekend or holiday.

AQL: Zero Deviation

4.1.1.4 Meetings

The Contractor shall participate in at least three (3) status meetings per year onsite at the Contractor's place of business(es), at Ginnie Mae's headquarters, or at another neutral site as directed or agreed to by the COR. This includes meetings with any of the Contractor's partners and/or Subcontractors. The exceptions to this will include meetings with OIG, the GAO, OIG Audit Contractor(s) or additional meetings as required by Ginnie Mae to oversee the Contractors’ vendor management or operational effectiveness. Additional exceptions being due to acts of God, pandemics or State or Federal Government declared emergencies.

4.1.1.5 COR Information Access

The Contractor shall provide 24-hour/seven (7) day a week access (excluding maintenance downtime) to the COR and their assigned designee(s) to view transactional and loan-level data for any loan that the

Contractor is servicing on Ginnie Mae's behalf. The Contractor shall also work to establish this access with the COR/ISSO/CISO in the event there may be HUD or Contractor Information Technology (IT) firewall issue that needs to be overcome. If the Contractor is going to update their security protocols that may affect Ginnie Mae's access, the Contractor shall contact the COR and ISSO/CISO so that any impacts to access can be understood and mitigated. The Contractor shall work with Ginnie Mae to effectuate the re-establishment of any access that may have been lost/removed/severed. The Contractor shall begin to establish the access no later than thirty (30) days after contract is awarded.

• Loan servicing system - Read only access

• Document repository system - Read/Download access

• Any wraparound servicing system access

4.1.1.6 Freedom of Information Act (FOIA)

Upon request of the COR, the Contractor shall provide all information required for completion of

Freedom of Information Act (FOIA) requests. The response due date will be established at the time of

COR request.

4.1.1.7 Continuous Monitoring

For the duration of the contract, the Contractor will support and participate in the following activities to support continuous monitoring and validate the state of readiness and compliance:

1. Information security monitoring:

a. Annual or emergent security audits and security scans that may be performed by the

Office of Inspector General (OIG), the General Accountability Office (GAO), or the

Department of Homeland Security (DHS).

b. Provide system and/or vulnerability-related information to the Information Security Team

(or their delegate/designee) in order to: 1) Review audit findings; 2) Determine if corrective actions were properly implemented and the associated audit findings were properly closed; 3) respond to audits; 4.) Support cybersecurity incident analysis and forensics activities.

c. Produce scheduled Monthly/Quarterly/Annual security performance measure reports that align to Ginnie Mae’s reporting requirements specified by OMB for FISMA, the

Presidents cybersecurity Cross Agency Priority (CAP) goals and targets, and CyberScope reporting.

d. Identify, perform, track, and report vulnerability and security weakness remediation and mitigation activities through the Plan of Action and Milestones (POA&M) process.

2. Documentation revalidation:

a. Prepare and present an annual Security Self-Assessment Report to the Information

Security (INFOSEC) Office team.

b. Review and update of all security authorization documentation on a quarterly basis to reflect system or administrative changes.

Deliverable(s)

A00X Security Self-Assessment Report

4.1.1.8 Continuity of Operations Plan (COOP)

The Contractor shall create and submit a Continuity of Operations Plan in accordance with Executive

Order 12656 of February 1996, the Computer Security Act of 1987 and OMB Circular A-130 mandate that COOP exists for all U.S. Government operations. The COOP shall be due 120 days from the contract award date and updated annually thereafter.

The Contractor shall Provide Ginnie Mae with its detailed COOP plan that outlines the steps and communication strategy necessary to ensure that all essential business functions under the contract proceed during a COOP event.

The Contractor shall maintain the COOP capability as defined by Federal Preparedness Circular 65 issued

June 2004, and all other applicable laws and directives issued by Homeland Security and other federal mandates.

The Contractor shall maintain peripherals and deliverables in accordance with Presidential Policy

Directive 40 (PPD-40), Federal Continuity Directives 1 and 2 (FCD), National Institute of Standards and

Technology (NIST) and 800-34, 800-53, and 800-161.

The Contractor shall within 120 calendar days of contract award date, in conjunction with the client, analyze and determine what Contractor systems and operations support the Ginnie Mae Mission Essential

Function(s) (MEF), Essential Supporting Activity(ies) (ESA), and Essential Supporting Task(s) (EST).

The systems identified must meet or exceed the minimum Maximum Tolerable Downtime (MTD) /

Recovery Time Objective (RTO) requirement noted in the most recent Business Process Analysis /

Business Impact Analysis housed at Ginnie Mae and as determined by the methodology detailed in

Federal Continuity Directive (FCD)-2.

Within 120 calendar days of contract award date, for all systems and operations providing support to the

Ginnie Mae Mission Essential Function(s) (MEF)/ Essential Supporting Activity(ies) (ESA), provide all relevant information system documentation to include, but not limited to, a COOP Plan, Information

Systems Contingency Plans (ISCP), SOPs, and Point of Contact (POC).

The Contractor shall maintain required documentation, essential records and systems that support the

Ginnie Mae MEF/ESA.

If a COOP event occurs, the Contractor shall:

• Resume business functions within four (4) hours of the event unless specified otherwise in the

MEF/ESA operations within the MTD/RTO of each system identified supporting Ginnie Mae

MEF/ESA.

• Ensure that primary and alternate personnel maintaining and/or operating Ginnie Mae MEF/ESA support systems are available as "essential personnel” during an event that requires continuity support operations, for a minimum planning requirement of 30 calendar days, or longer as required by the definition of "extended operations.

o Essential Personnel: defined as faculty and staff who are required to report to their designated work location, to ensure the operation of essential functions or departments during an emergency or when normal operations have been suspended.

o Extended Operations: Operations that go beyond the 30-calendar day minimum planning and generally involve the coordination and management of personnel and resources to mitigate an emergency and facilitate the transition to reconstitution operations.

The Contractor shall segregate and separately identify all costs incurred in continuing performance of essential services in a crisis. Requests for equitable adjustments will be handled in accordance with the applicable Changes clause(s).

The Contractor shall provide POC information for the emergency notification service (ENS) database and other client-based contact rosters (such as an office specific "call tree) related to emergency planning/notification. The Ginnie Mae COOP has created a Devolution Team in Q1 of 2024. The

Contractor will need to offer some resources to participate on this Disaster Emergency Response Group

(DERG) Team in case of an emergency event. The responsibilities will include participating in up to 3

COOP Trainings, Exercises and other COOP events during the year. In addition, Ginnie Mae has procured its own Emergency Notification System, and the Contractor will need to respond to these emergency tests sent out by the Ginnie Mae COOP monthly.

The Contractor shall review, revise, and update all Ginnie Mae MEF/ESA support system documentation on an annual basis. For example, SOPs, plans and policies.

The Contractor shall participate in a maximum of five (5) training and/or exercise events per contract year to include at least one exercise event. The required exercise event is participation in the annual National

Level Exercise/Eagle Horizon that specifically focuses on COOP operations and capabilities.

The Contractor shall report any real-world incidents/events that affect systems supporting Ginnie Mae

MEF/ESA to the CO within MTD/RTO requirements and/or no later than 24 hours of incident.

The Contractor shall provide an after-action report (AAR) related to training and/or exercise events and real-world events within 30 calendar days of the event.

• An overview of the event of what happened and how it happened.

• A detailed analysis of what was observed, what was expected, who was involved, what are the strengths and what are the opportunities.

• Recommend ways to improve performance in the future.

• Improvement plan with corrective actions to take for future occurrences. Including a list of the party responsible for the corrective actions.

• Conclusion summary of the report.

A00X Continuity of Operations Plan (COOP -Plan)

A00X After-Action Report (AAR)

4.1.1.9 Disaster Recovery Plan

The Contractor shall create and submit a Disaster Recovery Plan in accordance with Executive Order

12656 of February 1996, the Computer Security Act of 1987 and OMB Circular A-130 mandate that a

Disaster Recovery Plan (DRP) for all U.S. Government information resources be maintained. The DRP, Disaster Recovery Test Process, and Disaster Recovery Test Scenarios shall be due 30 days from the contract award date and updated semi-annually thereafter.

This contingency planning develops strategies for rapid recovery of mission critical information to enable

Return to Operations (RTO) of four (4) hours after the occurrence of a crisis or disaster. Ginnie Mae recognizes that the Contractors ability to return to operations within four (4) hours may be contingent upon other Ginnie Mae Contractors. For the purposes of this section, the four (4) hour window commences upon system availability.

In the event of a disaster that renders the Contractors primary office space uninhabitable, the Contractor

(or its Subcontractors) shall be capable of resuming operations within four (4) hours.

The Contractor shall ensure that there are personnel that can perform the business operations at the applicable back-up location(s).

The Contractor shall implement and maintain the DR Plan that outlines the steps and communication strategy necessary for rapid recovery of mission critical information to enable the Return to Operations

(RTO) within four (4) hours after the occurrence of a crisis or disaster and shall continue uninterrupted.

Ginnie Mae recognizes that the MFF Contractors ability to return to operations within four (4) hours may be contingent upon other Ginnie Mae Contractors. For the purposes of this section, the four (4) hour window commences upon system availability.

Within 30 days of the contract award date and prior to the implementation of the DR Plan, the Contractor shall coordinate with Ginnie Mae and other Ginnie Mae Contractors to develop and implement DR testing processes and procedures that conform to all required federal mandate and guidance in addition to business requirements.

The Contractor shall participate with Ginnie Mae and other Ginnie Mae Contractors to fully test and satisfy the DR Test in accordance with NIST standards. The DR Test shall be performed 30 days from the contract award date and performed semi-annually thereafter in March and September.

• Tests typically run for two days. The Contractor will need to coordinate and work with other Ginnie Mae Contractors to complete any DR test/drill.

• The Contractor shall communicate the testing results and any deficiencies in the plan to

Ginnie Mae.

• In the event of a failure, the Contractor will be required to re-test until deficiencies identified during testing are remediated.

• The Contractor shall provide support to Ginnie Mae and other Ginnie Mae Contractors to perform environmental, infrastructure and application validation.

• The purpose of this is to ensure that changes and fixes to software and the environment that are implemented over the course of a year do not create problems and that any issues are remediated before the next DR test.

The Contractor shall coordinate and participate with Ginnie Mae and other Ginnie Mae Contractors to perform Quarterly Environmental Validation Support.

The Contractor shall coordinate with Ginnie Mae and other Ginnie Mae Contractors to develop and implement the Disaster Recovery Environment Validation Processes and Procedures and incorporate into the DR Plan.

In the event of a disaster, the Contractor shall resume and complete all business operations and processes for all day-to-day activities performed under this contract within four (4) hours following the disaster (the excusable delay).

The Contractor shall, participate in emergency drills or simulations as directed by the COR Ginnie Mae.

A00X Disaster Recovery Plan

4.1.1.10 Risk and Controls Self-Assessment (RCSA)

a. Overview - The Ginnie Mae OER is responsible for managing Ginnie Mae’s risks. The

Operational Risk Analysis Division (ORAD) within OER has delegated the authority to oversee the operational and financial, internal controls and risks within the corporation. ORAD accomplishes this goal through Risk and Controls Self-Assessment (RCSA) (operational), OMB

A-123 Appendix A (financial) and Vendor Risk Management (VRM) (third party) assessments.

The Government understands that some of the Contractors’ internal procedures for activities are solely associated with the Contractors’ business and may be proprietary. The Government and the

Contractor shall agree to which specific activities, including all activities, policies and procedures performed by the Contractor and paid for by the Government as part of this contract, shall belong to the Government. A major Ginnie Mae objective is to have access and transparency into the activities performed by the Contractor in order to understand the interrelationship between the

Contractors activities and Ginnie Mae’s because the Contractor performs many essential business activities supporting Ginnie Mae’s MBS programs.

b. Operational, Financial and Third-Party Assessments - The Contractor shall allow Ginnie Mae to perform internal control assessments throughout the Contractors organization as it pertains to the activities the Contractor performs on behalf of Ginnie Mae. These assessments shall provide reasonable assurance that the Contractor operations and contract management objectives are being accomplished and that the Contractors mitigation strategies or controls are effective.

These assessments performed by Ginnie Mae, at a minimum, shall allow Ginnie Mae to assess the vendor through the following key activities:

1. A comprehensive description of the program with processes, key activities, and accountabilities clearly identified.

2. A method for verifying/ensuring effective processes. Third party audits, peer reviews, independent assessments, and external certification may be used.

3. Timely notification to the COR of significant program changes prior to the changes.

4. Rigorous, risk-based, credible self-assessments, and feedback and improvement activities, including utilization of subject matter experts, and other independent reviews to assess and improve the Contractors work process and to carry out independent risk and vulnerability studies.

5. Identification and correction of deficiencies/gaps or operational incidents regarding risk or risk management. The findings will be based on Ginnie Mae's criteria. Ginnie Mae will communicate the results of the assessments with the vendor upon completion of the examination.

6. Integration of the program with other management programs including annual internal control reporting.

7. Metrics and targets to assess performance, including benchmarking of key functional areas, industry, and research institutions. Assure development of metrics and targets that result in effective performance of risk management and mitigation.

8. Continuous feedback and risk management improvement.

9. A Corrective Action Plan that responds to each risk identified and provides next steps and deadlines for how the risks will be resolved or mitigated going forward.

10. Timely and appropriate communication to Ginnie Mae, including electronic access, of related information.

4.1.1.11 Audit Readiness

a. The Contractor shall use a qualified independent audit firm to conduct the SSAE 18 work. The independent audit firm shall have experience in performing similar audits to the service organization.

b. The Contractor shall provide the auditor with access to all systems, information and people required to perform a SSAE 18 Type II with an American Institute of Certified Public

Accountants (AICPA) SOC 1 and & SOC 2 Type II review.

c. Annually, Ginnie Mae and the Contractor must agree on the scope and timing for the SOC 1 and

SOC 2 audits before they are executed. This scope may include, but shall not be limited to, services, business processes, information systems, control objectives and controls.

d. For SOC 1, this report shall be conducted every year of the contract term. A draft of the SSAE 18 report for SOC 1 will be submitted to Ginnie Mae by August 15th of the year ordered and the final report shall be delivered August 30th. The contract may be modified after award to define other reporting periods and due dates during the transition period. Additionally, the report shall be conducted if there are major organization or system changes that occur and substantively alter the service provider's operating environment.

e. For SOC 2, this report shall be conducted by the issuance of a separate delivery order under this contract when the date, scope and periods of the test can be determined.

f. The Contractor shall provide the SSAE 18 auditor with corrective action plans for addressing any findings noted for both SOC 1 and SOC 2. All significant deficiencies known as misstatements must be remediated in a timely manner with Remediation Status Progress Reports provided to

Ginnie Mae quarterly as noted below in number (3) and (4).

g. Ginnie Mae, the COR and HUD's OIG, shall have access to all work papers related to the SSAE

18 audit.

The Contractor shall:

11. Conduct a SOC 1, Type II report as a Contractor which provides services to Ginnie Mae that are relevant to Internal Controls over Financial Reporting (ICFR).

12. Conduct a SOC 2, Type II report as a Contractor which provides services to Ginnie Mae that are relevant to security, availability, processing integrity, confidentiality, and privacy.

13. Provide a draft SSAE 18 report for SOC 1 including corrective action plan to the Ginnie

Mae COR by August 15th of the year ordered and a final report by August 30th of each year. The report shall also include a corrective action plan for all items requiring remediation. The Contractor shall provide Ginnie Mae a quarterly Remediation Status

Progress Report including remediation actions taken and remaining actions required to address all open remediation items.

14. Provide a draft and final SSAE 18 report for SOC 2 including corrective action plan to the Ginnie Mae COR when due dates, scope and periods of the test can be determined.

This work will be established by issuance of a separate delivery order under this contract.

The report shall also include a corrective action plan for all items requiring remediation.

The Contractor shall provide Ginnie Mae a quarterly Remediation Status Progress Report including remediation actions taken and remaining actions required to address all open remediation items.

15. Any restrictive legends for the use of the SOC 1 and SOC 2 reports shall be approved by

Ginnie Mae.

16. The HUD Inspector General, Ginnie Mae’s auditors or the COR or his/her designee shall have express access to the work papers of the independent public accounting firm preparing the SSAE 18 during and after completion of this task. The Contractor will provide support to Ginnie Mae for HUD OCFO (Accountability, Integrity and Risk

Program) and OIG requests.

17. Conduct both the SOC 1 and SOC 2 reports in accordance with SSAE 18, the AICPA

"attest" standard and Ginnie Mae’s guidance on scope.

18. The Contractors subservice organizations, which support the contract and help to provide the overall contract solution, shall also provide Ginnie Mae with the appropriate SOC reports as applicable. This includes an annual Document Custodian SOC 1 report that meets all the requirements described in this task.

19. If the SOC reports provided to Ginnie Mae do not satisfy Ginnie Mae’s requirements or if the reports are not delivered to Ginnie Mae, Ginnie Mae may take the following types of recourse:

i. Ginnie Mae may conduct its own audits of the service organization and subservice organizations.

ii. If Ginnie Mae conducts its own audits, the Contractor must establish service organization and subservice organization(s) agreement to provide necessary support to Ginnie Mae’s auditors, to include providing required access to facilities, people, and records.

iii. Ginnie Mae may invoice the service organization for the cost of the SOC report(s) or deduct such costs from future service organization invoices.

The Contractor agrees to retain all records, processes, documentation, controls, flowcharts, and accounts related to the Agency (HUD or GSA) under this Agreement for a period of at least three (3) years from the completion date of any work. Such records, processes, documentation, controls, flowcharts, and accounts shall itemize the names of employees, hours worked, services performed, materials used, and any other costs or expenses.

At any reasonable time, the Contractor shall permit the Agency or Ginnie Mae Contractor to review and audit all records and accounts related to costs and expenses invoiced to the Agency which pertain to the non-fixed price transactions under this Contract. The Contractor agrees to cooperate with all inspections

(i.e. Contract Audit Reviews (CARs), OMB A-123, Appendix A, Operational Risk Assessments (RCSA), Vendor Risk Assessment (VRM), and Continuity of Operations (COOP) activities) and to resolve all findings to Ginnie Mae’s satisfaction at no additional cost to the Government. The Contractor agrees that the government may deduct any monetary discrepancies from any invoice submitted by the Contractor to correct all monetary findings. The Agency's signature on timecards or other documents evidencing work performed or materials purchased shall not preclude the Agency from receiving an adjustment to amounts paid to the Contractor based on an audit or other review by or on behalf of the Agency.

Such records shall include, but not be limited to, accounting records, written policies and procedures;

flowcharts, subcontract files (including proposals of successful and unsuccessful bidders, bid recaps, etc.);

all paid vouchers including those for out-of-pocket expenses; other reimbursement supported by invoices;

ledgers; cancelled checks; deposit slips; bank statements; journals; original estimates; estimating work sheets; contract amendments and change order files; back charge logs and supporting documentation;

insurance documents; payroll documents; timesheets; memoranda; and correspondence.

A00X RCSA & VRM Corrective Action Plan

A00X MSS SOC 1: Draft Annually by August 15th; Final Annually by August 30th

A00X Document Custodian SOC 1: Draft Annually by August 15th; Final Annually by August 30th

A00X MSS SOC II: As specified in the individual delivery order when issued

A00X SSAE 18 Audit Remediation Progress Status Reports

1. Standard: SSAE 18 Audit Report (Draft & Final), Draft Annually by August 15th; Final Annually by August 30th.

AQL: Zero Deviation

2. Standard: MSS SOC II: As specified in the individual delivery order when issued.

AQL: Zero Deviation

3. Standard: SSAE 18 Audit Remediation Progress Status Reports, Quarterly until remediation actions completed.

4.1.1.12 File Control

The Contractor shall take inventory, board, and take possession and control of all files and records, including vendor invoices and supporting documentation for pooled and non-pooled loans/properties assets (NPA) from Ginnie Mae's outgoing Contractor(s). Transfer costs may include but are not limited to costs of taking possession of the accounts and custodial files, IT transfers, computer and other system conversions, potential travel, the establishment or transfer of tax services, current and new monthly Investor accounting and reporting, and custodial release fees or any other charges imposed by the document or funds custodians.

The Contractor shall deliver the file in a standardized layout recommended by the Ginnie Mae, Office of Enterprise Data & Technology Solutions (OEDTS) with delivery instructions, file naming conventions, file format, enumerations, and business validations specified by OEDTS.

Following the Department of Housing and Urban Development's (HUD's) Project Planning and

Management (PPM) Life Cycle and industry best practices in the analysis, design, development, testing and implementation, the Contractor shall create and validate files that are compliant with this standardized data layout. The layout data shall be periodically updated by the Contractor to accommodate GNMAs reporting needs. The standardized layout is referenced in Exhibit B.

The Contractor shall provide a monthly file containing data for loans (forward and reverse) and assets associated with the Single-Family defaulted Issuer portfolio. The Contractor shall deliver the file monthly by the third (3rd) business day of each month. At a minimum, the file shall include attributes describing the following:

1. Original and current loan characteristics

2. Modification agreements

3. Claims information

4. Default action events

5. Foreclosures

6. Forbearances

7. Bankruptcies

8. Litigation

9. Natural disasters

10. Property damages

11. Hazard insurance

12. Acquired property transactions

13. Appraisals and document deficiency information.

The Contractor shall comply with any adjustments made to any data submissions. The Contractor shall work with the COR or Ginnie Mae SME to make necessary adjustments or additions to data submissions.

A00X Data Submission

1. Standard: Monthly Data Submission and Attestation received by the third business day each month

4.1.1.13 Document Custodian Exception Remediation Plan

The Contractor shall submit to the COR the Document Custodian Exception Remediation Plan within sixty (60) calendar days of transfer of loans and pools to the Contractors loan servicing systems and establishment of Document Custodian relationship, that details the exceptions discovered and the resolution timeline of issues preventing final certification/recertification of

Ginnie Mae pools. Any plan must be approved by the COR before the Contractor executes the submitted plan. This includes required curative work to perform loan servicing activities to complete default servicing activities, modifications, foreclosures, protect Ginnie Mae’s lien position or file claims timely.

The Contractor shall establish an agreement with the Document Custodian to maintain custody of the NPA transferred to the Contractor's oversight.

The Contractor shall execute a HUD-11715 Master Custodial Agreement with the assigned

Document Custodian for every portfolio where active pools and/or non-pooled assets reside.

Deliverables

A00X Document Custodian Exception Remediation Plan

1. Standard: Document Custodian Exception Remediation Plan within sixty (60) calendar days of the date of transfer of loans and Document Custodian relationship establishment.

AQL: 90 Days, if loan count is greater than 100,000 loans

4.1.2 Issuer Services

4.1.2.1 Stand-By Contract Services

The Contractor shall be prepared, capable, and staffed to perform the complete range of services expected of a Ginnie Mae Issuer. These services include providing termination services, servicing current, delinquent, and defaulted loans, both pooled and non-pooled, including bankruptcy and foreclosure services, management, and disposition of acquired properties (i.e., REO), preparation and submission of insurance or guarantee claims to FHA, VA, RD, PIH, asset sales, monthly investor account reporting, and other reporting requirements to Ginnie Mae. The Contractor shall also be available to receive and remit data requests at the direction of the COR.

The Contractor shall maintain the capacity and readiness to execute simultaneous or consecutive multiple Issuer terminations and seizures, including terminations and seizures of the largest

Ginnie Mae Mega-Issuers i.e., those with more than 400,000 loans in Ginnie Mae pool securities.

The Contractor shall maintain the capacity and readiness to service portfolios with seriously delinquent portfolios in various stages of delinquencies. If the Contractor has some limitations in properly staffing for a sizable termination and seizure of over 400,000 loans, the Contractor shall provide the COR with a Staffing Capacity Plan and a return to normal servicing levels (RTNS) plan and timeline within 72 hours after the Technical Direction has been issued for COR review and approval.

The Contractor shall submit a final staffing capacity plan and RTNS plan to the COR within five

(5) business days if the COR has provided commentary. In addition, the Contractor shall be ready to onboard a portfolio of 100,000 loans with a 6% 60+ day delinquency ratio at all times.

4.1.2.2 Readiness to Perform

The Contractor shall demonstrate readiness to perform and demonstrate all processes and functions required in this PWS as prescribed by the ISSO/CISO or their agent(s) including the continuing of operation plan and disaster recovery test. At the direction of the COR, the

Contractor may be evaluated for Ginnie Mae, agency, reporting, and IT compliance by an agent of Ginnie Mae at any time.

The Contractor shall maintain the capacity and readiness to execute simultaneous or consecutive multiple Issuer terminations and seizures, including terminations and seizures of our largest

Ginnie Mae Mega Issuers i.e., those with more than 400,000 loans in Ginnie Mae pool securities.

The Contractor shall be ready to onboard a portfolio of 100,000 loans with a 6% 60+ day delinquency ratio at all times.

4.1.2.3 Staffing

The Contractor shall be prepared, capable, and staffed to perform the complete range of services expected of a Ginnie Mae Issuer. This includes the servicing of seized portfolios in accordance with the respective agency guides and policies, the Ginnie Mae Termination and Seizure

Playbook and provide data updates and remittances to Ginnie Mae.

Accounting support staff, upon COR request, at the end of each quarter, the Contractor shall provide coverage from Subject Matter Experts (SMEs) after normal business hours and on holidays or week-end days that occur from the third (3rd) to the eighth (8th) business day of the month after each quarter end (i.e., April, July, October, and January) to support issues identified in data files or accounting reports delivered to GNMA by the Contractor. The Contractor shall provide the necessary support during these time periods to resolve data and report issues through delivery of corrected data files, accounting reports, or other deliverables.

The Contractor shall provide in the Staffing Capacity Plan-to-Onboard a portfolio of 800,000 loans with a 6% 60+ day delinquency ratio. The plan should address the staffing that currently exists and is proposed in increments of 50,000 loans. The Staffing Capacity plan should demonstrate, at a minimum:

1. Current MSS Portfolio Statistics - Current, delinquent, loss mitigation, foreclosure, bankruptcy and REO

2. Current Portfolio Headcount - Onsite and Remote Staff

3. Staffing Scenarios - 50,000 loan count increments up to 800,000 loans / at 6% and 10%

DQ ratios

4. Applicant Pipeline Considerations, per increment

5. Recruitment/Hiring Timeline (days)

6. Onboarding Timeline (days)

7. Training Timeline (days)

8. Return-To-Normal-Servicing Timeline (RTNS) (days)

9. Total Time to Recruit-to-RTNS (days)

The Staffing Capacity Plan shall be delivered quarterly to the COR by March 31st, June 30th.

September 30th and December 31st during the performance period.

A00X Staffing Capacity Plan

1. Standard: Staffing Capacity Plan submitted in accordance with the established delivery date.

AQL: Zero deviation

4.1.2.4 Reviews

The Contractor shall supply the Field Review Contractor (FRC) with the necessary documents and data to successfully execute a termination and seizure and permit the FRC to conduct additional reviews if necessary. FRC reviews are conducted four (4) times a year (three (3) quarterly and one (1) annual review). The Contractor shall provide access to its information and documentation to other GNMA Contractors employed to receive data, conduct virtual or onsite reviews during the contract period of performance. Upon COR request, the Contractor shall provide information and documentation for special reviews outside of scheduled reviews.

4.1.2.5 Systems Walkthrough

The Contractor shall provide Ginnie Mae with direct access to the underlying data, supporting documentation, etc. as prescribed under the Technical Direction from the COR. The Contractor shall also provide Ginnie Mae with a walkthrough of the systems and process that the Contractor uses to perform contracted services for Ginnie Mae and how to properly access the data and documentation.

4.1.2.6 Communication Coordination

At the CORs direction, the Contractor shall coordinate communications between GNMA, the representatives from the selling terminated but non-seized Issuer and the purchasing Issuer. This shall include participating in or facilitating conference calls and drafting meeting minutes on behalf of GNMA. Meeting minutes shall be submitted to the COR no later than two business days after each meeting.

4.1.2.7 Milestone Reporting

Upon COR request, the Contractor shall provide benchmark and milestone reporting for the consulting duties overseeing the assigned project on a weekly basis. Each report shall be submitted the following Monday or the next business day if Monday is a holiday. At a minimum, the report shall include the following:

1. Listing of transferring pools

2. Data mapping starts and completion

3. Master Agreement start and execution

4. Custodial Account setup completion

5. Pool transfer start and completion

6. MERS registration change complete

7. Agency servicer transfer start and completion

8. Document Custodian notification

9. Document Custodian change start and completion

10. Collateral file transfer start and completion

A00X Milestone Report

1. Standard: Milestone Reporting by the following Monday or the next business day if Monday is a holiday.

4.1.2.8 Weekly Updates and Executive Dashboards

The Contractor shall provide weekly updates via an executive dashboard to the COR, by 5:00PM

EST each Friday or the following business day if Friday is a federal holiday.

A00X Executive Dashboards

1. Standard: Executive Dashboards by 5:00PM EST each Friday or the following business day if

Friday is a federal holiday.

4.1.3 T/E/S Support Services

4.1.3.1 Termination & Seizure Services

The Contractor shall provide Issuer termination and seizure services for GNMA. All services shall be provided in accordance with the procedures outlined in GNMAs Termination Playbook for Contractors. Services include:

1. Managing multiple sites for termination and seizure activities

2. Securing control of the terminated and seized Issuers portfolio, data, and documentation

3. Transferring physical and electronic files

Any curtailment by FHA, VA, PIH or RD for reasons that were related to the prior master subservicer servicing activities, the Contractor is given a grace period of sixty (60) days after the date of the seizure of a portfolio for any curtailments incurred by the Contractor with respect to missing…