Draft Statement of Work.pdf

CONTROLLED

C o n t r o l l e d b y F H F A

ATTACHMENT A

STATEMENT OF WORK: Cash Flow Data, Models and Software

1.0 BACKGROUND INFORMATION

The Federal Housing Finance Agency (FHFA), created by the Housing and Economic Recovery Act of 2008 (‘Act’), regulates and supervises Fannie Mae, Freddie Mac, and the Federal Home Loan Banks, collectively known as the Regulated Entities)). The Act combined three organizations, the Office of Federal Housing Enterprise Oversight, the Federal Housing Finance Board, and a group from the Department of Housing and Urban Development, which collectively had previously regulated GSEs. The regulated entities play critical roles in supporting the U.S.

housing finance system. Fannie Mae and Freddie Mac guarantee mortgage-backed securities (MBS) and hold mortgages and MBS for investment. The Federal Home Loan Banks (FHLBanks) lend money to banks and other financial institutions using mortgages as collateral and invest in mortgage-related assets. The primary functions of the FHFA are to ensure the capital adequacy and the financial safety and soundness of the Regulated Entities and to ensure they discharge their housing finance mission efficiently and effectively.

FHFA, among other responsibilities, calculates independent estimates of the market value and market value sensitivity to interest rate and house price changes of the Regulated Entities’ mortgage-related assets, both whole loans and securitization exposures, advance portfolios, consolidated obligations (debt), and derivatives (swaps, swaptions, caps and floors). FHFA also calculates independent estimates of the income sensitivity of the Regulated Entities’ positions to interest rate, and house price changes and conducts other types of scenario and stress testing analyses.

To model MBS and structured products FHFA requires cash flow data and models (deal model libraries) integrated with PolyPaths software, as well as a ‘front-end’ software application.

Additional information on FHFA and its mission can be found at: http://www.fhfa.gov .

2.0 SCOPE OF WORK

The FHFA requires licenses to the following:

1. Cash flow data and modelling software integrated with PolyPaths software, to monitor, model, and report on the Regulated Entities structured (tranched) mortgage investments known as Collateralized Mortgage Obligations (CMOs), Mortgage-Backed Securities (pass-thorough), Credit Risk Transfer (CRT) deals, and Agency Reinsurance Transactions;

2. Direct programmer access to the deal model libraries to continue development of customized models or analysis tools.; and

3. Front-end software for analysis and modeling of the CMO/MBS/CRT deals for users unlicensed to use PolyPaths software.

http://www.fhfa.gov/

4. Data on agency and non-agency structured transactions, including, but not limited to deal name, current face value, number of assets, average loan size, and 12-month constant prepayment rates (CPR speeds).

FHFA cannot predict the investment decisions of the FHLBanks or Enterprises or the security issuance of the Enterprises and therefore requires nearly 100 percent coverage of the investment securities markets, listed in Section 3 below, for adequate supervision work, research and policy decisions. FHFA prefers coverage of State Housing Finance Agency bonds, commercial real estate debt funds, and Agency Seller/Servicer Risk Share deals. FHFA prefers that the contractor’s market presence and experience is sufficient to ensure best practices in error-tracking and remediation. FHFA also prefers that the contractor’s market presence and experience with broker and dealer institutions and mortgage sellers and servicers are sufficient to ensure timely modeling of new deals prior to issuance and timely monthly updates to securities data.

FHFA will implement the software within its existing systems in such time as to produce, at a minimum, results within ten business days after contract award. FHFA will use the software to:

1. Produce position-level risk reports for internal (non-public) use that depict model estimates of market value, income and credit loss sensitivity to interest rates and house prices.

2. Produce and publicly release summary (portfolio) risk reports that depict model estimates of market value, income and credit loss sensitivity to interest rates and house prices.

3. Inform policy decisions, including but not limited to the multifamily scorecard cap and risk analysis.

The FHFA will retain and use, after contract termination, the reports created during the contract period of performance. To assist FHFA, the contractor must provide periodic and timely updates, basic support and maintenance. In particular, the contractor must provide technical support available (by phone, email and/or online meeting technology) to troubleshoot problems and answer questions about the software, its implementation, and its interface with the third-party vendor models. Such support shall respond to FHFA’s software questions within one (1) business day.

3.0 REQUIREMENTS

The contractor shall have the capability to meet each of the requirements listed below. Unless noted as preferred, the requirements represent minimum, mandatory requirements:

I. Analytical Requirements

a) CMO subroutines and databases integrated with PolyPaths

1. Five (5) licenses to deal model libraries integrated with PolyPaths

2. One (1) developer license to the deal model libraries

3. One (1) developer license to the deal model libraries for FHFA IT for support purposes only

4. Deal Model Libraries (asset and debt classes)

i. US Residential MBS

1. Agency CMO

2. Agency-Pool Backed Private Label MBS

3. Prepayment Linked Note

4. Agency Credit Risk Transfer (CRT)

5. Agency Reinsurance Transactions (ACIS, CIRT)

6. RMBS

7. Home Equity

8. Non-Performing/Re-Performing

9. HECM

10. Agency Single Family Pool Option

ii. US Commercial MBS

1. CMBS

2. Agency Multi-Family

3. Agency Multi-Family Pool Option (MPF)

4. Single Family Rental

5. Franchise

6. Small Balance Commercial Loan

7. Commercial Real Estate CDO

iii. Agency pool information data

iv. Manufactured housing deal model libraries

v. State Housing Finance Agency (HFA) bonds

vi. Commercial real estate debt funds

vii. Agency Seller/Servicer Risk Share deals

b) Front-end software: Five (5) licenses to the graphical user interface (GUI) to access the cash flow data and models without PolyPaths as well as current and historical collateral, tranche, and deal data.

II. Computational Requirements

a) The software must be fully integrated with PolyPaths and relevant prepayment/loss models.

Full integration means that the contractor has, jointly with software developers listed above, built, and tested the necessary linkages between the two frameworks.

b) Graphical User Interface: The software shall:

1. Be user-friendly.

2. Include user-friendly functions for uploading, downloading and importing and exporting instrument terms and conditions data, scenarios, and market data.

3. Include user-friendly functions for downloading and exporting valuation, cash flow, loss and other reports as Excel pivot tables attached to OLAP cubes or as Excel, CSV, or XML files.

c) The software shall comply with all federal government security and data protection requirements including Office of Management and Budget (OMB) directives and memorandums, National Institute of Standards and Technology (NIST) special publications and Federal Information Processing Standards (FIPS).

III. License Agreement Requirements

a. FHFA requires five (5) named user licenses of the deal model libraries integrated with PolyPaths and five (5) named users of the front-end software.

b. Licensed users may include personnel from multiple FHFA divisions.

c. The software must be easy to install primarily in a server environment at FHFA headquarters in Washington D.C., and on a disaster recovery server.

d. FHFA may operate the software in a virtual environment hosted by a cloud provider.

e. FHFA requires user access to the server installation directly from the Washington DC FHFA headquarters as well as remotely by personnel either telecommuting or traveling on official government business.

f. The Contractor’s license agreement shall detail how it intends to provide software versions and updates to FHFA.

g. FHFA requires support for at least the second most recent general release of the software if FHFA does not accept the most recent version of the software.

h. FHFA requires a license agreement that permits the FHFA to use the software to:

1. Produce position-level risk reports for internal (non-public) use that depict model estimates of market value, income and credit loss sensitivity to interest rates and house prices; and

2. Produce and publicly release summary risk reports that depict model estimates of market value, income and credit loss sensitivity to interest rates and house prices.

3. Inform policy decisions, including but not limited to the multifamily scorecard cap and risk analysis.

i. FHFA requires a license agreement that allows the FHFA to retain and use, after contract termination, the reports created during the contract period of performance.

IV. Software Maintenance and Support

The Contractor shall furnish the most current version of manuals and publications for all software provided under this contract within five (5) business days of contract award. The Contractor shall provide these manuals and publications at no additional cost to the FHFA. Electronic access to manuals and publications are preferred. The Contractor shall update user manuals to reflect major changes to the software.

The Contractor shall update the software on a regular basis to keep pace with changes in industry standard and best practice modeling. The Contractor shall provide software maintenance with associated vendor-provided data files.

The Contractor shall provide documentation of Contractor changes and/or modifications to the software. Electronic access to this documentation is preferred.

FHFA will not be obligated to wait for new software releases to compel the Contractor to correct software deficiencies or malfunctions. FHFA requires industry-standard support for FHFA users of the software. In particular, the contractor shall make experts available by phone, email, and online meeting technology (as appropriate) to answer questions about the software. Such experts shall respond to FHFA’s software questions within one (1) business day. FHFA requires liaison support between the deal model libraries and the integrated software listed in section (II.a) of the Statement of Work.

VIII. Deliverables

a. The Contractor must deliver five (5) licenses to the deal model libraries integrated with PolyPaths

b. The Contractor must deliver one (1) developer license to the deal model libraries for Windows/64 bit and make one license available to an IT staff member for support purposes only

c. The contractor must deliver the deal model libraries detailed in Section I.a.5 (Analytical Requirements)

d. The contractor must deliver five (5) licenses to the front-end software detailed in Section I.b (Analytical Requirements)

e. The Contractor must deliver model documentation – electronic access is preferred. The

Contractor shall furnish the most current version of manuals and publications for all software provided under this contract within five (5) business days of contract award.

The Contractor shall provide these manuals and publications at no additional cost to the

FHFA.

f. The Contractor must deliver timely support services on an ongoing basis over the life of the contract (including telephone, e-mail, or other assistance)

g. The Contractor must give FHFA written notification of the release of any software modifications, improvements, updates, and revisions. In the case of new software level releases, FHFA may elect to accept the later versions of the software, and if accepted, software support shall be at no additional cost during the contract period, including all options. FHFA prefers written notification of modifications to the files in the deal model libraries.

h. The Contractor shall furnish the most current version of manuals and publications for all software provided under this contract within five (5) business days of contract award.

The Contractor shall provide these manuals and publications at no additional cost to the

FHFA.

IX. FHFA Security Requirements

a. Requirements for solutions that may be COTS or externally hosted Software as a Service (SaaS)

1. The solution supports encryption of data at rest and data in transit using FIPS 40-2 approved algorithms;

2. The solution implements role-based access control to allow for a least privilege access model;

3. The solution audits user-activity and allows FHFA privileged users to view audit reports;

4. The solution supports single-sign-on using FHFA’s system login credentials via

Security Assertion Markup Language (SAML) 2.0 and function in a “Service Provider” or “Relying Party” type role where FHFA serves as the Identity Provider.

If the single sign-on is not supported, the solution shall require complex passwords that meet the following requirements:

i. 12 characters in length;

ii. Requires both uppercase and lowercase letters;

iii. Requires at least one number and one special character;

iv. Cannot be identical to the last 24 passwords;

v. Are disabled every 60 days;

vi. User accounts are locked after 5 failed logon attempts;

5. The solution supports the termination of user sessions after 15 minutes of inactivity or a time period to be defined by FHFA.

b. Additional requirements for COTS hardware or software supporting networked information technology.

The solution shall be capable of transmitting, receiving, processing, forwarding, and storing digital information utilizing system packets that are formatted in accordance with commercial standards of Internet Protocol (IP) version 6 (IPv6) as set forth in the USGv6 Profile (NIST Special Publication 500-267) and corresponding declarations of conformance defined in the USGv6 Test program. The solution shall also maintain interoperability with IPv4 systems and provide the same level of performance and reliability capabilities.

c. Additional requirements for externally hosted Software as a Service (SaaS)

i. The solution undergoes periodic penetration testing and the vendor tracks and reports on the remediation of identified vulnerabilities;

ii. All data in use and at rest, and data backups/storage must reside within the U.S.;

iii. Only authorized contractor personnel (including subcontractor personnel) with appropriate background investigations and authorization shall access FHFA data and backups.

iv. The solution provides an exit/transition strategy that avoids vendor lock-in and it:

1. ensures that FHFA can retrieve all data placed in the cloud environment in a timely manner;

2. can be executed quickly to ensure continuity of service;

3. transfers all FHFA data to the Government in a predefined format;

4. maintains, backs up, and secures the data until it is returned; and

5. transfers all data without additional charge to the Government.

4.0 PERIOD OF PERFORMACE

The period of performance is for one (1) base year and four (4) one-year option years.

5.0 INFORMATION TECHNOLOGY ACCESSIBILITY (SECTION 508)

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities.

Products, platforms and services delivered as part of this work statement that are ICT, or contain ICT, must conform to the Revised 508 Standards, which are located at 36 C.F.R. §

1194.1 & Apps. A, C & D, and available at https://www.access-board.gov/guidelines-and-standards/communications-and- it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines

E102 / 702.10 – Web Content Accessibility Guidelines (WCAG) success criteria level A & AA are incorporated as a requirement. The referenced WCAG criteria is available at http://www.w3.org/TR/WCAG20/

Applicable Functional Performance Criteria

All functional performance criteria apply when using an alternative design or technology that achieves substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4-6 of the Revised 508 Standards, or when Chapters 4-6 do not address one or more functions of ICT.

Applicable Requirements for Software and Web Products

Web deliverables/tools and access shall conform to the following standards:

• E207 – WCAG Level A & AA Success Criteria

• E302 – Functional Performance Criteria

• E501 – ICT Web and/or Software

• E502 – Interoperability with Assistive Technology

• E503 – Application http://www.w3.org/TR/WCAG20/