GNMA Technology Operations Sources Sought-RFI.pdf

Department of Housing and Urban Development Government National Mortgage Association

(Ginnie Mae)

Sources Sought Notice/Request for Information

Ginnie Mae Technology Operations

July 29, 2026

Sources Sought Notice/Request for Information U.S. Department of Housing and Urban Development (HUD)

Ginnie Mae Technology Operations

Notice Type: Sources Sought Synopsis/Request for Information

Response Deadline: August 13, 2026, 2:00 PM EST

Primary NAICS Code: 518210 – Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services

Product Service Code (PSC): DA01 – IT and Telecom – Business Application/Application Development Support Services (Labor)

Target GSA Schedule: Multiple Award Schedule (MAS) SIN 518210C – Cloud Computing and Cloud Related IT Professional Services

1. Introduction & Purpose Ginnie Mae is seeking industry feedback on its strategy to establish a single enterprise Technology Operations contract responsible for infrastructure operations, application operations and maintenance, cloud operations, cybersecurity (SA&A) operations, DevSecOps, identity services, and enterprise integration. The objective is to improve operational efficiency, strengthen cybersecurity/information assurance, standardize service delivery, reduce operational risk, increase automation, and enable continuous modernization while maintaining uninterrupted support for mission-critical systems. Industry feedback will be used to refine the acquisition strategy, Performance Work Statement, performance measures, and overall contract structure prior to release of the solicitation. The results of this research will also assist the government in determining potential socio-economic set-asides.

Important Note: This Sources Sought/Request for Information is strictly being used for Market Research purposes that help define the Acquisition Strategy. There is no active solicitation at this time. This request does not constitute a Request for Proposals (RFP). Submission of information is purely voluntary, and the government assumes no financial responsibility for any response preparation costs. General capability statements will not be evaluated; vendors must respond to the specific questions listed in Section 3 – Requested Information to be considered as an interested vendor.

2. General Description of Work Ginnie Mae’s Office of Enterprise Data & Technology Solutions (OEDTS) requires a contractor to support day-to-day operations, maintenance, software development, modernization, application delivery, maintenance and support, implement innovative solutions, and integrate new technologies to align with organizational goals and enhance overall efficiency. This includes maintaining and optimizing existing IT systems, applications and infrastructure to ensure reliability, scalability, and security; providing technology integration services to implement new systems, tools, and platforms; delivering proactive support and continuous improvement to enhance operational efficiency, ensuring continued compliance with industry standards, regulations, authorizations and organizational policies; provide infrastructure and application program and project management. Core service areas include:

Transition-In

Project Management (PMP)

Desktop as a Service (DaaS)

Technology Operations, Maintenance and Integrator Support (Infrastructure and Applications) (Transition from Digital Service Software Development Contract – Base Year)

DevSecOps CI/CD Pipeline Operations and Support

Identity and Access Management (IAM)

Infrastructure and Application Integrator

Cloud Infrastructure and Application O&M

Risk Application Operations Maintenance and Integrator Support (Infrastructure and Applications) (Transition from VMMR Contract)

Securities Operations, Applications Operations, Maintenance and Integrator Support (Infrastructure and Applications) (Transition from MBSOA Contract)

Financial Application Operations, Maintenance and Integrator Support (Infrastructure and Applications) (Transition from GFIT Contract)

System and Cyber Security Support

Technology Operations, Maintenance and Integrator Support (Infrastructure and Applications) (Transition from Digital Service Software Development Contract – OY1)

Technology Operations, Maintenance and Integrator Support (Infrastructure and Applications) (Transition from Digital Service Software Development Contract – OY2)

Technology Operations, Maintenance and Integrator Support (Infrastructure and Applications) (Transition from Digital Service Software Development Contract – OY3)

Technology Operations, Maintenance and Integrator Support (Infrastructure and Applications) (Transition from Digital Service Software Development Contract – OY4)

Transition-Out

For detailed Background, Performance Metrics, Reporting Requirements, and Place of Performance, please reference Attachment A – Draft Performance Work Statement (PWS).

Note: Please be advised that the attached PWS is a DRAFT of the anticipated required services and at this time the DRAFT PWS does not reflect any changes. Any changes deemed necessary by the Government will be incorporated in the solicitation.

3. Requested Information Interested vendors must provide a response addressing the following questions:

a. Provide organization name, address, email address, website address, telephone number, and size and type of ownership for the organization.

b. Enterprise Consolidation Strategy

Ginnie Mae intends to consolidate enterprise technology infrastructure, application operations and maintenance, cloud operations, cybersecurity operations, DevSecOps, identity services, and enterprise integration currently supported under multiple contracts into a single Technology Operations contract. Does this consolidation strategy represent the most effective approach? If not, what alternative acquisition strategy would you recommend and why?

c. Contract Structure

Does the proposed contract structure appropriately balance operational accountability, flexibility, and risk? If not, what recommendations do you have regarding CLIN structure, optional task areas, contract organization, or scope segmentation?

d. Contract Type

Considering the operational and evolving nature of this requirement, what contract type (Firm-Fixed-Price, Cost-Reimbursement, Time-and-Materials, Hybrid, or other) would you recommend for each major functional area and why?

e. Transition-In Approach

The PWS provides a 180-day Transition-In period for assuming responsibility across multiple technologies and contracts. Is this transition period realistic? What additional transition activities, milestones, Government support, or risk mitigation strategies would improve transition success?

f. Knowledge Transfer

What best practices should the Government require for knowledge transfer, documentation validation, operational readiness, and assumption of responsibilities during Transition-In and Transition-Out?

g. Operating Model

The Government intends to establish a centralized enterprise Technology Operations model. What organizational structure, governance model, and operational practices would best support long-term success?

h. Service Integration

This contract will require coordination among Government personnel, SaaS providers, cloud providers, software development contractors, cybersecurity organizations, and multiple application vendors. What governance structure, decision-making framework, and service integration model would you recommend to ensure accountability and effective coordination?

i. Staffing Model

Based on the scope of this PWS, what labor categories, staffing model, organizational structure, and specialized skill sets would you recommend to successfully perform this effort? What Key personnel roles would you recommend?

j. Technology Operations Best Practices

What additional operational best practices, IT Service Management (ITSM) capabilities, automation, or operational processes should be incorporated into the PWS to improve service quality, operational maturity, and long-term sustainability?

k. DevSecOps Operations

The PWS includes operations and maintenance of enterprise DevSecOps pipelines. What additional operational responsibilities, automation capabilities, engineering practices, or security controls should the Government consider including?

l. Cybersecurity Operations

The PWS includes enterprise cybersecurity (SA&A), Identity and Access Management (IAM), vulnerability management, compliance, continuous monitoring, and system security responsibilities. What additional operational capabilities or cybersecurity services should the Government consider? (Security Operations Center responsibilities are not included)

m. Cloud Operations

What additional cloud operations, cloud governance, observability, resiliency, or multi-cloud management capabilities should be included to improve operational efficiency and cloud performance?

n. Artificial Intelligence

How should Artificial Intelligence (AI), AIOps, workflow automation, predictive analytics, autonomous operations, or machine learning be incorporated into enterprise Technology Operations throughout the life of the contract?

o. Continuous Innovation

What contract incentives, governance mechanisms, performance objectives, or evaluation criteria would encourage continuous modernization, automation, innovation, and operational improvement throughout the contract period?

p. Emerging Technologies

What emerging technologies, operational best practices, or industry trends should the Government consider incorporating into this requirement over the next five to ten years?

q. Key Performance Indicators (KPI) Validation

The Government has developed detailed ServiceNow KPI definitions, SLA targets, timer logic, pause conditions, severity definitions, and measurement criteria. Are these performance measures appropriate? Which metrics should be added, modified, consolidated, or removed to better measure contractor performance and mission outcomes?

r. Service Level Agreements (SLA) Realism

Are the proposed Service Level Agreements (SLAs), response times, and resolution targets realistic and achievable? Please identify any performance standards that present operational risk and recommend improvements.

s. Outcome-Based Performance

Beyond traditional SLA response and resolution metrics, what outcome-based performance measures should the Government use to evaluate contractor success? Please consider operational maturity, automation, cybersecurity, resiliency, customer experience, technical debt reduction, cloud optimization, and continuous improvement.

t. Continuous Improvement Metrics

What metrics should the Government use to measure continuous operational improvement rather than simply operational responsiveness? Examples may include reduction in recurring incidents, reduction in manual effort, automation adoption, platform stability, release quality, cloud optimization, technical debt reduction, or customer satisfaction.

u. Additional Recommendations

Please provide any additional recommendations that would improve the acquisition strategy, Performance Work Statement, contract structure, performance management approach, service level framework, or long-term success of this enterprise Technology Operations contract.

In addition to answering the questions listed above, the vendor’s response shall include a cover page with the following information:

Point of contact name, position title, telephone number and email address Unique Entity Identifier (UEI) Business size applicable to NAICS Code Socioeconomic business category GSA contract number (if applicable), and any other applicable GWAC number, if applicable

4. Evaluation Criteria for Market Capacity The government will evaluate the submitted information to determine market capacity based on:

Scope and Scale: Ability to match the operational depth described in this notice and the draft PWS.

Resource Adequacy: Ability to secure and deploy corporate financial, human capital, and technical resources.

Project Management Health: Demonstrated capacity for schedule compliance, cost containment, performance tracking, personnel retention, and risk mitigation.

5. Submission Instructions & Communications Policy Please email your completed response before the deadline.

Deadline: August 13, 2026 @ 2:00 PM EST Email To: Maria Guercio, Contract Specialist (Maria.C.Guercio@hud.gov) and Cheri

Redding, Contracting Officer (Cheri.L.Redding@hud.gov).

Subject Line: Source Sought/RFI - Ginnie Mae Technology Operations

Strict Communications Policy: The government will not accept or acknowledge vendor telephone calls or texts. In addition, the government will not provide vendor feedback, including evaluation comments regarding submissions, nor will it respond to any vendor emails or requests for follow-up.