DRAFT Statement of Work.pdf

STATEMENT OF WORK (SOW):

CREDIT RISK TRANSFER (CRT) ANALYTICS

1.0 BACKGROUND

The Housing and Economic Recovery Act of 2008 created FHFA, which regulates and supervises Fannie Mae, Freddie Mac, and the 11 Federal Home Loan Banks. In 2013, FHFA directed the Enterprises to engage in credit risk transactions (CRT) to reduce their respective exposures to mortgage credit risk, and consequently, reduce taxpayer risk. Since 2013, the mix of CRT offerings has expanded considerably to include capital market note issuances, reinsurance transactions, and lender-facing transactions. From 2013 to the end of 2023, the Enterprises transferred credit risk on approximately $6.7 trillion of unpaid principal balance, with a total risk-in-force of $210 billion.

The Office of Capital Policy (OCAP), within the Division of Housing, Mission & Goals (DHMG), provides independent oversight for the Enterprises CRT programs, which includes monitoring issuance, deal economics, performance, and progress towards meeting risk objectives set in the Conservatorship Scorecard.

2.0 SCOPE

To assist with the oversight responsibilities of the CRT programs.

The analytic tool, along with potential customization services, will assist the Office of Financial Analysis, Modeling & Simulations (OFAMS) in executing its oversight responsibilities and supporting executive decision-making of the CRT programs of the Enterprises.

To assist with executing these responsibilities, OCAP seeks access to a cloud-based, web browser-accessible, COTS CRT analytics tool/platform, which is comprehensive, reliable, and flexible.

3.0 OBJECTIVES

The main objective of this task order is for FHFA to obtain access to:

A tool to maintain the current level of independent and analytic support OCAP provides to Agency leadership and Divisions for various policy decisions and insights regarding the CRT programs.

4.0 TASKS AND REQUIREMENTS – CRT ANALYTICS

FHFA has the following requirements in order to provide oversight of the Enterprises’ CRT programs:

4.1 CRT Analytics Tool

The Contractor must provide FHFA a firm-fixed-price (FFP) license to a COTS CRT analytics tool for six (6) authorized users. The need for additional users (outside of the specified payment range for up to ten (10) authorized users) may arise in the future and the resulting task order can be modified, as appropriate, for a negotiated, in-scope increase. The tool must have the following functionalities:

4.1.1 Perform On-Demand

Economic scenario analyses on one, or more, outstanding Enterprise CRT transactions to determine the magnitude of potential future loss recoveries under, for example, the most recent CCAR/DFAST severely adverse scenario, a 2007-like stress event, and severe house price declines (e.g., up to 50% down). This allows us to independently determine (i.e., not be solely reliant on Enterprise-provided data and statements) whether it is appropriate for the Enterprises to extinguish outstanding CRT transactions prior to their respective contractual maturity dates.

Stochastic analyses for a wide range of potential loss outcomes using various confidence intervals between 0 – 100 percent. Similar to the above, this allows the independent determination of whether it is appropriate for the Enterprises to extinguish outstanding CRT transactions based on the likelihood of modeled future loss recoveries.

Granular-level collateral analyses for specific CRT transaction reference pools (e.g., delinquency rates, collateral pool factors, projected prepay speeds, etc.).

4.1.2 Computational Engine

Analytic capability of CRT collateral performance (defaults, prepayments, severity, and losses) at the deal level including historical performance and projected performance under multiple scenarios;

Analytic capability of CRT collateral performance at the portfolio level including historical performance and projected performance under multiple scenarios;

Trend analysis in collateral underlying CRT reference pools;

Enterprise Regulatory Capital Framework (ERCF) analytic and reporting capability;

Trend analysis in CRT deal structure and CRT premium rates;

Features to assess collateral pool creditworthiness for each CRT;

Stress-testing capability of collateral with pre-packaged (e.g., Comprehensive Capital

Analysis and Review) and customizable scenarios;

Simulation capability (e.g., Monte Carlo or some other type of simulation method) to facilitate the estimation of outcomes across a broad range of scenarios, and the capability to select different distributions to better understand tail-risk; and

Aggregate empirical results at the portfolio-, deal- and tranche- levels.

4.1.3 Economic Analysis

Economic capabilities to test trigger and call features in CRT transactions;

Pricing/cost features from an investor perspective and the Enterprises; and

Access to the cost of coverage.

4.1.4 CRT Data Availability and Presentation

A graphical user interface for viewing input data and empirical results;

Accessibility to the full collection of publicly available CRT transactions for the Enterprises including, but not limited to, data and deal structures;

A CRT data feed including monthly performance updates and new issuance;

Exporting features to transport data to MS Excel, Tableau, or similar software;

Visualization features of empirical results of scenarios and simulation analyses; and

Compatibility with recent versions of commonly used web browsers, specifically MS’s Internet Explorer/Edge and Google Chrome.

4.1.5 License Ancillary Services

License to the CRT analytics tool, at a minimum, must include:

a. Information technology (IT) help-desk support services, through email and/or telephone. The support should be comparable to the support it generally provides in the commercial marketplace. Help-desk support services include, but are not limited to, troubleshooting errors, login/access issues, questions related to the tool (i.e., IT/technical issues), etc. Help-desk support must provide resolution within one (1) business day of receipt of either question or request. Support must be available 9AM to 5PM Eastern Time Monday through Friday (except Federal Holidays and/or days the Contractor has determined as holidays for its employees);

b. Subject matter expert/technical support services, through email and/or telephone. The support should be comparable to the support it generally provides in the commercial marketplace. Subject matter expert/technical support services include, but are not limited to, answering modeling/data/mortgage deals-specific questions, model validation issues, data updates, etc. Support must provide resolution within one (1) business day of receipt of question or request. Support must be available 9AM to 5PM Eastern Time (ET) Monday through Friday (except Federal Holidays and/or days the Contractor has determined as holidays for its employees);

c. Initial set-up and configuration of the tool, if any, on an enterprise- basis (i.e.

any overall FHFA-specific account set up); and

d. Training on the tool for new users through, but not limited to, written and electronic user manuals and interactive training such as conference call, remote slideshow presentations, web-based interactive meeting/test environment webinars, etc. The training should be comparable to the support it provides to other customers.

4.2 Ad-Hoc Customization Services (Labor-Hour Services)

The Contractor must, on an as-needed/as authorized by FHFA basis, provide ad-hoc, labor-hour (LH) customization services to the mortgage analytics tool. The customizations are separate from the basic license of the CRT analytics tool and may include, but are not limited to, the following:

4.2.1 Providing modifications to existing reports and datasets beyond what is included in the license for the CRT analytics tool; and

4.2.2 Developing and delivering newly created reports and data functionalities beyond what is included in the license for the CRT analytics tool.

Specific labor categories with applicable labor descriptions, requirements (i.e., education and experience levels), and labor rates will be stipulated and agreed to in the contract schedule and in accordance with the available labor categories on the Contractor’s General Services Administration (GSA) Schedule contract. For such customizations and modifications, the Contracting Officer’s Representative (COR), first consulting with the Contracting Officer (CO), will provide a list of customization requirements to the Contractor. Upon receiving the request, the Contractor shall submit an estimate for the work effort (i.e., estimated labor categories, amount of labor hours, and applicable labor rates as defined in the contract) within three (3) business days of receiving the request. The CO will review the Contractor’s estimate, with consultation from the COR, and provide either written authorization, or written rejection, for the services within five (5) business days. No labor-hour, ad hoc customization services shall be initiated without the advance written authorization of the CO, who will specify the scope of work (i.e., number of labor hours and amount of funding) the Contractor must not exceed.

5.0 DELIVERABLES

5.1 The Contractor must provide an end-user manual and other related technical documents necessary to efficiently and conveniently operate the tool, within ten (10) business days after task order award.

5.2 The Contractor must provide access to an operational mortgage analytics tool within ten

(10) business days after task order award. In addition, FHFA remains open to other analytic tools that comply with FHFA and federal information system requirements. The mode of delivery must be web-based. For accessing a web-based/cloud-based CRT analytics tool, the Contractor shall provide access to its website and assist with any necessary installation and troubleshooting (as detailed in Section 4.1.4). The Contractor must provide login credentials for all end users through email and assist with accessing, installing, and troubleshooting.

5.3 The Contractor must provide initial end-user training within thirty (30) business days after task order award. The Contractor must provide training to any additional end-users as end-users are added and upon request by the COR.

5.4 The Contractor must provide access to up-to-date model development documentation that underlie the analytic and quantitative techniques performed by the tool, within ten

(10) business days after task order award.

5.5 The Contractor must provide support/help desk services as needed by FHFA end users, throughout the performance period of the task order, as detailed in Section 4.1.4.

5.6 The Contractor must provide regular updates to the tool, including its modeling and underlying data, as required to maintain operability.

5.7 In addition, for any written deliverables, the Contractor must ensure they are in an electronic format (e-documents) — either in a MS Office product format (Word/PowerPoint/Project/Excel) or an Adobe Acrobat PDF format and are in compliance pursuant to Section 508 of the Rehabilitation Act of 1973, as amended (29 USC 794d), and its implementing standards and guidelines (36 CFR Part 1194).

6.0 GOVERNMENT-FURNISHED PROPERTY

Unless otherwise agreed as part of an on-premise solution, FHFA will not furnish government property for the Contractor to fulfill the requirements of this task order.

However, if the Contractor visits FHFA Headquarters (400 7th Street, SW, Washington, D.C. 20219) for training and related purposes, FHFA may furnish temporary access to desks, chairs, office space, internet access, network-access, and other common office furnishings.

7.0 SECURITY

Primarily, the Contractor will not work at FHFA Headquarters. Further, the Contractor may visit FHFA Headquarters for training and related sessions on a temporary basis. In these events, the FHFA COR will coordinate visitor access and escorting duties.

The Contractor shall provide written assurance that its information technology systems comply with the requirements set forth by NIST Special Publication 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations. The following are acceptable forms of assurance:

7.1 A FedRAMP Provisional Authorization (P-ATO) by the FedRAMP Joint Authorization

Board (JAB), or Agency Authorization (A-ATO) from a customer agency;

7.2 Completed Security Assessment and Authorization (SA&A) package in accordance with NIST Special Publication 800-53, Rev. 4 security control framework or FedRAMP framework, to include:

a. Completed and signed System Security Plan (SSP);

b. Completed and signed Information System Contingency Plan (ISCP);

c. Security Control Assessment (SCA) Results;

d. Security Assessment Report (SAR); and

e. Plans of Action and Milestones (POA&M)

7.3 If the information system has not received a FedRAMP P-ATO or A-ATO, and has not undergone an assessment in accordance with the NIST Special Publication 800- 53, Rev. 4 or the FedRAMP framework, the Contractor shall complete and submit the Security Assessment Questionnaire for Information Systems Operated on Behalf of

FHFA to the FHFA Contracting Officer (CO) to attest to the level of compliance the Contractor has achieved with respect to the NIST Special Publication 800-53, Rev. 4 framework. Upon request, the Contractor shall provide additional information as necessary for FHFA to assess compliance with NIST Special Publication 800-53, Rev. 4.

7.4 The Contractor shall ensure compliance with all federal security requirements throughout the life of the task order, including compliance with any subsequent and/or new security requirements as they are updated and evolve over time.

8.0 INFORMATION TECHNOLOGY SECURITY REQUIREMENTS

8.1 Requirements for solutions that may be COTS or externally hosted cloud solutions.

a. The solution supports encryption of data at rest and data in transit using FIPS 140- 2 approved algorithms;

b. The solution implements role-based access control to allow for a least privilege access model;

c. The solution audits user-activity and allows FHFA privileged users to view audit reports; and

d. The solution supports single-sign on using FHFA’s system login credentials via Security Assertion Markup Language (SAML) 2.0 and function in a “Service Provider” or “Relying Party” type role where FHFA serves as the Identity Provider.

f. The solution supports the termination of user sessions after 15 minutes of inactivity or a time period to be defined by FHFA, however, any processing shall not be impacted by the session timeout requirement. For example, if a user executes analysis tasks that require processing time over the specified session termination timeout, the processing will continue in the application. The user will then be able to authenticate to the system to download the analysis.

8.2 Additional requirements for COTS hardware or software supporting networked information technology:

a. The solution shall be capable of transmitting, receiving, processing, forwarding and storing digital information utilizing system packets that are formatted in accordance with commercial standards of Internet Protocol (IP) version 6 (IPv6) as set forth in the USGv6 Profile (NIST Special Publication 500-267) and corresponding declarations of conformance defined in the USGv6 Test program.

b. The solution shall also maintain interoperability with IPv4 systems and provide the same level of performance and reliability capabilities.

8.3 Additional requirements for externally hosted cloud solutions:

a. The solution undergoes periodic penetration testing and the vendor tracks and reports on the remediation of identified vulnerabilities;

b. All data in use and at rest, and data backups/storage must reside within the U.S.;

c. Only authorized contractor personnel (including subcontractor personnel) with appropriate background investigations and authorization shall access FHFA data and backups;

d. The solution provides an exit/transition strategy avoiding vendor lock-in and it;

i. Ensures that FHFA is able to retrieve all data placed in the cloud environment in a timely manner;

ii. Can be executed quickly to ensure continuity of service;

iii. Transfers all FHFA data to the Government in a predefined format;

iv. Maintains, backs up, and secures the data until it is returned; and

v. Transfers all data without additional charge to the Government.

9.0 LICENSE AGREEMENT MINIMUM REQUIREMENTS

The license agreement for the CRT analytics tool, at a minimum, must include and/or conform to the following requirements:

9.1 At the termination or expiration of the license agreement, FHFA shall have the right to maintain and use indefinitely print or electronic copies of its reports, presentations, or other content created in accordance with the license agreement;

9.2 Authorized end users may be from multiple divisions across FHFA, and may concurrently access and use the tool from their official duty stations or via remote access when such end users are conducting business for the benefit of FHFA;

9.3 FHFA does not permit compliance audits; however, the license agreement may require that FHFA will provide written assurance of its compliance or other alternative agreed to in writing by the Contracting Officer;

9.4 The license agreement shall not include an indemnification of the Contractor by the FHFA;

9.5 The license agreement shall be governed by, and construed in accordance with, the federal laws of the United States of America;

9.6 The Contractor shall represent and warrant that it makes commercially reasonable efforts to ensure that the software, data, or product as applicable is free of any viruses, worms, Trojan horses, malware, and/or other malicious code;

9.7 The license agreement shall not include terms that authorize assignment of the task order except in accordance with Federal Acquisition Regulation Subpart 42.12;

9.8 Contractor shall acknowledge and agree that if there is a conflict between the terms and conditions of the license agreement and those of the task order, the task order governs;

9.9 The license agreement shall permit FHFA to use the analytic tool for official

Government purposes, including but not limited to reports, presentations, graphs, public releases, other publications, and examination of the regulated entities; and

9.10 The license agreement may acknowledge that FHFA is a federal government agency and is exempt, by law, from the payment and collection of sales taxes.

10.0 INFORMATION TECHNOLOGY ACCESSIBILITY (SECTION 508) (BEST

MEETS EXCEPTION IS APPLIED)

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities. As such, the following requirements apply to this solicitation:

10.1 Products, platforms and services delivered as part of this work statement that are

ICT, or contain ICT, must conform to the Revised 508 Standards, which are located at 36 C.F.R. § 1194.1 & Apps. A, C & D, and available at https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines

10.2 E102 / 702.10 – Web Content Accessibility Guidelines (WCAG) success criteria level A & AA are incorporated as a requirement. The referenced WCAG criteria is available at http://www.w3.org/TR/WCAG20/

10.3 E202.7 – Best Meets Exception applied.

Applicable Functional Performance Criteria

All functional performance criteria apply when using an alternative design or technology that achieves substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4-6 of the Revised 508 Standards, or when Chapters 4-6 do not address one or more functions of ICT.

Applicable Requirements for Software and Web Products

Web deliverables/tools and access shall conform to the following standards:

• E207 – WCAG Level A & AA Success Criteria

• E302 – Functional Performance Criteria

• E502 – Interoperability with Assistive Technology

• E503 – Application

Electronic Documents and/or Support Services

All services and deliverables such as reports, training materials, support documentation and plans, shall conform to the following standards:

• E205 – WCAG Level A & AA Success Criteria

• E302 – Functional Performance Criteria

• E602 – Support Documentation

• E603 – Support Services

11.0 PERIOD OF PERFORMANCE

The period of performance will be for one (1) year base period and, if all option are exercised, four (4) twelve-month option periods beginning from the task order effective date.