DRAFT Vendor Risk Management Program_PWS_SoleSource_ORAD 02.09.2021_Final (002).pdf

Performance Work Statement (PWS) 10/30/2020

Third Party / Vendor Risk Management

(VRM) Program

Version 1.0

Vision Statement

1 General Information

1.1 Introduction

1.2 Background

1.3 Constraints

1.4 Description of Services

1.5 Non-Personal Services

1.6 Period of Performance

1.7 Place of Performance

1.8 Hours of Operation

1.9 Special Qualifications

1.10 Post Award/Kickoff Conference

1.11 Status Meetings

1.12 Contractor Travel

1.13 Transition In

1.14 Transition Out

2 Definitions and Acronyms

2.1 Definitions

2.2 Acronyms

3 Government-Furnished Property and Services

3.1 Government Services

3.2 Facilities

3.3 Equipment

3.4 Materials

3.5 Quality Assurance (QA)

4 Contractor-Furnished Items and Services

4.1 Facilities

4.2 Equipment

4.3 Material

4.4 Contractor Responsibilities

4.5 Contractor Personnel

4.6 Identification of Contractor Employees

4.7 Quality Control

4.7.1 Quality Control Plan

5 Specific Tasks

5.1 Task One - Program Management (Scope Area 2)

5.2 Task Two - Update of VRM Framework (Scope Area 10)

5.3 Task Three - Vendor Assessments (Scope Area 10)

5.4 Task Four - Service Organization Monitoring and Risk Mitigation (Scope Area 10)

5.5 Task Five - Information Technology (IT) Governance (Scope Area 10)

5. Task Seven - VRM Governance Document Updates (Scope Area 7)

5.8 Task Seven - VRM Training (Scope Area 5)

5.9 Task Eight - Special Projects (Scope Area 10)

6 Deliverables

6.1 Quality Control Plan

6.2 Acceptance Criteria

7 Performance Requirements Summary

8 Related Documents

Performance Work Statement (PWS) Third Party / Vendor Risk Management (VRM) Program

Vision Statement

To strengthen the Vendor Risk Management Program (VRM) to enable an optimized approach to the identification and remediation of third party / vendor compliance issues as well as implementation of effective risk mitigation strategies through consistent reporting and monitoring of Ginnie Mae's vendors.

1 General Information

1.1 Introduction

The U.S. Department of Housing and Urban Development (HUD), Government National Mortgage Association (Ginnie Mae) Office of Enterprise Risk (OER) requires contractor support to strengthen for the continued enhancement, administration, and execution of its Third Party / Vendor Risk Management (VRM) Program, service organization monitoring, and risk mitigation and Information Technology (IT) governance support.

1.2 Background

The U.S. Department of Housing and Urban Development (HUD) Government National Mortgage Association (Ginnie Mae) is seeking Contractor support to execute the VRM Program, an internal assessment of mission critical third-party vendors that support our essential functions. Ginnie Mae defines VRM as the programmatic approach to identifying, assessing and managing risks associated with engaging third parties to provide goods and services or act as an agent on behalf of the organization to support the organization’s business goals.

Ginnie Mae’s vision for the VRM program is to facilitate improved decision-making through a structured understanding of opportunities and threats as well as implementing strategies to ensure effective use of resources, enable an optimized approach to the identification and remediation of compliance issues, and promote consistent reporting and monitoring of vendors across business units. Full ownership of VRM must occur at all levels of the organization to promote effective and efficient operations in an effort to reduce risks to acceptable tolerance levels.

Ginnie Mae’s VRM Framework objectives are to:

• Update segmentation workbook of existing or potential vendor relationships.

• Obtain relevant vendor related background information to assist Ginnie Mae in our assessment of selected vendors.

• Evaluate vendor effectiveness to determine whether vendor or third-party performance is in line with procurement specifications and business needs.

• Identify residual risks to services / products purchased by Ginnie Mae, and identify deficiencies resulting from assessments.

• Report and present to executive management and other stakeholders’ risks of adverse events caused by or affecting Ginnie Mae’s vendors and/or material third parties as it pertains to Ginnie Mae’s operations.

• Engage and work collaboratively with business owners to create plans of action to address and resolve identified gaps.

Ginnie Mae’s VRM Framework is a six-part dynamic and iterative-phased methodology which includes: (1) Plan, Define Risks, and Scope Assessment; (2) Information Gathering; (3) Assess Documentation and Management of Vendors; (4) Identify Gaps, Analyze Risks, and Rate Vendors; (5) Report and Communicate Assessment Status and Results; and (6) Implement Mitigation Strategies and Recommendations.

This approach to managing third-party risks assists Ginnie Mae in providing comprehensive internal controls and ongoing management of major vendor risks inherent in Ginnie Mae’s business activities.

1.3 Constraints

The services identified in this TO will adhere to the rules, regulations, laws, standards, and conventions identified by HUD as well as within the Federal Government. Constraints include the following and any subsequent updates:

SSAE No. 18, Attestation Standards: Clarification and Recodification, (April 2016) https://www.aicpa.org/content/dam/aicpa/research/standards/auditattest/downloadabledocuments/s sae-no-18.pdf

AT-C Section 320 Reporting on an Examination of Controls at a Service Organization Relevant to User Entities Internal Control Over Financial Reporting https://www.aicpa.org/content/dam/aicpa/research/standards/auditattest/downloadabledocuments/ at-c-00320.pdf

Committee of Sponsoring Organizations of the Treadway Commission (COSO), Enterprise Risk Management Integrating with Strategy and Performance https://www.coso.org/Pages/erm.aspx

The Green Book, Standards for Internal Controls in the Federal Government https://www.gao.gov/assets/670/665712.pdf September 2014

U.S. Department of Housing and Urban Development HUDAR, https://www.hud.gov/program_offices/cpo/hudar

Federal Acquisition Regulation https://www.acquisition.gov/browse/index/far

Office of the Comptroller of Currency (OCC Bulletin 2013-29), https://www.occ.gov/news-issuances/bulletins/2013/bulletin-2013-29.html

Federal Information Security Modernization Act of 2014 https://www.congress.gov/bill/113th-congress/senate-bill/2521

As well as Federal Information System Controls Audit Manual (FISCAM) and National Institute of Standards and Technology (NIST) standards and regulations such as the Electronic Funds Transfer Act, Fair Debt Collection Practices Act, HIPAA, Real Estate Settlement Procedures Act and Foreign Corrupt Practices Act, among others.

1.4 Description of Services

The Contractor shall assist the Ginnie Mae OER, Operational Risk Analysis Division (ORAD) with the continued enhancement, administration and execution of its VRM Program. The VRM Program will provide oversight of Ginnie Mae vendors and related staff to ensure their activities are conducted in compliance with vendor contract requirements and stated applicable laws and regulations. The Contractor will perform annual VRM assessments for Ginnie Mae’s Tier 1 vendors using Ginnie Mae’s VRM Framework. The Contractor will also provide service organization monitoring and risk mitigation and Information Technology Governance support. The Contractor as directed by the Contracting Officer (CO) and Contracting Officer's Representative (COR) / Program/Project Manager (PM) will provide the following services which shall include:

o Program Management o Update of VRM Framework o Vendor Assessments o Service Organization Monitoring and Risk Mitigation o Information Technology Governance o Governance Document Updates o Training Services o Special Projects

Detailed descriptions of specific tasks are provided in Section 5 Specific Tasks and Deliverables.

Ginnie Mae’s Tier 1 vendors cannot bid on this Third Party / VRM Program procurement.

Once awarded the contract, if the awardee is viewed as a competitor by a Ginnie Mae Tier 1 vendor, the awardee will be required to sign a mutually agreeable Non-disclosure Agreement (NDA) with the Ginnie Mae Tier 1 vendor before conducting the applicable Tier 1 VRM Assessment.

1.5 Non-Personal Services

The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual Contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services.

If the Contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the Contractor's responsibility to notify the Contracting Officer (CO) immediately. These services shall not be used to perform work of a policy, decision making, or management nature, i.e. inherently Government functions. All decisions relative to programs supported by the Contactor shall be the sole responsibility of the Government.

1.6 Period of Performance

The Period of Performance shall be four (4) months.

1.7 Place of Performance

The services to be performed under this contract shall be performed at Contractors facility, with the exception of when the Contractor will be at the government facility to attend meetings and conduct VRM interviews.

1.8 Hours of Operation

N/A

1.9 Special Qualifications

The Contractor shall have the following risk and compliance industry certifications:

• Certified Public Accountant (CPA)

• Certified Information Systems Auditor (CISA)

• Certified Internal Auditor (CIA)

• Certified Fraud Examiner (CFE)

• Committee of Sponsoring Organizations (COSO)

• Certified Government Financial Manager (CGFM)

1.10 Post Award/Kickoff Conference

The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The Government intends to convene a Post Award Conference with the Contractor within ten business days after contract award. The Contracting Officer will notify the Contractor of the specific date, location, and agenda within five (5) business days after contract award.

1.11 Status Meetings

The Contracting Officer, Contracting Officers Representative (COR), Program/Project Manager (PM) and other Government personnel, as appropriate may meet periodically with the Contractor to also review Contractor performance, requirement status, etc. At these meetings, the Contracting Officer will apprise the Contractor of how the Government views the Contractor's performance or progress of the requirement. The Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government. Post Award Conference and subsequent meetings may be held via teleconference.

1.12 Contractor Travel

Prior to travel, the Contractor shall coordinate with and receive Government authorization from the COR for all travel. Reimbursement of travel costs will be in accordance with the Federal Travel Regulation and in accordance with FAR 31.205-46. The Contractor shall travel using the lower cost mode transportation commensurate with the mission requirements. When necessary to use air travel, the Contractor shall use the tourist class, economy class or similar lodging accommodations to the extent they are available and commensurate with the mission requirements. HUD will not reimburse Contractor's local travel. Local travel is defined as travel within fifty (50) miles of Washington, DC. All other travel will be reimbursed on a cost reimbursable basis; no profit or fee will be paid.

1.13 Transition In

1.14 Transition Out

2 Definitions and Acronyms

2.1 Definitions

Business/Workdays - Every official workday of the week which are days between and including Monday to Friday. This does not include public holidays and weekends.

Calendar Day - Any day of the week.

Contractor - A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Contracting Officer (CO) - A person with authority to enter into, administer, and/or terminate contracts and make related determinations and findings on behalf of the Government. Note: the only individual who can legally bind the Government.

Defective Service - A service output that does not meet the standard of performance associated with the Performance Work Statement.

Deliverable Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

Government Furnished Property (GFP) - Government-furnished property means property in the possession of, or directly acquired by, the Government and subsequently furnished to the Contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification.

Government-furnished property also includes contractor-acquired property if the contractor-acquired property is a deliverable under a cost contract when accepted by the Government for continued use under the contract.

Contracting Officer's Representative (COR) - An employee of the U.S. Government appointed by the Contracting Officer to perform contract administration activities regarding technical issues.

This individual has authority to provide technical direction to the Contractor as long as direction is within the scope of the contract, does not constitute a change and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

Performance Requirements Summary (PRS) - A listing of the performance requirements under the contract that are to be evaluated by the Government on a regular basis, performance indicators for these requirements, performance standards for these requirement and surveillance methods to be used to determine if performance standards are met.

Performance Standard - The Contractor's performance level required by the Government.

Performance Work Statement (PWS) - A statement of work for performance-based acquisitions that describe the required results in clear, specific and objective terms with measurable outcomes.

Physical Security - Actions that prevent the loss or damage of Government property.

Quality Assurance (QA) - Policies and procedures adopted by the Government to ensure that supplies and services acquired under Government contracts conform to the contracts quality requirements.

Quality Assurance Surveillance Plan (QASP) - A plan describing how the agency will survey, observe, test, sample, evaluate and document the Contractor's performance in meeting critical performance standards identified in the contract.

Quality Control (QC) - All necessary measures taken by the Contractor to assure that the quality of an end-product of service shall meet contract requirements.

Service Contract - A contract that directly engages the time and effort of a Contractor whose primary purpose is to perform an identifiable task rather than to furnish an end item of supply.

Subcontractor - Any person , other than the prime Contractor, who offers to furnish or furnishes any supplies, material, equipment, or services of any kind under a prime contract or a subcontract entered into in connection with such prime contract, and any person who offers to furnish or furnishes general supplies to the prime contractor or a higher tier subcontractor. The Government does not have privity of contract with a subcontractor.

Tier 1 Vendors Ginnie Mae’s current Tier 1 vendors include: (1) the Mortgage Backed Securities Issuance & Bond Administration (MBSIBA) Contractor (currently called the Pool Processing Agent and Central Paying & Transfer Agent (PPA/CPTA) Contractor), (2) the Mortgage Backed Securities Operations & Analytics (MBSOA) Contractor, (3) the Ginnie Mae IT Infrastructure Consolidation Contractor, the (4 & 5) two Single Family Master Subservicer (MSS) Contractors, (6) the Ginnie Mae Financial Accounting Services Contractor and (7) the Multiple Award Blanket Purchase Agreements (BPAs) for Information Technology Services Contractors. Ginnie Mae anticipates awarding (8) a Cloud contract in late 2020 and eventually (9 & 10) a Multifamily (MF) MSS and a Home Equity Conversion Mortgage-Backed Securities (HMBS) MSS contract. These new contracts would also be considered Tier 1 vendors.

Work Week - Monday through Friday, unless specified otherwise.

2.2 Acronyms

AICPA - American Institute of Certified Public Accountants AQL - Acceptable Quality Level CCB - Change Control Board CCMB - Configuration Change Management Board CMMI - Capability Maturity Model Integration CFO or OCFO - Office of the Chief Financial Officer of HUD CFR - Code of Federal Regulations CIO or OCIO - Office of the Chief Information Officer of HUD CO - Contracting Officer COR - Contracting Officer’s Representative COTS - Commercial Off-the-Shelf CPO - Office of the Chief Procurement Officer of HUD CSF - NIST Cybersecurity Framework CUEC - Complementary User Entity Controls ERM - Enterprise Risk Management EST - Eastern Standard Time (U.S.)

ETC - Estimate to Completion FISCAM - Federal Information Systems Audit Manual FISMA - Federal Information Security Modernization Act of 2014 GAO - U.S. General Accounting Office GFP - Government-Furnished Property HUD - U.S. Department of Housing and Urban Development HUDAR - HUD Acquisition Regulation HUD/ISG - Internet Services Group within the Telecom Processing Division HUD Web - HUDs Intranet Web Site and related WEB pages.

IG or OIG - Inspector General (Office of) IT - Information Technology IV&V - Independent Validation and Verification KPI - Key Performance Indicator KRI - Key Risk Indicator MSS - Master Subservicer NIST - National Institute of Standards and Technology OCFO - Office of the Chief Financial Officer OCM - Office of Capital Markets OCPO - Office of the Chief Procurement Officer OEDTS - Office of Enterprise Data & Technology Solutions OER - Office of Enterprise Risk OI - Operational Incident OIG - Office of Inspector General OIPM - Office of Issuer and Portfolio Management OMB - Office of Management and Budget OMO - Office of Management Operations OSO -Office of Securities Operations OSPPC - Office of Strategic Planning, Policy Communications ORAD - Operational Analysis Division PL - Public Law PM - Program Manager POC - Point of Contact

PPM - Project Planning and Management PWS - Performance Work Statement QA - Quality Assurance QASP - Quality Assurance Surveillance Plan QCP - Quality Control Plan RCSA - Risk and Controls Self-Assessment SF - Standard Form SOC - System and Organization Controls SSAE 18 - Statement on Standards for Attestation Engagements TO Task Order TOD - Test of Design TBD - To be determined U.S.C - United States Code VRM Vendor Risk Management

3 Government-Furnished Property and Services

The Contractor shall ensure accurate control and accountability of all Government-Furnished Property (GFP) in accordance with the terms and conditions of this contract. The Government will furnish, at no cost to the Contractor, the GFP shown below.

3.1 Government Services

The Government will not provide services.

3.2 Facilities

The Government expectation is the place of performance to be at Contractor's facility, and government will not provide office space, cubicle, or work area herein referred to as "office". That said, if a meeting is required for interviews or discussion the contractor will be allowed onsite to attend meetings and conduct VRM interviews. Prior approval is necessary before a Contractor can utilize Government office space.

3.3 Equipment

The Government will not provide access to printers, copiers, fax machines, etc., when the Contractor staff is at Ginnie Mae facilities to attend meetings or conduct VRM interviews. Meeting space will only be provided upon determination of need by the Government.

3.4 Materials

Copies of required materials may be provided to the Contractor in hard copy or soft copy. All materials will remain the property of the Government and will be returned to the COR upon request or at the end of the contract period.

3.5 Quality Assurance (QA)

The Government shall evaluate the Contractor's performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable quality level.

4 Contractor-Furnished Items and Services

The Contractor shall furnish, all facilities, equipment, and supplies required to perform the work under this contract that are not listed under Government-Furnished Property and Services.

4.1 Facilities

The Contractor shall furnish all necessary facilities to meet the requirements under this TO.

4.2 Equipment

The Contractor shall furnish all required equipment to fulfill the requirements of the TO.

4.3 Material

The Contractor shall furnish all materials to meet the requirements under this TO.

4.4 Contractor Responsibilities

The Contractor shall only conduct business with designated Government personnel listed as points of contact (POCs). Names of authorized personnel shall be provided to the Contractor by the Government, in writing, and updated as necessary throughout the contract period.

U.S. Government records, copies of original results and reports, verified original data, corrected data and corrected supporting final reports which are maintained by the Contractor remain the property of the U.S. Government. These files/results must be surrendered to the COR/PM.

4.5 Contractor Personnel

The Contractor shall provide a Contract/PM who shall be responsible for the performance of work.

An alternate shall also be designated to act in the absence of the Contract/PM. These Contractor personnel (main point of contact and alternate point of contact) are considered Key Personnel by the Government and shall be listed as such in accordance with HUDAR 2452.237-70, "Key Personnel. The Contract/Project Manager and alternate shall have full authority to act on all contact matters relating to daily operations of this contract. Accordingly, at a minimum, the points of contact shall have the technical knowledge of the requirement and be in the position to actually receive assignment, guidance, and direction from the COR, PM, and CO per HUDAR 2452.237-73, "Conduct of Work and Technical Guidance" and shall be allocated enough hours to the requirement to ensure successful performance. These points of points of contact shall each be an employee of the Contractor. An employee of a subcontractor is not acceptable for either of these positions. The Contract/Project Manager or alternate shall be available between the hours of 8:00am to 4:30pm Monday through Friday EST, except Federal Holidays or when the Government facility is closed for administrative reasons.

4.6 Identification of Contractor Employees

All Contractor/subcontractor personnel shall wear company picture identification badges as to distinguish themselves from Government employees. When conversing with Government personnel during business meetings, over the telephone, or via electronic mail, Contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees.

Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation.

Where practicable, Contractor/subcontractors occupying collocated space with their Government program customer shall identify their work space area with their name and company affiliation, or at a minimum, "Contractor" after name.

4.7 Quality Control

The Contractor shall establish and maintain a complete quality control program that shall ensure services are performed in accordance with this contract. The Contractor shall develop and implement procedures to identify, prevent, and ensure non reoccurrence of defective services. The Contractor's quality control program is the means by which he assures himself that his work complies with the requirements of the contract. The Contractor shall provide the associated Quality Control Plan to the Government as directed.

4.7.1 Quality Control Plan

The Contractor shall develop, maintain, enforce, and document a Quality Control Plan (QCP). The QCP shall ensure the Government receives the level of quality that is consistent with the requirements specified in this contract. The QCP shall be sufficiently detailed to provide the Contractor's methodology for identifying and recruiting qualified personnel. The QCP shall also provide the Contractor's methodology for resolving problems identified by the Government during reviews conducted in accordance with its Quality Assurance Surveillance Plan (QASP). The QCP shall also provide the Contractor's methodology for establishing an internal feedback system for support personnel, and for resolving problems identified by that feedback system. The QCP shall demonstrate and validate that the services or deliverables to be provided under the contract are completed with a level of quality that meets the minimum performance threshold established in the Government's QASP. The QCP shall address Quality Management Approach, Quality Assurance, Quality Control and Quality Standards.

5 Specific Tasks

5.1 Task One - Program Management (Scope Area 2)

The Contractor shall provide program management support under this task order (TO). This includes the management and oversight of all activities performed by contractor personnel, including subcontractors, to satisfy the requirements identified in this TO.

5.1.1 Weekly Status Meetings & Reports

The COR/PM and other Government personnel will meet weekly with the Contractor to review Contractor performance, contract requirement, engagement status, etc. The Contractor shall apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

Post Award Conference and subsequent meetings may be held via teleconference. The Contractor shall provide the COR minutes of these meetings, including attendance, issues discussed, decisions made, and action items assigned, within two (2) business days following the meeting.

By the second day of each work week, the Contractor PM shall develop and provide a Weekly Status Report using Microsoft (MS) Office Suite applications to the COR/PM.

The Weekly Status Report shall include, at a minimum:

1. Activities during reporting period, by task (on-going activities, new activities, activities completed; progress to date on all above-mentioned activities). Start each section with a brief description of the task.

2. Problems, risks, issues and corrective actions taken or proposed resolutions to address them.

3. Personnel gains, losses, and status (security clearance, etc.).

4. Government actions required.

5. Schedule (show major tasks, milestones, and deliverables; planned and actual start and completion dates for each).

6. Accumulated invoiced cost for each CLIN up to the previous month.

7. Projected cost of each CLIN for the current month.

Deliverables A001 Weekly Status Reports

5.1.2 Project Work Plan

The Contractor shall submit a Draft Project Work Plan (PWP) for the contracted services within five

(5) business days of contract award. A Final PWP shall be provided within seven (7) business days after receiving Ginnie Mae’s comments on the Draft PWP. Changes to the PWP shall be reviewed and accepted by the COR/PM and Contractor's Project Manager prior to work beginning. The PWP shall be updated annually. Provisions will be established to update the PWP at appropriate junctures, as directed by the COR/PM.

The PWP shall consist of a narrative description and a graphic summary of the schedule and financial elements of the contract. The PWP shall identify information such as, but not limited to, background (vendor being reviewed), purpose (of the review), scope, methodology, level of effort (resource hours, levels, and dollars), and identify each of the milestones to be accomplished in meeting the requirements of the TO. Each milestone will have a projected completion date, a summary of the activities required and identification of any input from the COR/PM.

Performance Standards

a) Standard: The PWP is submitted within seven (7) business days after receiving Ginnie Mae’s comments on the Draft PWP.

AQL: Zero deviation.

A002 Draft and Final Project Work Plan

5.2 Task Two - Update of VRM Framework (Scope Area 10)

The Contractor shall assist Ginnie Mae with updating and producing the VRM Framework on an annual basis. All methodologies and framework related activities should be documented and all procedures must be approved by the COR/PM prior to any VRM Framework activities being finalized.

a. The Contractor shall provide recommended updates to Ginnie Mae’s VRM Framework, the VRM Assessment Plan along with supporting tools and templates, presentations and Dashboards, and develop additional tools and templates as needed. Templates and tools include but are not limited to, VRM Framework, Assessment Plan, questionnaire templates, the Risk Register, VRM PowerPoint templates, vendor inventory, and key risk indicators/thresholds. This also includes documenting the evaluation methodology for each control.

b. Update Ginnie Mae’s VRM Framework and Risk Focus Areas for any new AICPA, GOA, OMB, FISMA, FISCAM, HUD, government or agency requirements and the latest industry best practices in accordance with NIST and COSO guidelines.

c. Incorporate and update VRM Framework and Risk Focus Areas for any new or revised Ginnie Mae related risk initiatives as applicable. Incorporate and update for any changes in Ginnie Mae’s MBS business landscape, business processes, policies or procedures that impact VRM (e.g., budget, strategic planning, internal controls, etc.).

A004 Draft and Final VRM Framework, Assessment Plan, and Supporting Tools and Templates

5.3 Task Three - Vendor Assessments (Scope Area 10)

The Contractor shall perform VRM assessments for two (2) Ginnie Mae vendors during the period of performance of this TO. All Vendor Assessments should be completed by May of each year.

The vendor assessments will cover all VRM Framework Risk Focus Areas (see "VRM Framework Risk Focus Areas below).

Tier 1 Vendors Draft VRM Assessment Schedule

1. Single Family Master Subservicer #1

2. Single Family Master Subservicer #2

For the specific VRM Information Security Risk Focus Area assessment requirements by Tier 1 vendor, please see Attachment A VRM Information Security Risk Focus Area Requirements.

The work for the Service Organization Monitoring Risk Focus Area will be performed under Task Four: Service Organization Monitoring and Risk Mitigation with the work being executed concurrently as part of the overall Task Three: Vendor Assessments for all Risk Focus Areas.

VRM Framework – Risk Focus Areas

*Note: Service Organization Monitoring work will be performed under Task Four: Service Organization Monitoring and Risk Mitigation.

The Contractor will adhere to Ginnie Mae’s established VRM procedures, processes and templates for VRM planning, evaluation, reporting and remediation and recommend enhancements based on best practices. Ginnie Mae will provide the priority order of the vendor assessments and ensure the required Ginnie Mae and vendor key stakeholder are available to support the applicable VRM activities.

Performance Standards

a) Standard: Completes Vendor Risk Segmentation by Tier, Scope Assessment, Draft and Final VRM Assessment Plans tailored for each Tier 1 vendor, and Initial Risk Register per timelines agreed to in the PWP.

AQL: Zero deviation. .

b) Standard: Completes Interview Questions, Questionnaire Forms and Templates, as well as Information Gathering, meeting minutes Documentation Acceptance Form and Business Process Handoff documentation.

AQL: Zero deviation.

c) Standard: Completes Risk Identification and Gap Analysis Assessment Report and Risk Register.

AQL: Zero deviation.

d) Standard: Completes Vendor Assessment Reports, VRM Dashboards and Executive Reports.

AQL: Zero deviation.

A005 Draft and Final Vendor Risks Segmentation by Tier A006 Draft and Final Scope Assessment A007 Draft and Final Initial Risk Register A008 Draft and Final VRM Program Assessment Plans tailored for each Tier 1 vendor A009 Draft and Final Interview Questions, Questionnaire Forms, and Templates A010 Draft and Final Information Gathering, Meeting Minutes, and Documentation Acceptance Forms A011 Draft and Final Business Process Handoff Documentation A012 Draft and Final Risk Identification and Gap Analysis Assessment Report A013 Draft and Final Risk Register A014 Draft and Final Vendor Assessment Reports A015 Draft and Final VRM Dashboard and Executive Report

5.3.1 Plan, Define Risks, and Scope Assessment

Annually, the Contractor shall work with Ginnie Mae to plan and schedule all key VRM assessment activities by performing vendor Scope Assessments. The Contractor shall update the VRM Assessment Plan tailored for each Tier 1 vendor.

a. The Contractor shall inventory and segment vendors into risk tiers based on the impact to Ginnie Mae’s operations. The analysis is performed with Ginnie Mae’s excel based Vendor Segmentation Workbook which segments vendors into three risk tiers based on criteria provided by Ginnie Mae.

b. All Tier 1 vendors will be assessed by the Contractor following Ginnie Mae’s VRM Framework and procedures. The current Tier 1 level vendors include (1) the MBSIBA Contractor (currently called the PPA/CPTA Contractor), (2) the MBSOA Contractor, (3) The Ginnie Mae IT Infrastructure Consolidation Contractor, the (4 & 5) two Single Family MSS Contractors, (6) the Ginnie Mae Financial Accounting Services Contractor, (7) the Multiple Award Blanket Purchase Agreements (BPAs) for Information Technology Services Contractors. Ginnie Mae anticipates awarding (8) a Cloud contract in late 2020 and eventually (9 & 10) a Multifamily (MF) MSS and HMBS MSS contract. These new contracts would also be considered Tier 1 vendors.

c. The Contractor will develop a Scope Assessment for each vendor to determine and appropriately size the annual VRM assessments. As part of this, the Contractor will begin to understand and document the inherent risks to Ginnie Mae’s operations for the vendor provided services in the Initial Risk Register.

d. The VRM Assessment Plan provides detailed steps for performing the assessment. It describes steps used to execute Ginnie Mae’s VRM Framework methodology phases two and three (Information Gathering and Assess Documentation and Management of Vendors). The results of completing this assessment plan will facilitate development of the vendor assessments results and risks rating as part of Ginnie Mae’s VRM Framework methodology phase four (Identify Gaps, Analyze Risk and Rate Vendors). The Assessment Plans support Ginnie Mae’s ongoing efforts to maintain oversight and management of its vendors to ensure their activities are conducted with effective internal controls and quality control standards in compliance with contract requirements and applicable laws and regulations.

1. The Contractor shall tailor the VRM Assessment Plan for each Tier 1 vendor before executing the vendor assessments. The VRM Assessment Plan and all procedures must be approved by the COR/PM and Ginnie Mae’s Operational Risk Division prior to assessments being performed.

5.3.2 Information Gathering

The Contractor shall gather a wide variety of vendor background information and documentation on each vendor for the services provided to Ginnie Mae including interviewing key Ginnie Mae and vendor stakeholders.

a. Gather Vendor and Ginnie Mae Documentation: Obtain existing Ginnie Mae and vendor information to facilitate assessments for the VRM Framework - Risk Focus Areas. Gather and validate documentation such as, relevant contract information, contract tasks and deliverables, contract service and compliance requirements, SLA performance reporting, key business processes, applications and systems and related.

b. Interview Key Stakeholders and Perform Walk Throughs:

1. Ginnie Mae Stakeholder Interviews and Walk-throughs: The Contractor shall conduct Ginnie Mae stakeholder interviews and perform walk throughs. As part of the interviews, obtain an understanding of the purpose, scope, and objectives of the services provided, along with Ginnie Mae’s internal assessments of vendor performance and potential risks.

Obtain information and documentation on Ginnie Mae’s vendor contract management processes, procedures, policies, internal controls and Ginnie Mae personnel criticality to be able to determine risks, gaps and mitigation strategies. Coordinate and conduct the Information Gathering Stakeholder Questionnaires with Ginnie Mae stakeholders. Provide meeting minutes of interviews and facilitate the Ginnie Mae stakeholder sign-off of the Documentation Acceptance Form.

2. Vendor Stakeholder Interviews and Walk-throughs: The Contractor shall conduct key vendor contact interviews and perform walkthroughs in conjunction with Ginnie Mae personnel to identify and gather existing information on vendor policies, processes and procedures, vendor personnel criticality, internal controls environment, and information technology applications and systems and related for the Risk Focus Areas. Coordinate and conduct the Information Gathering Vendor Stakeholder Questionnaires with Ginnie Mae’s vendor stakeholders. Provide meeting minutes of interviews and facilitate the Ginnie Mae stakeholder sign-off of the Documentation Acceptance Form.

3. Business Process Handoffs: Ginnie Mae will provide the Contractor with business process flowcharts. The Contractor will analyze the flowcharts to determine, and document, the business process handoffs between vendors and Ginnie Mae.

4. The Contractor shall document the results of the interviews and walkthroughs utilizing Ginnie Mae tools and templates as well as the approved meeting minutes format.

Information gathering results shall be included within the Vendor Assessment Report.

5.3.3 Assess Documentation and Management of Vendors

This due diligence phase includes evaluating the effectiveness of vendors to ensure that vendor performance is in line with procurement specifications and Ginnie Mae’s business needs. Reviews of vendors compliance with contract requirements and third-party due diligence reviews will be performed. The Contractor shall ensure all Assessment Plan steps are executed as part of the review and assessment. The Contractor shall review documentation and identify, assess and document risks and internal controls for both Ginnie Mae and the vendor. This includes assessing operations and design of vendor internal controls. The Contractor shall also assess Ginnie Mae’s management of the vendor contractual relationship. In determining nature, timing, and extent of review, the Contractor shall consider the risk, and complexity of services provided.

The VRM Assessment Plan shall provide the steps for the Contractor to perform the following for all Risk Focus Areas:

a. Assess, measure, monitor, rate, and assist Ginnie Mae in managing vendor risk by focusing on the documentation, people, processes, information security, pending or current legal issues, continuity of operations (COOP), vendors financial condition, and their ongoing ability to provide the required services. This also includes a Ginnie Mae and vendor personnel assessment.

b. Access information gathered to identify potential risks vendors pose to Ginnie Mae including, but not limited to, evaluating and concluding on the design and operational effectiveness of the vendors key business level controls. Determine mitigation strategies/controls that exist for identified risks.

c. Assess effectiveness of Ginnie Mae’s management of the vendor contractual relationship.

Identify, assess, and document risks, internal controls, and gaps in Ginnie Mae’s ongoing efforts to maintain oversight of its vendors. This should include a review and assessment of Ginnie Mae feedback on vendor performance and risk management activities.

5.3.4 Identify Gaps, Analyze Risks, and Rate Vendors

The Contractor shall identify, analyze, and document internal control and risk management gaps and deficiencies, and perform risk assessment evaluations and gap analysis to assess the risks to Ginnie Mae. This phase includes identifying the residual risks vendors pose to Ginnie Mae through the information gathering and assessing documentation and management of vendor phases. Gaps in risk mitigation will be identified and risks will be rated and scored for exposure to Ginnie Mae.

This includes performing gap ratings and remediation recommendations and overall vendor risk scoring. This will also include development of supporting, final Risk Register and Gap Analysis to document risk ratings.

a. Risk Assessment Evaluation: The Contractor shall conduct a risk assessment evaluation to determine the risks the vendors may present to Ginnie Mae in the eight Risk Focus Areas:

contractual, reputational, financial, legal, risk management, information security, business continuity, and service organization monitoring (see "VRM Framework Risk Focus Areas). The Contractor shall evaluate the overall health of the vendor, vendors reputation and performance, security and compliance requirements, internal control structure, operational incidents, performance metrics, etc.

b. Gap Analysis Assessment Report: The Contractor shall perform a Gap Analysis to identify gaps/deficiencies and any risks (contractual, reputational, financial, legal, risk management, information security, business continuity, and Service Organization Monitoring) the vendor may present to Ginnie Mae. The Gap Analysis Assessment Report provides inherent and residual risk scores of each risk identified during the assessment to establish final risk scores. It factors in gaps in vendor risk management, risk mitigation strategies, and recommendations for mitigating gaps identified. The Contractor will identify, and document gaps related to a deficiency in design, operating effectiveness, controls, and processes. The Contractor shall identify and analyze existing mitigation strategies and controls in place for the vendor risks and incorporate these into the gap assessment. The Contractor shall provide an impact analysis of these risks that shall be identified as the Risk Identification and Gap Analysis Assessment Report (Gap Analysis). The Gap results will be included as part of the Assessment Report. The Contactor shall also update the Final Risk Register.

1. The Risk Register will be updated and populated by the Contractor with VRM results (prior year Risk Register will be included in the update). The Risk Register will contain risk information based upon interviews with Ginnie Mae personnel and vendor personnel associated with the purpose, scope, and objectives of the contract services provided. The Risk Register shall include, but not limited to, risk category, risk description, risk impact description, risk owner, risk taxonomy, inherent risk scores and ratings (impact score, probability of occurrence score with resulting risk score and risk rating), mitigation strategies in place, gap, residual risk scores and ratings, and corrective actions.

2. Gap Analysis Rating and Recommendations: The VRM program rates gaps based on severity and provides recommendations for corrective actions to the business unit. The documentation of the gap should include the gap description, gap condition, gap root cause, gap example, criteria, gap impact, recommendations, and mitigation strategies with probability of occurrence, impact, and risk rating. Within this, the documentation should include the extent of the gap and whether compensating controls exist that mitigate the identified risk. Each gap documented should also provide specific, value added recommendations which can be utilized by Ginnie Mae to improve the deficient control and reduce the probability of occurrence.

c. Overall Risk Score: An overall risk score is calculated for each vendor under assessment based on the aggregated results encompassing all applicable risk focus areas. The risk rating is based on a residual risk impact to Ginnie Mae and a residual risk probability.

5.3.5 Vendor Assessment Reporting

The Contractor shall profile the vendor through the summarization of the results of the assessment in the Vendor Assessment Report and VRM Dashboards. Risks, gaps, mitigation strategies, and recommendations for vendor risk management will be included in the reporting.

a. Vendor Assessment Report: At the conclusion of the assessment, the Contractor shall provide Ginnie Mae a Vendor Assessment Report summarizing the results of the review. The Vendor Assessment Report shall contain a summary of the activities performed, the results and conclusions of each activity and shall identify risk areas, gaps/deficiencies in risk management, controls and processes, and areas of significant risk to Ginnie Mae including an impact analysis.

The report shall also prioritize the deficiencies noted for resolution and make recommendations on how to remediate these deficiencies. Additionally, the Vendor Assessment Reports will provide input to Ginnie Mae management on whether operational activities are affecting the goals, strategy, and financial reports of Ginnie Mae.

Below are the key components of the draft and final Vendor Assessment Report.

1. Executive Summary:

I. Background Information: Assessment background, vendor background, Risk Focus

Areas, the Executive Dashboard with key assessment results, the overall vendor score, and the VRM results overview which lists Ginnie Mae’s strengths and gaps or areas for improvement as well as the vendors strengths and gaps or areas for improvement.

II. Business Processes: Information about how the vendor supports Ginnie Mae’s key business processes including business function overviews for Ginnie Mae’s relevant divisions, and business process handoffs for relevant processes.

III. IT Dashboard: Summary of SSAE 18 SOC Reports Analysis for applicable vendors.

2. VRM Methodology:

I. Risk Focus Areas: The VRM Framework and Framework phase definitions.

II. Criteria: Impact categories and corresponding criteria, probability of occurrence criteria.

III. Data Collection: Data collection methods for risk validation as well as information about the risk identification and validation process.

IV. Scoring: Residual Risk Scoring, Heat Map, and overall vendor Risk Scoring.

3. VRM Assessment Results:

I. Summary Results: Overall risk score heat map and residual risk scores by Risk Focus Area heat map.

II. Risk Focus Areas Results: risk score results by residual risk heat maps by Risk Focus Area and residual and inherent risk scores by Risk Focus Area.

III. Gaps: Background info and impacts and risk response heat maps (from Gap Analysis Assessment Report described below).

4. Risk Response Recommendations:

I. Remediation Timelines: Recommended timelines to implement risk responses and corrective action plans (CAPs).

II. Personnel Criticality Assessment: criteria, Vendor Personnel Criticality Assessment Score results and Ginnie Mae Personnel Criticality Assessment Score results.

5. Other relevant information as required by Ginnie Mae.

b. VRM Dashboards and Executive Reports: Summarize assessment results, findings and recommendations in dashboards and reports for Ginnie Mae key stakeholders and executive management. The Dashboard should represent a visual, consolidated dashboard displaying identified risks and gaps for the selected vendor including such items as risks by focus area, gaps by focus area, Ginnie Mae and vendor gaps, personnel criticality and related assessment results and recommendations. The Contractor shall also provide an Information Security Dashboard for vendors that are responsible for providing SSAE 18 SOC reports as part of their contract. The dashboard shall include a summary of the vendors SSAE18 SOC reports including report type, purpose, audit period, scope, assumptions, auditor’s opinion, exceptions overview, percentage of control objectives with and without exceptions, number of exceptions, exceptions by control objective and conclusions and recommendations. The Dashboards are included in the Vendor Assessment Report.

c. The Contractor will provide the report to Ginnie Mae’s management and stakeholders in coordination with the Operational Risk Division. Documentary evidence will become the property of Ginnie Mae along with all other materials performed during this assessment.

5.4 Task Four - Service Organization Monitoring and Risk Mitigation (Scope Area 10)

The Contractor will review all applicable SOC I and SOC II Reports for two Ginnie Mae Tier 1 vendors. Some Ginnie Mae Tier 1 vendors are required to provide both SOC 1 and SOC 2 reports and some are required to only provide SOC 1 reports. For the current Ginnie Mae Tier 1 contractors as of this TO, there are 9 Tier 1 vendor SOC Reports per year. With the anticipated additional Ginnie Mae Tier 1 contract awards expected during the period of performance of this TO, there will be an additional estimated four (4) Tier 1 vendor SOC Reports per year.

Service Organization Monitoring:

Support Ginnie Mae in implementing a dedicated service organization monitoring capability that can provide Ginnie Mae with an enhanced view of service organization-related risk exposure, proactively prevent or detect service organization control weaknesses and…