HECM PWS.pdf

Performance Work Statement (PWS) Home Equity Conversion Mortgage (HECM)

Business Service Provider Solution

May 5, 2026

Page i

Performance Work Statement

Vision Statement 1General Information

1.1Scope

1.2Background

1.2.1Home Equity Conversion Mortgage Insurance

1.2.2HECM Life Cycle

1.2.3HECM Underwriting through Pre-Endorsement

1.2.4HECM Endorsement

1.2.5HECM Insurance-In-Force Loan Portfolio

1.2.6HECM Claims

1.2.7HECM Assigned Notes Portfolio

1.2.8Accounting

1.3Constraints

1.3.1Non-Disclosure Agreements

1.3.2Security, Cybersecurity, Records Management, and Privacy Requirements

1.3.3Cloud Computing Requirements

1.3.4Solution Functionality

1.3.4Project Planning and Management

Page ii

1.3.5Compliance with Laws and Regulations

1.4Non-Personal Services

1.5Period of Performance

1.6Place of Performance

1.7Hours of Operation

1.8Special Qualifications

1.9Post Award/Kickoff Conference

1.10Status Meetings

1.11Contractor Travel

1.12Confidentiality

1.13Transition Periods

1.13.1Transition-In

1.13.2Transition-Out

2Definitions and Acronyms 2.1Definitions

2.2Acronyms

3Government Furnished Property and Services 3.1Government Services

3.1.1Service Layered Architecture Profile

3.1.2Training

3.1.3Preparing for the Authorization to Operate

3.1.4Configuration Change Management Board

3.1.5Technical Review Sub-Committee

3.1.6Annual Financial Statement Audits

3.1.7Additional Audits and Evaluations

3.2Facilities

3.3Equipment

3.4Materials and Information

3.5Quality Assurance (QA)

4Contractor-Furnished Items and Services 4.1Facilities

4.2Equipment

4.3Materials

4.4Contractor Responsibilities

4.4.1Government Records

Page iii

4.4.2Data Handling

4.4.3Ownership

4.4.4Training

4.4.5Project Tailoring Agreement

4.4.6Physical Infrastructure

4.5Contractor Personnel

4.6Identification of Contractor Employees

5Specific Tasks 5.1Transition-In

5.1.1Transition-In Plan

5.1.2Implementation Project Management Plan

5.1.3Data Analysis and Design

5.1.4Data Migration

5.1.5Data Extract

5.2Privacy Compliance

5.2.1Records Inventory Worksheet (HUD-67)

5.2.2Privacy Impact Assessment (PIA)

5.2.3Information Collection Paperwork Reduction Act

5.2.4PII Confidentiality Impact Level (PCIL)

5.2.5Privacy Implementation Statements

5.2.6Privacy Control Assessment (PCA)

5.2.7Annual Recertification and Continuous Monitoring (Privacy)

5.3Security Compliance

5.3.1Architecture and System Design Document

5.3.2Significant Changes

5.3.3Required Security Documents

5.3.4Security Control Tailoring

5.3.5Security Implementation Statements Narratives and Evidentiary Support

5.3.6Security Control Assessment

5.3.7Solution Assessment and Authorization

5.3.8Annual Recertification and Continuous Monitoring (Security)

5.4Core Requirements for Records Management

5.5Business Requirements

5.5.1Dashboard

5.5.2Data Exchange

Page iv

5.5.3Data Validation

5.5.4Data Transmission Verification

5.5.5Analysis and Exchange of Internal and External Data

5.5.6Display/Onscreen Functionality

5.5.7Tracking

5.5.8Timelines and Workflows

5.5.9Set Aside Accounts

5.5.10Alerts and Error Messages

5.5.11Query and Search Functions

5.5.12Changes and Updates

5.5.13Data Storage and Retention

5.5.14Data Dictionary

5.5.15User Roles and Responsibilities

5.5.16Borrower Portal

5.5.17Customizable Features

5.5.18Reporting Formats

5.5.19Expansion of HECM Accounting Functionality

5.5.20Operations and Maintenance (O&M) Support Services

5.6Performance Monitoring

5.6.1HECM Accounting Solution Monitoring

5.6.2HECM Loan Servicing Monitoring

5.6.3System Uptime Performance

5.6.4System Availability and Incident Reporting

5.7Change Management

5.7.1Configuration Management Plan

5.7.2Approval of Changes

5.7.3HUD Application Release Tracking System

5.7.4User Acceptance Testing (UAT)

5.7.5Accounting Testing Requirements

5.8Solution Implementation

5.8.1System Testing

5.8.2HECM Insurance-In-Force and Assigned Notes Portfolios

5.8.3Solution Configuration/Modifications

5.8.4Deploy and Release the Tested Solution to Production

Page v

5.9Management and Budgetary Reporting

5.10HECM Accounting Requirements

5.10.1IMIP and MMIP Functions

5.10.2Accounting Areas

5.11HECM Claims

5.11.1Claims Assignments for Processing

5.11.2HECM-Assignment Claim Processing Claim Type 22

5.12GNMA HECM Securities

5.13Training

5.14Help Desk

5.15Meetings

5.15.1Weekly Status Meetings

5.15.2Information Gathering, Data Calls, Meetings

5.15.3Monthly Status Meeting

5.15.4Integrated Financial Operations

5.16Reports

5.16.1Management Plan

5.16.2Standard Operating Procedures (SOP)

5.16.3 External User Manual

5.16.4Internal User Manual

5.16.5Weekly Implementation Status Report (WISR)

5.16.6Accounting Reports

5.16.7Recurring Servicing Reports

5.16.8Ad-Hoc Reports

5.17User Manuals and Financial Operating Procedures Support

5.17.1Financial Operating Procedures Support

5.17.2Software Infrastructure Production Support Relating to Performance Testing and Enhancement

5.19Development, Modernization, and Enhancements (DME) (Optional Task)

5.20Independent Audit of Operations

5.21Transition-Out Preparation

6 Deliverables 6.1Deliverables Matrix

6.2Quality Control Plan

6.3Acceptance Criteria

Page vi

7Related Documents 7.1.Privacy

7.1.1Records Inventory Worksheet (HUD-67)

7.1.2Privacy Impact Assessment (PIA)

7.1.3PII Confidentiality Impact Level (PCIL)

7.1.4NIST Implementation Statement Narratives and Evidentiary Support

7.2Security

7.2.1NIST Implementation Statement Narratives and Evidentiary Support

8Performance Requirements Summary

Performance Work Statement HECM Business Service Provider

Vision Statement To deliver a mission- insurance-in-force and assigned notes portfolios; ensures accurate, compliant financial recording and reporting in accordance with federal accounting standards; securely manages and analyzes HECM data;

mitigates operational, security, records management, and privacy risks; and supports sustainable outcomes for seniors and HUD.

1 General Information

1.1 Scope

The Office of Housing FHA Commissioner, U.S. Department of Housing and Urban Development (HUD), requires a comprehensive HECM loan servicing and accounting business solution that fully supports all functional requirements, processes, steps, timelines, and reports associated with current HECM insurance program and regulatory changes during the period of performance.

transactions for all active and terminated cases throughout the full lifecycle of a HECM, including associated processing for pre-endorsement and underwriting, endorsement, claims, and assigned notes.

The Contractor shall:

Deliver web-based, end-to-end reverse mortgage loan business and accounting

Provide and maintain accurate HECM business services for all active and historical loan level records Provide FHA management with ready access to data for financial, budgetary, and user-generated reporting Provide business intelligence and management reporting tools Provide automated reconciliation support of loan balances and posted transactions partners (FHA-approved HECM lenders, servicers, and investors; GNMA; etc.); automated or manual HECM records Provide the ability to quickly adapt to legislative, regulatory, and other administrative changes in the policies and procedures based on industry best practices for financial management and reporting; Federal government and Credit Program accounting; auditing; state-of-the-art information technology, security, records management, and privacy standards; and project management.

Provide a HECM services Help Desk to address operational and technical issues related to delivery, implementation, operation, servicing, and validation of the HECM portfolio and its related financial transactions Provide training to HUD Headquarters, Albany Financial Operations Center, Single Family Housing origination and servicing staff; Office of Housing Counseling, HECM servicers, lenders, and investors; and FHA-approved contractor staff on HECM business services and their related financial transactions.

Provide all FedGAAP-compliant accounting treatments, account reconciliations, posting entries, and reports associated with the HECM insurance program, its insurance-in-force loan portfolio, its HECM claims, and its Secretary-held Assigned portfolio.

Provide accounting treatments -SL) that accurately reflect and reconcile with -end financial statements; monthly Treasury reporting; internal management reports, and disclosures to internal and external governance entities.

Provide a solution compliant with federal, HUD, and FHA/Housing-specific IT security, cybersecurity, records management, privacy policies, procedures, and governance.

Descriptions for the specific tasks are provided in Section 5.

1.2 Background

Home Equity Conversion Mortgage (HECM) insurance program enables eligible senior homeowners, who are at least 62 years old, to convert some of into cash to address economic hardship caused by the increasing costs of health, housing, and subsistence needs at a time of reduced income without requiring repayment of monthly principal or interest payments for as long as the borrower resides in the home and complies with the terms and conditions of the mortgage.

FHA insures mortgages secured by HECM properties under Section 255 of the National Housing Act. The three types of HECM transactions are HECM Traditional, HECM for Purchase, and HECM-to-HECM a HECM is determined by the Principal Limit Factors (PLFs) based on the value of the property;

the age of the youngest borrower or eligible non-borrowing spouse; and the expected average mortgage interest rate.

Funds from a HECM are distributed to the borrower plan option. The borrower may choose from among six different payment plans: single lump sum payment, line of credit, tenure, term, modified tenure, modified term. The borrower can change payment options, subject to drawable equity, at any time for a fee.

Unlike a traditional forward mortgage, there are no monthly payments associated with a HECM.

Instead, the principal borrowed, along with the interest, Monthly Mortgage Insurance Premium, and servicing fees are added to the mortgage balance over time. HECM borrowers remain responsible for the payment of taxes, insurance, and other property ch

FHA provides mortgage insurance to FHA-approved HECM lenders protecting them against eligible losses resulting from non-repayment of the full loan balance makes mortgage lenders more willing to offer these loan products. Non-repayment of a HECM would typically occur if the amount of the debt exceeds the net proceeds from the sale of the property when the loan becomes due and payable. If a loss is the result of non-repayment, the servicer files a claim with HUD for insurance benefits.

FHA-approved originating lenders perform HECM origination functions such as financial assessment; property underwriting; and closing activities including calculation of the Initial Mortgage Insurance Premium (IMIP) and Monthly Mortgage Insurance Premium (MMIP).

When all eligibility criteria are met, the originating lender closes the HECM; informs FHA of the closing by completing the Insurance Application screen in the FHA Connection (FHAC) portal;

and pays the IMIP due. The HECM business solution collects the IMIP and notifies FHAC/CHUMS. The HECM is endorsed for insurance and FHAC/CHUMS notifies the business solution of the new status. After endorsement, FHAC/CHUMS transmits relevant data to the business solution and to the Single-Family Housing Enterprise Data Warehouse (SFHEDW).

Once the HECM is insured, Lenders must report HECM details to FHA and seek HUD approval

If the Servicer is unable or unwilling to make payment disbursements to the borrower, HUD assumes responsibility for making payments to the borrower until the Servicer can resume making payments. HUD requires the Servicer to reimburse HUD for the total payment to the borrower with interest from the date of the payment to the date reimbursement is received by HUD. The Servicer may assign the HECM to HUD.

One feature that distinguishes FHA HECM product from conventional reverse mortgage products is an option for the servicer to assign the loan to HUD when the total loan balance equals

(1) to increase the liquidity of these loans that have no stated term to maturity and (2) to provide mortgagees with full insurance coverage from losses due to non-repayment. When HUD accepts assignment of a HECM, HUD assumes all responsibilities for servicing the loan until final disposition.

As of the end of calendar year 2025, FHA had approximately 280,000 HECM active insured (Insurance-In-Force) loans with another 196,000 Secretary-held HECM assigned properties.

The data contained in the current HERMIT Servicing and Accounting Modules have a FIPS 199 Moderate security categorization and risk level of concern for confidentiality, integrity, and ould HECM data or its Servicing or Accounting modules be compromised through unauthorized access, use, disclosure, disruption, modification, or destruction.

A high-level diagram of the current HERMIT system is shown below.

The following is a high-level overview of the HECM life cycle.

A. The borrower receives counseling from a HUD-approved housing counseling agency.

The borrower need not have contacted a lender to receive counseling.

B. Borrower eligibility is determined by verifying the age of the borrower; by verifying the results of the financial assessment; by reviewing title evidence and the existing indebtedness on the property; and by evaluation of the collateral.

C. The Originator requests an FHA case number via the FHA Connection according to the type of HECM transaction. The Originator then orders and records details from the appraisal and validates acceptance of the HECM collateral.

D. For the purpose of estimating the borrower's principal limit before closing, the Originator uses the indices in effect at the time the initial loan application is signed by the borrower.

Based on this figure, the borrower chooses a payment plan.

E. On the date of closing, the note interest rate and expected (ten-year) interest rate are finalized. The loan is closed. The Originator may choose the assignment option for recapturing the mortgage proceeds in the event of non-repayment. The Originator must also remit the initial MIP (IMIP) electronically to HUD or its agent.

F. The Borrower executes the security instrument and signs the loan agreement.

G. Disbursement of loan proceeds to the borrower may begin after the three-day right-of-rescission period expires, if applicable to the transaction.

H. After closing, there are disbursement restrictions during the initial 12-month period based on the financial assessment and mandatory set-asides for taxes and insurance.

I. The Originator completes the HECM Insurance Application screen in FHA Connection to issue an electronic Mortgage Insurance Certificate (MIC).

J. When applicable, within 60 days of the disbursement date, the Originator submits the electronic case binder to HUD for review and approval.

K. If the case binder is not approved, the Originator receives an electronic Notice of Return (NOR). The Originator must correct any deficiencies noted by HUD staff prior to receiving the electronic MIC.

L. Issuance of the electronic MIC completes the endorsement process.

M. The Servicers adds the monthly MIP (MMIP) to the outstanding loan balance and remits the MMIP to HUD, or its agent. The MMIP accrues daily on the outstanding balance of the loan at an annual rate equivalent to one and a quarter percent (1.25% or .0125).

N. Depending on the payment type, the Net Principal Limit (NPL) accrues daily at an annual rate equivalent to one half of a percent (.5% or .005).

O. When the indebtedness on the HECM equals 98% of the Maximum Claim Amount (MCA), or if a request for a line of credit draw will cause the outstanding balance to exceed 100% of the MCA, and any time thereafter, Mortgagees may assign the HECM to HUD and file a claim for no greater than the MCA.

P. When the HECM becomes due and payable, the borrower or his/her estate will pay an amount equal to the lesser amount of the mortgage balance or the sales proceeds, if the property is sold by the borrower or his/her estate for at least 95% of the fair market value of the property.

Q. If the proceeds from the sale of the property are not sufficient to pay the outstanding HECM balance, the Servicer may not assign the HECM and may not submit a claim for insurance benefits.

The primary responsibility for HECM underwriting, origination, and pre-endorsement servicing rests with FHA-approved originators and lenders and HUD staff, who use the FHA Connection to interface with CHUMS.

HECM loan origination functions are done by FHA-approved HECM originators and servicers using the HECM Insurance Application screens in the FHA Connection (FHAC). Once a HECM is endorsed, pertinent data is sent via an automated interface from the Computerized Homes

HECM Solution. Once

HECM Insurance-In-Force (IIF) portfolio.

The primary responsibility for HECM IIF loan servicing rests with the FHA-approved HECM

Housing (SFH) receives requests from mortgage loan servicers on HECM IIF loans and provides decisions on servicing activities requested by HECM servicers.

The HECM Solution shall handle Claim Processing functions and associated financial transactions:

Demand Assignment Foreclosure/Deed-In-Lieu Optional Assignment

(Short Sale) Supplemental Claim Over-Claimed Amounts Received HECM Claim Payment Notification Post-Claim Reviews

A HECM-IIF loan becomes a part of the HECM Assigned Note portfolio in one of the following two conditions:

If the HECM servicer fails to make the required payments to the homeowner, a demand assignment may be requested, and HUD would advance monies under the subordinate

-IIF loan is assigned to HUD.

When a HECM-IIF loan reaches a specific threshold (currently 98% of the Maximum Claim Amount) and the loan is in good standing, the FHA-approved HECM lender may elect to assign the loan to HUD. HUD then continues loan servicing for the life of the loan.

Prior to accepting the assignment, HUD must ensure that the lender has provided clear title from the lender to HUD.

Following loan assignment, monthly payments are made to the borrower. SFH is responsible for monitoring the status of tax, hazard and flood insurance payments; certifying annual occupancy;

initiating foreclosure or deed-in-lieu of the loan upon the death or non-compliance of the borrower; completing foreclosures judicially or non-judicially; evicting occupants post foreclosure; inspecting properties to determine occupancy; coordinating the protection and preservation of vacant properties; track completion of insured repairs and disburse insurance proceeds appropriately; assisting borrowers with routine servicing actions including substitution of collateral, providing lienholder consent when needed and partial releases of collateral;

changing borrower payment plans; providing loss mitigation options to defaulted borrowers;

identifying Non-Borrowing Spouses and determine if they qualify for a deferral period; release liens following satisfaction of the debt owed; provide payoff letters; defend legal actions challenging HECMs; ordering appraisals; approving short sales; paying vendor invoices and accepting payments and payoffs.

Throughout the HECM lifecycle, accounting treatments are recorded for:

Premiums o Initial Mortgage Insurance Premiums (IMIP) o Annual Mortgage Insurance Premiums (MIP) Claims

Assigned Notes

1.3 Constraints

shall adhere to the following constraints.

Reference Instructions to Offerors

The Contractor shall ensure its solution is compliant with HUD security, cybersecurity, records management, and privacy requirements to safeguard information from the public, other federal agencies, the mortgage lending community, third party providers, and other entities, as appropriate.

HUD follows National Institute of Standards and Technology (NIST) guidelines to provide a reasonable level of assurance to senior management in the following areas:

Risk Management: NIST compliance helps organizations identify, assess, and manage cybersecurity risks effectively ensuring that sensitive data are protected from potential breaches.

Enhanced Security Posture: By implementing NIST guidelines, organizations can improve their overall security posture, minimize risk, reduce vulnerabilities, and protect critical assets from cyber threats.

Provides a roadmap for implementing effective security measures and managing risks associated with sensitive information.

Fosters trust and confidence among clients, the American public, and business partners.

The Contractor shall comply with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations, to protect sensitive data and manage security and cybersecurity risks. Specific requirements are listed in Section 5.2, Privacy, and Section 5.3, Security.

The Contractor shall comply with federal and HUD records management requirements as provided in Section 5.4, Records Management.

The Contractor shall ensure its facilities are compliant with Federal Information Systems Security and Privacy standards and policies.

Due to the Sensitive but Unclassified (SBU) nature of the HECM financial data and the Personally Identifiable Information (PII) contained therein, the Contractor shall ensure that its facilities are secured at all times.

The Contractor shall implement the Physical and Environmental Protection security controls for a Moderate Control Baseline found in NIST SP-800-53, Security and Privacy Controls for Federal Information Systems and Organizations.

The Contractor shall provide HUD online access to its solution for validation and continuous monitoring of security and privacy compliance.

The Contractor shall:

Provide system diagrams, configurations, technical and design documentation, and information on data and file formats.

Provide feedback and recommendations to HUD on system diagrams, configuration and design documents, information on data and file formats, and technical processes.

Provide Information System Component Inventory (including version number, expiration date of support/license) to include:

Software Hardware Firmware Middleware

In order to meet the requirements of this PWS, the Contractor shall follow guidance provided in NIST SP 800-145, The NIST Definition of Cloud Computing, for service models and cloud deployment models.

In accordance with OMB Memorandum M-24-15, Modernizing the Federal Risk and Authorization Management Program, all cloud service solutions that process or store federal data must be FedRAMP authorized.

solution shall utilize a FedRAMP Authorized infrastructure and comply with HUD Enterprise Architecture (EA) requirements. The FedRAMP Marketplace (FedRAMP Marketplace) provides a searchable list of FedRAMP Authorized Cloud Service Offerings.

for its FedRAMP authorization. FedRAMP authorization requires a comprehensive assessment based on Federal Information Security Management Act (FISMA) requirements and National Institute of Standards and Technology Special Publication

800-53 (NIST SP 800-

inherit/leverage some controls from its FedRAMP authorized Infrastructure/Platform, the Contractor sha (ISSO) and Privacy Liaison Officer (PLO) to determine applicability of controls. See Sections 5.2 and 5.3, Privacy and Security, for detailed tasks and requirements.

The system must be hosted in a HUD.gov domain.

-approved HECM ; to appropriately record accounting treatments and financial transactions in accordance with Credit Reform/FedGAAP accounting principles and standards; to present accurate, reconciled accounting entries ; and to demonstrate, justify, and provide evidentiary support for annual FHA Financial Statement business operations and IT compliance audits and evaluations.

In addition, the Contractor shall ensure its solution meets the following requirements:

The goal of Configuration Management is to improve and maintain the integrity of all systems used by the HUD and its customers.

Software Configuration Management (SCM) Procedures apply to software development and operations and maintenance (O&M) activities performed by:

OCIO management Contracting Officer Representatives (CORs) IT project and program managers (IT PMs, PMs) Technical Points of Contact (TPOCs) Application system owners and leaders Developers, reviewers, pre-production evaluators, Test Center personnel, and production implementers

The SCM operational procedures provide the framework for monitoring and controlling the Software Life Cycle on all platforms.

The Contractor SCM guidelines to ensure its solution has approved configuration baselines and is maintained under an approved Configuration Management Plan

The Contractor shall adhere to all constraints to include security, cybersecurity, and privacy compliance throughout the HECM life cycle from loan initiation through loan maturity. As part of the governance requirements in Section 5.3, Security, additional details are provided for the following three plans:

Continuity of Operations Plan (COOP) The Contractor shall provide a specific baseline COOP for all services specified in this PWS. The COOP shall be designed and implemented so that all services required in this PWS are continued with minimal interruption in the case of an emergency or crisis office and other resources. The COOP at a minimum shall include a detailed listing of contract services, service level agreements, alternate resources, processes, and steps to immed other pertinent information needing consideration.

Contingency Plan (CP) The Contractor shall prepare Contingency Plan that identifies all the business operations and processes in this PWS and addresses the procedures the Contractor shall follow to validate acceptance after the system has been recovered, but prior to putting it Test Plan that presents the parameters for accepting system performance before introducing it back into Production. The objective is to provide confidence that the restored system meets the business requirements of both the Program Office and users.

The Acceptance Test Plan describes assumptions, roles and responsibilities, the system, and functions to be tested to include test approach; entry and exit criteria for acceptance;

and return to normal operations. The Contractor shall maintain detailed procedures for testing and validation of data to ensure that data are correct and up to date.

Configuration Management Plan (CMP) The Contractor shall establish, document, and maintain technical and procedural controls to protect HUD; HUD users; FHA-approved third-party providers infrastructure from unplanned, unauthorized, or unintended changes.

The Contractor shall prepare and maintain a Configuration Management Plan.

HECM accounting solution shall operate in tandem with the HECM loan portfolio solution and exchange data pertaining to accounts receivable, collections, accounts payable, and daily disbursements.

and financial operations run smoothly without interruption and minimize risk of data loss and operational disruptions.

The HECM Accounting solution shall interface with the following systems:

Computerized Home Underwriting Management System (CHUMS) for loan setup Treasury (Pay.gov) for collections and disbursements FHA Subsidiary Ledger (FHA-SL) for the recording of General Ledger entries capture and record financial transactions for:

Premiums o Initial Mortgage Insurance Premiums (IMIP) o Annual Mortgage Insurance Premiums (MIP) Claims Assigned Notes

To support HECM pre-endorsement requirements, the Contractor shall:

Record initial insurance application information from CHUMS along with subsequent updates and changes Record receipt of the IMIP and provide that information to CHUMS Record endorsements from CHUMS along with updates and changes to endorsed case information

In addition, the Contractor shall provide the following Display/Onscreen Functionality:

1. Provide loan set up screens that include the following (see Attachment B Single Family

(SF) Module Completed List):

o FHA case number o HECM type o borrower name o property address o case status o Maximum Claim Amount o Net Principal Limit o payment option and term o name of originator name and 10-digit FHA-approved mortgagee id number o servicer name and 10-digit FHA-approved mortgagee id number;

o investor name and 10-digit FHA-approved mortgagee id number.

2. Display data elements (e.g., loan status, product type, loan balance, maximum claim amount, etc.).

o The standard data element/field names, description, length, and formats are provided in the current ICDs per Section 3.4 (d)(1).

3. Capture and display case-level data elements received via Housing systems, i.e., FHAC/CHUMS, FHA Catalyst, Lender Electronic Assessment Portal (LEAP), Single Family Insurance System (SFIS), Single Family Insurance System Claims Subsystem (CLAIMS), and FHA Subsidiary Ledger System (FHA-SL) o borrower and Non-Borrower Spouse information.

display borrower Loan origination information

4. Capture, link, and display the forward mortgage case number with the new HECM case number

5. Capture, display, ingest, and store HECM Transactional Data functions from

FHAC/CHUMS

6. Allow end users to document the status of HECMs in their portfolio

The Contractor shall handle the following Lender Servicing functions:

Certify Occupancy Disburse Monthly Draws (Scheduled/Unscheduled) Track Disbursement of Drawable Equity

Monitor Events that could trigger Due and Payable status Initiate Termination of Mortgage Insurance Exercise Assignment Option Issue Certificate of Indebtedness (COI) Consent of Lienholder Due & Payable with HUD approval Issue Extension Claim filing Issue Extension Deed in Lieu Issue Extension Appraisal Issue Extension Repairs Issue Extension Request to Delay Foreclosure Issue Investor Short Sales Issue Partial Release Preservation & Protection Request HUD Advance (Assignment) Substitution of Collateral Subordination Zero Balance Issue Payoff Request Issue Release of Mortgage Second Mortgage

The Contractor shall handle the following Claim Processing functions:

Demand Assignment Foreclosure/Deed-In-Lieu Optional Assignment

Supplemental Claim Over-Claimed Amounts Received HECM Claim Payment Notification Post-Claim Reviews

The Contractor shall provide full servicing functionality for the HECM-Assigned Notes portfolio from assignment to pay-off or conveyance. A HECM Assigned Note may undergo any of the following events:

Assignment and new loan set up Annual Occupancy Certification Unscheduled Requests for Funds Responses to Correspondence Payment Plan Modification Payoff Requests Insurance Loss Draft Decision Not to Repair Release Approvals Default Servicing for HECM-Assigned Notes Repayment Events Death of Mortgagor Property Charge Issues Repayment Plans for Property Charge Defaults Title Transfer Property Condition Occupancy Property Inspection Custodial Care HUD Counseling Referral Due and Payable Repayment Status Loss Mitigation Options Mortgagor/Family Sale Deed-In-Lieu Short Sale Loss Mitigation Pre-Foreclosure Foreclosure Recommendation Notice of Intent and Referral to Foreclosure

Non-judicial Foreclosures Department of Justice Foreclosures Foreclosure Sales Third-Party Sales Conveyances Repurchases Notice to Vacate Evictions integrated phases architecture, investment, and implementation. EA work is business-driven, and technology solutions begin with the intended business model as the before design, and designs before building and deploying technologies.

modernization lifecycle of technology, systems, and applications through security categorization, selection of controls, risk assessment, system security plan development, certification and accreditation, and continuous monitoring.

to Operate (ATO) and FedRAMP assessment initiation in a cloud hosted environment.

The Contractor shall comply with and associated Federal Enterprise Architecture (FEA) R reflects a business-driven practice of government and industry best practices and is aligned with OMB's Federal Enterprise Architecture (FEA) reference models illustrated in the following graphics.

since the information contained in the se federal government-wide standardized Business

Areas and Information Types. In turn, these align with the FIPS 199 security categorization for the Confidentiality, Integrity, and Availability of each Information Type solution as a whole.

The FEA Reference model descriptions are:

Performance Reference Model (PRM) links agency strategy, internal business components, and investments, providing a means to measure the impact of those investments on strategic outcomes.

Business Reference Model (BRM) describes an organization through a taxonomy of common mission and support service areas instead of through a stove-piped organizational view, thereby promoting intra- and inter-agency collaboration.

Data Reference Model (DRM) facilitates discovery of existing data holdings residing in leverage it to support performance results.

Application Reference Model (ARM) categorizes the system- and application-related standards and technologies that support the delivery of service capabilities, allowing agencies to share and reuse common solutions and benefit from economies of scale.

Infrastructure Reference Model (IRM) categorizes the network/cloud related standards and technologies to support and enable the delivery of voice, data, video, and mobile service components and capabilities.

Security Reference Model (SRM) provides a common language and methodology for performance goals

The following graphic reflects the relationship between the FEA Framework reference models and reflects the line of sight from business operations.

layered presentation, business logic, and data access.

Application Architecture Describes how applications will be designed, developed, and deployed

Infrastructure Architecture Describes the common infrastructure providing the foundation for HUD applications and data storage

Application Security Architecture Describes the framework for securing the applications and related infrastructure layers

The building blocks of the HUD ETA focus on four primary areas of concern: application, data, industry standards and best practices avoiding the issues associated with environments designed using monolithic design patterns. Instead, the building blocks allow HUD to leverage existing IT investments; decouple software and hardware systems; and react to changing demands with awareness and agility. The following graphic illustrates how the different building blocks interact within the HUD ETA.

Chief Information Security Officer (DHS CISO) have mandated the implementation of ZTA across all federal agencies by September 2027.

ZTA is not just a compliance requirement it is a strategic imperative that ensures rigorous sophisticated nation-state and criminal cyber threats.

ZTA incorporates Enterprise Identity, Credential, and Access Management (eICAM). With a successful ZTA/eICAM implementation, HUD will adhere to federal mandates and significantly enhance operational resilience and security posture. This action protects cit

HUD will:

Implement Multi-Factor Authentication (MFA) across its applications and cybersecurity operations o Utilize Industry Leader technologies, such as Okta

Integrate ZTA within the HUD enterprise architecture o Enhance security measures o framework Ensure enhanced coordination and collaboration across OCIO functions Ensure ZTA strategy is both cohesive and effective Overcome challenges and ensure a smooth customer experience Achieve a secure, efficient, and user-centric digital environment Ensure the security and resilience of national housing infrastructure

-based Access Controls (CBACs) are integrated into its solution since this method ensures access is granted only under secure and appropriate conditions. CBACs continuously evaluate factors such as user identity, location, device health, and behavior to make precise access decisions.

The Contractor eICAM requirements and verify every access request explicitly uses least privilege principles and assumes breach to minimize potential damage. In addition, the Contractor shall incorporate:

Dynamic access controls and identity proofing o Tailored to specific user actions and the specific resources being accessed in a particular user session Dynamic attributes o User o Data o Metadata characterization schema

Dynamic (continuous) reauthentication o Continually ensure users are accessing only resources they are authorized to access only for the intended purpose (action) only at the authorized time (context)

Data categorization o Based on impact value

Data labeling o User reauthentication requirements that depend on clear categorization of the data that the user is attempting to access a Security Assessment Plan (SAP) and to meet ATO authorization decision requirements.

The RMF steps include:

1) Prepare to execute the RMF at the organization and system level by establishing context and priorities for managing security and privacy risk.

2) Categorize the information system and the information processed, stored, and transmitted by the information system based on impact loss analysis.

3) Select an initial set of controls for the system and tailor the controls as needed to reduce the risk to an acceptable level, based on a risk assessment.

4) Implement the controls and describe how the controls are employed within the system and its environment of operation (e.g., facility).

5) Assess the controls to determine if they are implemented as designed, operating as intended, and producing the desired outcomes with respect to satisfying the security and privacy requirements.

6) Authorize the system or common control provider based on a determination that the risk to operations and assets, individuals, other organizations, and the Nation is acceptable.

7) Monitor the system and the associate controls on an ongoing basis to include assessing control effectiveness, documenting changes to the system and environment of operation, conducting risk assessments and impact analyses, and reporting the security and privacy posture of the system.

The Contractor shall work with the ISSO to complete the information needed to comply with the RMF steps. HUD uses the Cyber Security Assessment Management (CSAM) tool to store Implementation Statement Narratives, evidentiary support, and solution-related documents. In turn, CSAM generates the Security Assessment Plan. The SAP is also referred to as the System Security Plan (SSP) or the System Security and Privacy Plan (SSPP). For those situations where security and privacy requirements overlap, the Contractor shall work with both the ISSO and

PLO.

1.3.4.14 Internal and External Interfaces

The Contractor shall establish and maintain interoperability with the following systems (including future upgrades or follow-on systems):

HECM approved Lenders Loan Origination Systems (LOS) FHA Connection (FHAC/F17C) FHA Subsidiary Ledger (FHA-SL/P013) Computerized Homes Underwriting Management System (CHUMS/F17) Single Family Insurance System (SFIS/A43) Single Family Housing Enterprise Data Warehouse (SFHEDW/D64A) Single Family Acquired Asset Management System (SAMS/A80S) Lender Electronic Assessment Portal (LEAP/P278) Asset Disposition and Management System (ADAMS/P260) Ginnie Mae Reporting and Feedback System (RFS/P269) FHA Catalyst (FCAT/P323A) GovCloud Records (GCR/P371) HUD Asset Sales Third-party portal system Department of Treasury Accounts Receivable: Pay.gov Department of Treasury Accounts Payable: PAM Process Social Security Administration: Death Master File (DMF) Imaging (Servicers and HUD HECM Servicing Contractor) Release preparation platform (e.g., REKON) Tax monitoring platform (e.g., Corelogic, Lereta, others) Bankruptcy monitoring platform (e.g., BANKO)

1.3.4.15 Additional Requirements

The Contractor shall, at a minimum, have the following Core Technical salient characteristics:

a. Ability and features for technical auditing and reporting.

b. Built-in feature of report design and creation in package.

The Contractor shall:

a. Utilize Application Programming Interfaces (APIs) for internal and external data exchanges to the maximum extent possible.

b. Comply with Business Process Model Notation 2.0 standards.

c. Allow Extract, Load, Transfer (ELT) data extractions from its database.

d. Perform Server and client-side input validation.

e. Provide Built-in feature of report design and creation in package.

The Contractor shall ensure that only obfuscated PII, i.e., dummy data, are used in development and testing environments.

The Contractor shall ensure real time, synchronous interoperability between its portfolio services and their associated financial treatments.

The Contractor shall ensure its solution is robust enough to support a multi-user environment including internal HUD users and approved contractors; external FHA-approved mortgage lenders and third-party servicers; external state and local government authorities; internal and external data exchanges.

The Contractor shall analyze and maintain the HECM solution to ensure the storage capacity and

Move data through multiple tiers as the data age.

Maintain automated retrieval capability to access the data.

Archive data and ensure retention and data disposal services comply with the records management requirements of the PWS.

Ensure accurate and complete user access audit logs and event logs are accessible and retrievable.

The Contractor shall maintain a minimum monthly system uptime performance of 99% uninterrupted access to its solution to include all implemented features, upgrades, updates, and fixes, except when authorized by HUD for system downtime or when outside of th control (e.g., manufacturer, natural disaster, etc.).

months.

The Contractor Planning and Management (PPM) Life Cycle. The PPM was designed based on the best practices from Capability Maturity Model Integration (CMMI) and the Project Management Body of Knowledge (PMBOK).

HUD offers two primary paths for managing projects.

Traditional PPM is Predictive Focused featuring a more plan-driven or linear approach.

This approach is recommended when the requirements are fully understood and fixed; a lower frequency of delivery is desired; and a lower degree of change is expected. This methodology favors process over innovation.

Agile PPM is Adaptive Focused and is geared toward constantly incorporating customer feedback and the continuous iteration of development and testing in the entire software development lifecycle of the project to deliver chunks of value in increments.

Although all HUD software development projects are required to use the Agile approach, Contractors are encouraged to propose a preferred methodology whether their solution is for custom development (including prototypes or pilots); Commercial Off-the-Shelf (COTS)/ Government Off-the-Shelf (GOTS) configuration; or Software as a Service (SaaS). Working with the HUD Project Manager(s), ISSO, and PLO, the Contractor shall tailor the PPM to take a manner that will provide HUD the best value and address all of the tasks necessary for successful project completion on time, within budget, and delivering the intended functionality described in the PWS.

The decisions of PPM tailoring are captured in the Project Tailoring Agreement (PTA) to document the specific agreement for creating, combining, referring, or omitting specific artifacts applicable to the project, as well as for adjusting project control gate reviews to be consistent

Officer (DCIO) for Business & IT Modernization. As a default, any Contractor proposed solution without an approved project tailoring agreement is required to follow all PPM phases and artifacts.

The Contractor shall f the tasks identified in this PWS shall adhere to the rules, regulations, laws, standards, and conventions identified by HUD, FHA/Housing, as well as within the Federal Government unless specifically exempted or superseded by subsequent Federal Regulation.

The Contractor shall ensure use of the most current versions of the documents referenced in the table below.

Document Number

Title and URL Mandatory/ Advisory

5 USC 3504

note

Government Paperwork Elimination Act Government Paperwork Elimination Act (1998) | CIO.GOV A

5 USC §552a Records maintained on individuals (The Privacy Act of 1974) 5 U.S.C. 552a - Records maintained on individuals - Content Details - USCODE-2024-title5-partI-chap5-subchapII-sec552a

A

12 USC

§1715z-20

Insurance of home equity conversion mortgages for elderly homeowners Content Details - USCODE-2023-title12-chap13-subchapII-sec1715z-20

A

29 USC §794d Electronic and Information Technology (Section 508 of the Rehabilitation Act) Section 508 of the Rehabilitation Act, as amended | Section508.gov IT Accessibility Laws and Policies | Section508.gov

M

31 USC §702 U.S. Government Accountability Office GAO Directives (U.S. GAO - Department of Housing and Urban Development)

M

44 USC §2101

et seq

44 U.S.C. 21 - NATIONAL ARCHIVES AND RECORDS

ADMINISTRATION - Content Details - USCODE-2011-title44-chap21

M

44 USC §2901

et seq

44 U.S.C. 29 - RECORDS MANAGEMENT BY THE

ARCHIVIST OF THE UNITED STATES AND BY THE

ADMINISTRATOR OF GENERAL SERVICES - Content Details - USCODE-2011-title44-chap29

M

44 USC §3101

et seq

44 USC Ch. 31: RECORDS MANAGEMENT BY FEDERAL

AGENCIES

M

44 USC §3301

et seq

44 USC Ch. 33: DISPOSAL OF RECORDS M

Federal Information Technology Acquisition Reform Act (2014) Federal Information Technology Acquisition Reform Act (2014)

| CIO.GOV

M

44 USC §3501

et seq.

Pub. L 104-13

Paperwork Reduction Act M

44 USC §3601

et seq.

E-Government Act of 2002 H.R.2458 - 107th Congress (2001-2002): E-Government Act of 2002 | Congress.gov | Library of Congress

M

Executive Order 14028 https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity

M

Document Number

Title and URL Mandatory/ Advisory

Pub. L. 101-

Chief Financial Officers Act (1990) | CIO.GOV M

Pub. L. 113-

Federal Information Security Modernization Act (FISMA) CSRC Topics - Federal Information Security Modernization Act

| CSRC

M

Clinger-Cohen Act

Information Technology Management Reform Act (ITMRA) and the Federal Acquisition Reform Act (FARA) (Clinger-Cohen Act of 1996)

M

Federal Financial Management Improvement Act (FFMIA) OFFM Federal Financial Management Improvement Act

M

Federal Managers Financial Integrity Act (FMFIA) Federal Managers Financial Integrity Act of 1982 | The White House

M

Government Management Reform Act M

Government Performance and Results Act (GPRA) Government Performance Results Act of 1993 | The White House

M

Pub. L. 111-

GPRA Modernization Act of 2010 (GPRAMA) M

Cash Management Improvement Act M

Debt Collection Improvement Act M

Reports Consolidation Act M

24 CFR 206 Home Equity Conversion Mortgage Insurance eCFR :: 24 CFR Part 206 -- Home Equity Conversion Mortgage Insurance

M

49 CFR 260.13

(2 U.S.C.

§661)

Federal Credit Reform Act eCFR :: 49 CFR 260.13 -- Credit reform.

M

Federal General Accepted Accounting Principles A

OMB Memoranda, Bulletins & Circulars Memoranda OMB The White House Bulletins OMB The White House Circulars OMB The White House

M

OMB

Memorandum M-96-20

Implementation of the Information Technology Management Reform Act of 1996 https://www.whitehouse.gov/wp-content/uploads/2017/11/1996- M-96-20-Implementation-of-the-Information-Technology- Management-Reform-Act-of-1996.pdf

M

OMB

Memorandum M-99-20

Security of Federal Automated Information Resources https://obamawhitehouse.archives.gov/omb/memoranda_m99- 20/

Number

Title and URL Mandatory/ Advisory

OMB

Memorandum M-06-15

Safeguarding Personally Identifiable Information https://obamawhitehouse.archives.gov/sites/default/files/omb/ass ets/omb/memoranda/fy2006/m-06-15.pdf

M

OMB

Memorandum M-06-16

Protection of Sensitive Agency Information https://obamawhitehouse.archives.gov/sites/default/files/omb/ass ets/omb/memoranda/fy2006/m06-16.pdf

M

OMB

Memorandum M-06-20

Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management https://obamawhitehouse.archives.gov/sites/default/files/omb/ass ets/omb/memoranda/fy2006/m06-20.pdf

M

OMB

Memorandum M-12-11

Reducing Improper Payments through the "Do Not Pay List" https://obamawhitehouse.archives.gov/sites/default/files/omb/me moranda/2012/m-12-11_1.pdf

M

OMB

Memorandum M-17-12

Preparing for and Responding to a Breach of Personally Identifiable Information

A

OMB

Memorandum M-21-31

Remediation Capabilities Related to Cybersecurity Incidents M-21-31

M

OMB

Memorandum M-22-09

Moving the U.S. Government Toward Zero Trust Cybersecurity Principles M-22-09 Federal Zero Trust Strategy

M

OMB

Memorandum M-24-15

M-24-15 Modernizing the Federal Risk and Authorization Management Program

M

Federal Risk and Authorization Management Program FedRAMP | FedRAMP.gov

M

FedRAMP Agency Authorization Playbook M

FedRAMP_CSP_Authorization_Playbook - Vol. I & II_LV100924.docx

M

FedRAMP Guidance for M-21-31 and M-22-09 FedRAMP Guidance for M-21-31 and M-22-09 | FedRAMP.gov

M

FedRAMP 20xP1 FedRAMP 20x Phase One | FedRAMP.gov

M

OMB Circular A-11

Preparation, Submission and Execution of the Budget https://www.whitehouse.gov/wp-content/uploads/2018/06/a11.pdf

M

OMB Circular A-16

Coordination of Geographic Information and Related Spatial Data Activities Circular-016.pdf

M

OMB Circular A-123

Management s Responsibility for Internal Control https://obamawhitehouse.archives.gov/omb/circulars_a123_rev Appendix A, Management of Reporting and Data Integrity Risk M-18-16

A

Number

Title and URL Mandatory/ Advisory

Appendix D, Management of Financial Management Systems Risk and Compliance, M-23-06

OMB Circular A-129

Policies for Federal Credit Programs and Non-Tax Receivables https://obamawhitehouse.archives.gov/omb/circulars_a129_rev2

M

OMB Circular A-130

Management of Federal Information Resources https://obamawhitehouse.archives.gov/sites/default/files/omb/asset s/OMB/circulars/a130 /a130revised.pdf

M

OMB Circular A-136 (Revised)

Financial Reporting Requirements https://obamawhitehouse.archives.gov/sites/default/files/omb/asset s/OMB/circulars/a136 /a136_revised_2016.pdf

M

Critical Infrastructure Protection in the Information Age Executive Order 13231 and amendments (i.e., EO 13284, EO 13286, and EO 13316)

M

HSPD-7 Critical Infrastructure Identification, Prioritization, and Protection Homeland Security Presidential Directive 7 | CISA

M

HSPD-12 Homeland Security Presidential Directive-12…