PWS - Digital Transformation Software Development and Operation and Maintenance_ (002).docx

Digital Transformation Software Development and Operations and Maintenance

Department of Housing and Urban Development (HUD) Government National Mortgage Association (Ginnie Mae) Digital Transformation Program

TABLE OF CONTENTS

SECTION C – PERFORMANCE BASED STATEMENT OF WORK

C.1 BACKGROUND

Ginnie Mae is a wholly owned corporate instrumentality of the United States within the Department of Housing and Urban Development (HUD). Its authority is generally prescribed in Title III of the National Housing Act, as amended (12 U.S.C. 1716 et seq.). The mission of Ginnie Mae is to link the United States housing market to the global capital markets, thus providing low-cost financing for federal housing programs. Through its Mortgage-Backed Securities (MBS) programs, Ginnie Mae guarantees privately issued securities backed by pools of mortgages insured or guaranteed by the Federal Housing Administration (FHA), the Department of Veterans Affairs (VA), Rural Development (RD) of the U.S. Department of Agriculture (USDA), and HUD’s Public and Indian Housing program (PIH). Ginnie Mae guarantees their investors the timely payment of scheduled monthly principal and interest payments, loan prepayments and early recoveries of principal on the underlying mortgages. If borrowers fail to make timely payments on their mortgages, the Issuer of the MBS must make the timely payments to the registered holders using the Issuer’s own resources.

Ginnie Mae has a multi-year, multi-phase program initiative to modernize and transform its MBS Securitization Platform including its technology, business processes and related policies to enable new and expanded capabilities and products, improve business and service delivery performance to its Issuers and investors and strengthen security while ensuring seamless integration across platforms and business partners. The MBS Securitization Platform includes Ginnie Mae’s proprietary applications, systems, infrastructure and supporting business processes to administer its MBS programs.

C.1.1 PURPOSE

Ginnie Mae requires a Contractor with extensive MBS expertise to provide innovative technology solutions, Agile and DevSecOps Software Development services, business process digitization, customer adoption, application operations, maintenance, and security services to assist in facilitating the planning, execution and implementation of Ginnie Mae’s Modernization and Digital Transformation initiatives and supporting programs. This support is critical for Ginnie Mae to ensure key milestones, desired results and business and quality objectives are delivered by Ginnie Mae and Ginnie Mae’s business partners for these highly specialized MBS IT and operational transformation initiatives.

C.1.2 OBJECTIVES

The objectives of this requirement are to acquire a Contractor to:

· Provide Development, Modernization, and Enhancement (DME) services delivering agile, efficient, reliable, flexible, scalable, highly available and secure applications, systems, solutions and business processes to enable Ginnie Mae to offer new and expanded capabilities, products, services and improved performance. Deliver services with Agile and DevSecOps software development principles and best practices. Software development services will be procured on an as-needed basis, in support of specific Ginnie Mae projects or requirements.

· Provide MBS expertise and technology leadership with innovative approaches and solutions to support Ginnie Mae’s Digital Transformation program vision and to meet program participants’ needs. Work collaboratively with Ginnie Mae and its business partners on Integrated Project Teams (IPT).

· Provide access to a broad range of emerging and advanced technologies, services, and products and solutions through Contractor teaming arrangements or subcontractors that enable Ginnie Mae’s to achieve its Digital Transformation objectives.

· Provide customer adoption services for new or updated applications, systems and business processes for Ginnie Mae’s business and end user communities.

· Provide Operations and Maintenance services for the applications, systems and solutions developed. Support and maintain compliance with Federal Government and Ginnie Mae policies, procedures, standards and industry best practices.

Modernization and Digital Transformation initiatives the Contractor shall support may include but is not limited to the following:

(1) Upgrading, replacing or integrating new applications, systems and business processes that support Ginnie Mae’s critical business operations as it relates to Pooling Certification and Securitization, Servicing Remaining Principal Balances (RPB), Reporting and Payment to Security Holders, Investor Reporting, Program Operations, Risk Management and Compliance;

(2) New development or system changes required to implement new and expanded products, services, capabilities and business process changes. When requested by Ginnie Mae, the Contractor will use business process reengineering techniques as part of a DME project to automate manual processes or to streamline business processes as a result of application code changes;

(3) Re-engineering or replacing Ginnie Mae’s major business applications by utilizing modernized technology and capabilities to reduce operational costs, improve business performance and operational effectiveness, improve customer experience, service availability and reliability, boost compliance and increase transparency;

(4) Modernizing business applications and processes currently supported by Ginnie Mae’s MBS Issuance & Bond Administration (MBSIBA) Contractor’s owned mainframe to a more modernized, distributed environment;

(5) Enhancing business applications, including MBS financial and accounting systems to comply with evolving government and mortgage industry requirements and standards;

(6) Upgrades to Ginnie Mae’s current environment to the latest version of applicable software(s) and any applicable licensed module(s) to improve capability and performance. These upgrades may include updates to Oracle, SAP Business Objects (BOBJ), Informatica and other licensed software versions used by Ginnie Mae where application code changes are required. Ginnie Mae will choose system version upgrades;

(7) System changes to meet any new/revised regulatory mandates, agency policy and mortgage industry standards changes and compliance requirements (e.g., Federal Information Security Management Act (FISMA), Office of Management and Budget (OMB), National Institute of Standards and Technology (NIST), Ginnie Mae, HUD, and other government agencies); and

(8) IT infrastructure initiatives to enable Ginnie Mae to improve IT efficiencies, performance, agility, capability, IT security and to reduce overall IT enterprise spending on hardware, software, and operations.

C.1.3 SCOPE

The scope of the work to be performed under this Digital Transformation Software Development and Operation and Maintenance (O&M) Task Order (TO) is as follows:

· Provide DME services to support Ginnie Mae’s Modernization and Digital Transformation initiatives to offer new and expanded capabilities, products, services and improved performance. Collaborate with Ginnie Mar and Ginnie Mae’s business partners on IPTs as applicable to support requirements development, technical design, testing, integration of the new or enhanced applications with existing Ginnie Mae systems and applications, deployment into the application environment, and customer adoption.

· Deliver services using Agile and DevSecOps framework, principles and industry best practices. Provide early, frequent and continuous delivery of software that meets user objectives, requirements and business outcomes. Ensure development, operations, security, infrastructure and architecture teams collaborate utilizes continuous exploration, continuous integration, continuous deployment, and release on demand techniques.

· Provide access to a broad range of emerging and advanced technologies, services, and products and solutions through Contractor teaming arrangements or subcontractors that enable Ginnie Mae to achieve its Digital Transformation objectives. Examples include machine learning, artificial intelligence for big data (trading), predictive analytics (risk assessment / management), chatbots (user experience), and robo-advisors (managing investment risk), blockchain distributed ledger, smart contracts, low-code/no-code rapid application development and product centric development.

· Provide Customer Experience (CX) support which includes customer adoption support, program participant and key stakeholder training, user guides and other training materials for all systems, applications and solutions developed.

· Provide application operations and maintenance (O&M) services, ensuring and maintaining compliance and minor software enhancement services for Ginnie Mae’s systems and applications which will be primarily hosted in the Amazon Web Services (AWS) GovCloud environment. This will include establishing and/or maintaining cybersecurity of all platforms supported as per Ginnie Mae and federal security requirements. Systems and applications include cloud and web-based technologies, software applications, databases and related support applications and processes. O&M support includes application and database operations management, application upgrades, application patching, application monitoring, application and software compliance, information assurance and IT security compliance, IT Service Management participation and compliance, reference architecture participation and compliance, corrective action to production systems from defects (“bug” fixes) as well as changes to accommodate new requirements or minor enhancements to functionality, process improvements, or changes to infrastructure. Provide support for data architecture, analytics, configurations, compliance, operational and technical incident reporting, data, quality assurance, and automation.

· For the systems, applications and solutions developed, support and comply with Ginnie Mae’s policies and federal regulatory requirements for Information Technology (IT) Systems Security, Disaster Recovery (DR), Continuity of Operations (COOP); Implement and maintain a DR Plan to ensure continuity; Develop and maintain a COOP plan to ensure continuity. Ensure all application DR and COOP plans are integrated with the Infrastructure Providers DR and COOP plans.

· Provide Specialized Consultation and Project Support.

· Provide support for audits such as Statement on Standards for Attestation Engagements (SSAE) 18, Type II Service Organization Controls Report (SOC) I and SOC II, Right to Audit, Federal Information Systems Controls Audit Manual (FISCAM), Office of Management and Budget (OMB) Circular A-123 Management's Responsibility for Internal Control (OMB A-123), Office of Inspector General (OIG) audits and other types of reviews or audit support.

· The Contractor must support the use of Ginnie Mae provided collaboration tools to include Microsoft Teams, Zoom, BOX, Adobe Connect, Mural and other potential Government authorized collaboration tools.

After contract award, Firm Fixed Price and Labor Hour Task Orders with a NTE ceiling will be issued by project / initiative with the specific required services, deliverables and performance requirements.

C.1.4 CURRENT ENVIRONMENT

C.1.4.1 Modernization and Digital Transformation Initiatives Overview Ginnie Mae is in the midst of a multi-year, multi-phase initiative to modernize and transform its Securitization Platform, systems, and business processes. The purpose of this initiative is to support the major growth in Ginnie Mae’s MBS programs with increased transparency and improved service, deliver new capabilities for Ginnie Mae’s Issuers, investors, and employees, and to optimize back-office efficiencies with our Cloud IT Services strategy and smarter approaches to development and delivery.

Ginnie Mae’s Digital Transformation effort is an outgrowth of administrative reforms recommended in the 2019 HUD Housing Finance Reform Plan, most notably the directive to:

· Transition the MBS platform from pool level to loan level functionality, including the ability to transfer servicing of individual loans within a pool.

· Strengthen risk management analytics and predictive capabilities.

· Fully modernize platform access, data standards, collection, and storage.

Ginnie Mae’s multi-year Modernization and Digital Transformation Roadmap requires MBS expertise to provide innovative technology solutions, Agile Software Development services, business process digitization, customer adoption, application operations, maintenance, and security services to fulfill all program life cycle responsibilities in accordance with HUD’s IT policies, Agile Framework, DevSecOps and other best practice guidelines.

Ginnie Mae’s Digital Transformation vision will transform Ginnie Mae’s business solutions delivery through innovative and agile business practices and technological advances and deliver greater value to existing customers, partners, internal stakeholders, and our housing finance ecosystem participants. Ginnie Mae’s vision is for the Digital Transformation program and related initiatives to accomplish the following:

· Be an operational and technology platform that meets or exceeds digital parity with the industry ecosystem.

· Have architecture and technology designs that are agile, modular, and flexible.

· Have more data-centric, data-driven decision making capabilities.

· Enable leaner, more streamlined, and more efficient business processing.

· Identify considerations to better position for an innovative workforce plan for the future.

· Digital Transformation will also facilitate new and enhanced partnerships across our ecosystem facilitating more value delivery. Its more flexible and adaptable data and technology architecture will enable operational efficiency, improve Customer Experience, and allow Ginnie Mae to better manage its counterparty risk.

C.1.4.2 Ginnie Mae’s Integrated Support Systems Overview

(a) Operations: Ginnie Mae and its Contractors operate in a highly integrated application, systems, business process, and infrastructure environment. Ginnie Mae’s Securitization Platform and core MBS operations and supporting applications, systems, and infrastructure relevant to this PWS are provided by multiple contractors. Four of the key contractors relevant to this PWS are as follows:

(1) MBS Issuance & Bond Administration (MBSIBA) Contractor.

(2) Mortgage Backed Securities Operations and Analytics (MBSOA) Contractor.

(3) IT Infrastructure Dedicated Cloud Services (IT IDCS) Contractor, to be referred to in this PWS as the Cloud Application Migration and Operations (CAMO) Contractor.

(4) Independent Verification and Validation (IV&V) Contractor.

In 2020-2022, Ginnie Mae migrated all of its portable and distributed applications (non-mainframe) and supporting infrastructure operations into the AWS GovCloud. As a result, most of Ginnie Mae systems, applications, and infrastructure are now hosted primarily in the AWS GovCloud and supported by Ginnie Mae’s CAMO Contractor. The MBSIBA mainframe and mainframe infrastructure were not part of the cloud migration effort and remain in the MBSIBA environment.

This environment requires a high degree of integration, collaboration, and coordination between each of Ginnie Mae’s business partners to support the overall Ginnie Mae enterprise. The Digital Transformation Software Development and O&M Contractor shall work with respective contractors and provide the technical and collaborative skills necessary to operate as part of an IPT.

(b) Resources: The Contractors shall also provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to provide services for Ginnie Mae as defined in this PWS except for those items specified as government furnished property and services.

C.1.4.3 Division of Contractor Responsibilities The Digital Transformation Software Development and O&M Contractor will need to work with the MBSIBA, MBSOA, CAMO, and Independent Verification and Validation (IV&V) Contractors in order to execute the deliverables in this contract. The systems, data and applications are tightly integrated across the MBSIBA, MBSOA and CAMO Contractors. The Contractor shall coordinate with Ginnie Mae’s business partners on integrated projects impacting more than one (1) business partner as a result of changes to Ginnie Mae’s systems, applications and business processes. This work requires high levels of collaboration.

The following provides an overview of the responsibilities of the key contractors the Digital Transformation Software Development and O&M Contractor will be required to collaborate with to fulfill the requirements of this Task Order.

(1) The MBSIBA Contractor is responsible for the engineering, connectivity to Ginnie Mae’s mainframe infrastructure, mainframe hosting, MBSIBA application security, compliance, O&M, integration and enhancements of the systems and applications along with the other services they provide.

(2) The MBSOA Contractor is responsible for application O&M and enhancements for additional key Ginnie Mae business applications and systems along with the other MBSOA services they provide.

(3) The CAMO Contractor is responsible for AWS GovCloud hosting services for the MBSOA and MBSIBA portable and distributed (non-mainframe) applications. The CAMO Contractor shares responsibility with the MBSOA and the MBSIBA Contractor for the security and O&M of these applications. The MBSOA and MBSIBA Contractors maintain the application functionality and supporting software components. The CAMO Contractor provides and supports the infrastructure components.

(4) The IV&V Contractor is responsible for providing IV&V of MBS Securitization Platform work products, requirements, applications and systems to ensure project objectives are met, appropriate quality is being delivered by Ginnie Mae’s development and implementation contractors and compliance with the development process standards.

(5) The Digital Transformation Software Development and O&M Contactor will provide DME services and O&M services for new Ginnie Mae applications and solutions and DME services for existing applications. Technical Guidance Memos (TGMs) will be executed to modernize existing applications or provide new software solutions. Solutions will be integrated into the overall Securitization Platform managed by multiple Contractors.

Ginnie Mae, in coordination with the CAMO Contractor and its related providers, will provide connectivity to the CAMO environments via AWS WorkSpaces and other secure remote access services for infrastructure or application administration related activities. The CAMO Contractor and other related providers will provide and support all dedicated connectivity to and within the AWS GovCloud.

C.2 TASK OVERVIEW

Task 1: Program Management Support Task 2: Software Development Services Task 3: Customer Experience (CX): Customer Adoption Task 4: Operations, Maintenance & Minor Enhancements Task 5: Security Requirements Task 6: Specialized Consultation and Project Support Task 8: Transition-In/Out Services

C.2.1 TASK 1 – PROGRAM MANAGEMENT SUPPORT

The Contractor must provide program management support under this Task Order (TO). This includes managing and overseeing all activities performed by Contractor personnel, including subcontractors, to satisfy the requirements identified in this TO. The Contractor must identify a Program Manager by name who will provide management, direction, administration, quality assurance, and leadership of the execution of this contract and direct management over all sub-contractors, service providers and services supporting this effort. The Contractor will facilitate Government and Contractor communications; use industry best-standards and proven methodologies to track and document PWS requirements and activities to allow for continuous monitoring and evaluation by the Government; and ensure all support and requirements performed are accomplished in accordance with the contract. The Contractor must notify the Contracting Officer (CO), Contracting Officer’s Representative (COR), and Technical Point of Contact (TPOC) of any technical, financial, personnel, or general managerial problems encountered throughout the contract period of performance (PoP).

The Contractor must ensure that solutions embrace an enterprise-level solution that integrates support across all program areas in a seamless manner. The Contractor must ensure support is in accordance with PWS requirements and provide deliverables in accordance with this PWS.

C.2.1.1 Coordinate A Project Kick-Off Meeting The Contractor will make themselves available to participate in the post award Project Kick-Off Meeting via teleconference within ten (10) business days from the time of award. The post award Project Kick-Off meeting will be scheduled, and an agenda provided by the GSA Project Manager (PM) within five (5) business days after TO award. The meeting will provide an introduction between the Contractor and Government personnel who will be involved with the oversight and implementation of this Task Order (TO). The meeting will provide the opportunity to discuss technical, management, security issues, travel authorization, reporting procedures, and the invoicing process. At a minimum, the attendees will include representatives the Contractor deems necessary to participate, e.g., Contracts Manager, TO Project Manager, Finance Representative, and others that would be coordinating with the government contracting and program staff along with the GSA COR/PM, Contract Specialist, and Contracting Officer.

Within five (5) business days of the Project Kick-Off Meeting, the Contractor will provide the meeting minutes documenting the discussion and capturing any action items.

C.2.1.2 Monthly Status Report (MSR) The Contractor must develop and provide a Monthly Status Report (MSR) using Microsoft (MS) Office Suite applications, by the tenth business day of each month via electronic mail to the TPOC, and upload into ASSIST.

The MSR must include the following:

(a) Progress of activities accomplished by all Contractor staff from the previous reporting period.

(1) Activities completed the previous month,

(2) New activities due to be accomplished next month,

(b) Problems observed and corrective actions taken to resolve. Also include issues, risks, or concerns and proposed resolutions to address these issues.

(c) Government actions being requested by the Contractor.

(d) Schedule – Must show major tasks, milestones, and deliverables; planned and actual start and completion dates for each.

(e) Summary of Contractor travel taken and the reason for the travel.

(f) Contractor, Sub-Contractor or vender risks and issues related to the services provided by this contract.

(g) Monthly Operational Reporting to include but not limited to changes, incidents, operational incidents, security incidents, and O&M reporting.

C.2.1.3 Monthly Meetings The Contractor PM must initiate and convene a Monthly Status Meeting the second Tuesday of every month or on a mutually agreed day to include the TPOC and other vital Government stakeholders. The purpose of this meeting is to ensure all stakeholders are informed of the monthly activities contained within the MSR, provide opportunities to identify other activities and establish priorities, and coordinate resolution of identified issues/incidents or opportunities. The Contractor PM must provide minutes of these meetings, including attendance, issues and risks discussed, decisions made, and action items assigned, to the TPOC within five (5) business days following the meeting.

C.2.1.4 Monthly Cost Report (MCR) The Contractor must develop and provide a Monthly Cost Report (MCR) using Microsoft (MS) Office Suite applications, by the tenth business day of each month via electronic mail to the TPOC, and upload into ASSIST.

The MCR must include the following:

(a) Monthly spend of activities accomplished by all Contractor staff from the previous reporting period.

(1) Actual cost of each CLIN for the current month.

(2) Projected cost of each CLIN for the current month.

(3) Projected cost of each CLIN for the remaining OY months.

(4) Accumulated invoiced costs for each Contract Line Item Number (CLIN) up to the previous month.

(b) Potential cost overruns observed, and corrective actions taken to resolve. Also include issues, risks, or concerns and proposed resolutions to address these issues.

(c) Personnel gains, losses, and status of contractor staff.

(d) Government actions being requested by the Contractor.

The Contractor PM will initiate and convene a Monthly Cost Meeting the second Tuesday of every month or on a mutually agreed day to include the TPOC and other vital Government stakeholders. The purpose of this meeting is to ensure all stakeholders are informed of the monthly activities contained within the MCR, provide opportunities to identify other activities and establish priorities, and coordinate resolution of identified issues/incidents or opportunities. The Contractor PM will provide minutes of these meetings, including attendance, issues and risks discussed, decisions made, and action items assigned, to the TPOC within five (5) business days following the meeting.

C.2.1.5 Project Management Plan (PMP) The Contractor must document all support requirements in a Project Management Plan (PMP). The PMP serves as the primary source of information for planning, executing, monitoring, controlling, and closing a project. It is a document that provides detailed plans, schedules, processes, and procedures for executing, managing, and controlling project life cycle activities. The PMP must:

(a) Describe the proposed management approach for overall project and TO governance.

(b) Provide a detailed schedule for all milestones, tasks, subtasks, and deliverables required in this TO.

(c) Describe in detail the Contractor’s approach to risk management under this TO and adherence to Ginnie Mae’s governance policies and procedures.

(d) Describe in detail the Contractor’s approach to communications, including processes, procedures, communication approach, and other rules of engagement between the Contractor and the Government.

(e) Include the Contractor’s Quality Control Plan (QCP).

The Contractor must provide Ginnie Mae with a draft PMP ten (10) business days after the project start date. Ginnie Mae will make comments on the draft within 15 business days. The Contractor must incorporate these comments into the final PMP and return it to Ginnie Mae within ten (10) business days of receiving Ginnie Mae’s comments. The PMP must be updated annually, at a minimum. The Contractor must work from the latest Government-approved version of the PMP.

C.2.1.6 Communications Plan The Contractor must facilitate Government and Contractor communications by:

(a) Effectively track and document TO requirement and activities using industry best standards and proven methodologies.

(b) Allowing for continuous monitoring and evaluation by the Government;

(c) Ensuring all support and requirements performed are accomplished in the TO.

(d) Notifying the COR and TPOC of any problems encountered throughout the TO PoP.

(e) Communications Plan: Create and provide a Communications Plan ten (10) business days after the project start date that will be used to manage the portfolio of work defined in this TO and contain regular updates on an agreed subset of CLINs. Submit the Final Communications Plan to the TPOC within ten (10) business days of receiving Ginnie Mae’s comments. All communications will be managed by the TPOC.

C.2.1.7 Risk Management Plan The Contractor must establish and maintain a Risk Management Plan to include a comprehensive Issue/Risk Log to track risks and assign mitigation strategies. Risks are potential future events that, if they occur, would have an impact on the project/TO whereas issues are events that have occurred and must be resolved as soon as possible. The Contractor shall perform an initial risk assessment jointly with Ginnie Mae during the first six (6) months of the project start, identifying and assessing the probability and impact severity of all foreseeable programmatic and technical risks, and developing mitigation strategies for high and medium exposure risks. The Contractor shall maintain and update the Risk Management Plan on an ongoing basis and conduct risk reviews as part of the bi-weekly meeting with TPOC.

The Risk Management Plan must include how risks will be identified, managed, and mitigated. The responsibilities for monitoring and review shall be clearly defined. The monitoring and review processes shall encompass, when applicable, all aspects of the risk management process for the purposes of:

(a) Ensuring that controls are effective and efficient in both design and operation.

(b) Obtaining further information to improve risk assessment.

(c) Analyzing and learning lessons from risk events, including near-misses, changes, trends, successes, and failures.

(d) Detecting changes in the external and internal context, including changes to risk criteria and to the risks, which may require revision of risk treatments and priorities.

(e) Identifying emerging risks.

The plan must also include an Issue/Risk Log template that shall be used to track issues and risks and assign mitigation strategies to address each one. The Contractor shall maintain the Issue/Risk Log and update it as needed. The Issue/Risk Log is an ongoing tool for the purposes of identifying, triaging, and managing risks. The Issue/Risk Log shall be monitored by the Contractor at least weekly.

C.2.1.8 Quality Control Plan (QCP) The Contractor will develop, maintain, enforce and document a QCP. The QCP must ensure the Government receives the level of quality that is consistent with the requirements specified in this contract. The QCP must be sufficiently detailed to provide the Contractor’s methodology for identifying and recruiting qualified personnel. The QCP must also provide the Contractor’s methodology for resolving problems identified by the Government during reviews conducted in accordance with its Quality Assurance Service Plan (QASP). The QCP must also provide the Contractor’s methodology for establishing an internal feedback system for support personnel and resolving problems identified by that feedback system. The QCP must demonstrate and validate that the services or deliverables to be provided under the contract are completed with a level of quality that meets the minimum performance threshold established in the Government’s QASP. The QCP must address Quality Management Approach, Quality Assurance, Quality Control and Quality Standards. The Contractor’s QCP will be delivered within ten (10) business days after the kickoff meeting. The document is to be submitted via electronic mail to the TPOC and uploaded into ASSIST.

If changes need to be made, the revised QCP is due within ten (10) business days of receiving Ginnie Mae’s comments.

C.2.2 TASK 2 – SOFTWARE DEVELOPMENT SERVICES

The Contractor shall provide software development services based on TGMs. The Contractor shall maintain and provide skill sets and labor categories necessary to support Agile, DevSecOps and all phases of HUD’s Project Planning and Management (PPM) Life Cycle V2.0 methodology including needs, requirements, business process subject matter expertise and advisory services, as well as software development, execution, deployment, and if required, decommissioning.

Ginnie Mae is responsible and shall approve the overall management, control and prioritization of any proposed software changes. DME and any other software changes will be controlled by Ginnie Mae in consultation with internal Ginnie Mae business owners, the COR, the TPOC, Ginnie Mae Project Managers, and other stakeholders. While DME initiatives may be proposed by the Contractor, Ginnie Mae shall decide which initiatives will proceed.

As directed by the TPOC, the Contractors shall perform DME services and tasks to any of Ginnie Mae’s existing applications, systems, and databases, develop any new applications, and support MBS platform modernization and Digital Transformation initiatives.

C.2.2.1 Digital Solution Development, Automation, and Infrastructure Support Ginnie Mae requires flexibility and agility to innovate, deploy and evolve capabilities at speed as its mission and agency requirements continue to evolve in its execution of software development. The Contractor shall support Ginnie Mae with the adoption of new digital solutions to support achieving the economies of scale that support the business case for digital platforms and requires support to achieve agency goals. The contractor shall employ Development, Security, and Operations (DevSecOps) with the use of principles such as Infrastructure as Code (IAC) and Continuous Integration/Continuous Deployment (CI/CD) pipelines to make environments available on demand with the necessary security accreditation built in to provide the delivery of mission and business value to end users with higher quality solutions and technical maturity. The Contractor’s software development shall be delivered in an Agile incremental, fast-paced style to reduce the risk of failure. The Contractor shall deliver working software into users’ hands as early as scheduled to give the design and development team opportunities to adjust based on user feedback about the service. A critical capability is being able to automatically test and deploy the service so that new features can be added often and be put into production easily. Development practices shall employ practices such as design and code in sections, automated testing, verifying code to identify and remedy code vulnerabilities, test automation, issue resolution, and prototyping.

C.2.2.2 Agile and DevSecOps Software Development

(a) Agile and DevSecOps Overview Ginnie Mae is positioned to adapt Agile and DevSecOps software development culture and practices to meet the changing business process automation demands and to enable business operations resilience. In the high-speed modern business landscape, agility means the difference between a competitive organization and an outpaced relic. Agile software development is a method of software development management that utilizes an iterative and incremental development process, user needs driven design of services, and improvement of software resulting from prompt user feedback. DevSecOps is a modern software development and delivery practice that not only breaks the traditional method of silo development, operations, and security teams but also introduces a philosophy and culture change to enable organizations for rapid software delivery through automation of continuous integration, security left-shift, automated testing and continuous deployment known as CI/CD pipeline automation. By adoption of Agile and DevSecOps, Ginnie Mae can proactively anticipate, rather than simply respond to, data security incidents and demonstrate quality and security improvements via shorter mean time to production, faster deployment speed, increased deployment frequency and faster mean time to recovery.

While the traditional waterfall System Development Life Cycle (SDLC) methodology remains to support the HUD PPM 2.0 guidelines for legacy systems, the Contractor shall follow Ginnie Mae’s Agile and DevSecOps guidelines and principles when conducting software development and enhancements. The Contractor shall ensure the agile software development Product Team has adequate skills and resources such as experienced and certified Scrum Master and DevOps/DevSecOps engineer for Agile and DevSecOps practices in addition to the traditional software development team. The Contractor agile software development Product Team shall include diverse levels of expertise for SDLC activities such as developing user stories and user acceptance criteria, architecture, designing, coding, testing, and quality acceptance. The Contractor Product teams shall embrace a collaborative culture and work closely with product owners, information security and operations teams throughout the DevSecOps CI/CD pipeline and agile delivery. The Contractor Product Teams shall leverage Ginnie Mae’s standard DevSecOps automation shared services, tools, and mandatory security scanning policy for building the product CI/CD pipelines. The use of any new tools must go through the new tool adoption approval process before being used in Ginnie Mae’s non- production and production environments. User stories and user acceptance criteria must be approved by Ginnie Mae’s product owner or product owners. Sprint ceremonies must be conducted based on best practices and sprint-based product demonstrations shall be provided to product owners and end users to obtain feedback.

The tools listed below are some of the currently used Agile/DevSecOps tools at Ginnie Mae. Our toolchain strategy for hyper automation is starting from MVP (minimal viable product) and gradually evolving to more comprehensive robust CI/CD automations as shared services with standardized templates in the AWS GovCloud ecosystems environment to meet the automation and collaboration needs for development, security, operations, and governance teams.

The Contractor’s lead Scrum Master and DevSecOps Engineer shall participate in Ginnie Mae’s DevSecOps and Agile Center of Excellence (CoE) activities to receive updates on Ginnie Mae’s Agile and DevSecOps practice guidelines, policies, procedures, toolchain standards as well as to have an opportunity to share your industry best practices and lessons learned with others within the CoE.

(b) Support Agile SDLC:

The Contractor shall support the agile software development life cycle as well as waterfall. Contractors must define its agile sprint process and its duration. The agile software development life cycle must be an iterative and incremental process. The agile life cycle will be used in the adoption of new products, proof-of-concepts, pilot initiatives, and in projects that enhance the customer experience. All work across the project phases shall be organized into a series of two-week iterations, or sprints at the project level. The detailed design and development is performed in parallel and not sequentially.

The agile software development life cycle must enable a rapid delivery of functionality for Ginnie Mae across a diverse set of project initiatives. Contractors shall deploy agile methods that break the entire project into smaller, easily developable, product features and capabilities through sprints in an incremental manner.

The agile team must possess diverse levels of expertise in activities such as architecture, designing, coding, testing, and quality acceptance. The agile team must demonstrate functionality and capabilities to stakeholders and incorporate feedback that improves the development of sprint activities.

The Contractor shall:

(1) Develop and maintain a prioritized product backlog for each project. The prioritized product backlog shall include the definition of the features that will make up the product backlog at the epic level. Establish high-level estimates and priorities against the backlog features.

(2) Develop and maintain user stories with estimates. The stories must be detailed enough so that specific tasks can be assigned to each user story. Validate the prioritization, identify dependencies and verify the creation of acceptance criteria that meet the Definition of Done.

(3) Develop and maintain a Risks, Assumptions, Issues and Dependencies (RAID) log with all stakeholders.

(4) Develop a Release Management Plan outlining the testing required, sprint increments to be included in each release and any additional sprints necessary to prepare the production environment for deployment of new capabilities, features, etc.

(c) Utilize Dev/Ops Approach:

The Contractor shall bring a DevOps approach to projects. Leveraging this ecosystem, development, test, and operations share responsibility for solutions delivery with collaborative responsibilities defined and executed. There is a feedback loop between development, test and operations activities that transforms software development into a just-in-time solutions delivery model. The general principle of DevOps is based on the convergence of software development, quality assurance, IT and operations maintenance. It is expected that minimally the following common components in the DevOps ecosystem be addressed: configuration management, processing in the cloud or on premise, and process automation that enables continuous integration, auditing, and monitoring. DevOps shall facilitate code changes that can be built, tested, and deployed into production using a well-defined, repeatable process.

The Contractor must demonstrate their ability to leverage state-of-the art technology and approaches to DevOps. Technology tools will monitor code, build software capabilities, execute test plans and Contractors shall provide their software development process and describe their approach to project and contract management, communication and collaboration among development, testing, quality assurance, and operations that will operate in the DevOps ecosystem. This process is subject to COR’s approval.

The Contractor shall deploy functionality with changes to development, system integration, user acceptance and production environments with minimal human interaction. The goal is to ensure that the deployment can be more efficient and timelier.

The Contractor shall demonstrate and perform a DevOps approach which describes how communications, tools, and other collaborations enable development, testing, quality assurance, security and operations.

The Contractor shall provide a software version description per project that includes code source, executables, scripts, and discusses how all aspects of the application lifecycle from development to operations can access, communicate, and implement feedback into subsequent versions.

The Contractor shall provide a detailed DevOps Plan for employing continuous delivery/deployment practices into the software development life cycle. This plan minimally shall include installation procedures, tasks, configuration information, and upgrade instructions for existing legacy software and data systems. The plan shall also include its approach for automation upgrades and installation of software releases. The plan shall describe support from the user and operational stakeholders to the development team. The final plan is subject to the COR’s approval.

In support of DevOps, the Contractors shall:

(1) Provide subject matter expertise for DevOps practices and tools.

(2) Develop or configure, test, stage, and release business applications by applying iterative processes utilizing the proposed DevOps environment and supporting tooling, and a frequent release cycle.

(3) Provide customer-friendly solutions that provide ease of use for nontechnical Government users.

(4) Provide comprehensive documentation and information necessary to analyze DevOps processes, procedures, and/or policies that were implemented in the creation of the applications.

(5) Provide business process analysis expertise regarding optimizing the workflow, automation, manual processes (where necessary), and feedback loops across the DevOps environment.

(6) Develop system configuration in such a manner as to leverage maximum re-use and sharing across the platform by other federal agencies embracing the Government’s shared service mandates.

(7) Provide incremental documentation that results in full technical and end user documentation or configuration for all software development efforts and product releases with all information necessary to document processes, procedures, code artifacts, and/or policies that were implemented in the creation of the development work.

(8) Perform Services in Accordance with HUD’s PPM Life Cycle V2.0.

(d) Project Management The Contractor shall ensure each project has an experienced technical project manager assigned to manage the overall project and the deliverables and serve as Ginnie Mae’s single point of contact for the project. The project manager must maintain Project Management Professional certifications, or the equivalent required to perform the requirements.

The Contractor shall:

(1) Perform services in accordance with HUD's latest PPM methodology and the Agile framework as adapted and tailored by Ginnie Mae. The Contractor shall be well versed and experienced in Agile project management and the Agile software development life cycle and perform services in accordance with Agile industry best practices.

(2) Control the planning and execution of the project’s activities and resources to ensure scope, quality, budget and other key goals are achieved.

(3) Provide the technical and collaborative skills necessary to operate as part of an IPT.

(4) Perform requirements and benefits analysis for each DME project as required to support business case development.

(5) Provide a Project Plan covering all phases of the project as defined by the latest HUD PPM methodology.

(6) Track, monitor and manage the project budget, the project schedule, project dependencies, project risks and issues and overall project performance. Communicate the project status to the COR and TPOC in writing.

(7) Ensure the DME projects are designed to align with Ginnie Mae’s Enterprise Architecture (EA) during all development.

(8) Coordinate all DME projects through the COR, the TPOC and Ginnie Mae's Project Managers, Project Management Office (PMO) and the Architecture Review Board (ARB). The Contractor will also be required to ensure all projects meet the requirements of Ginnie Mae’s Solution Architecture Competency Center (SAC2 or SACC), Data Management Competency Center (DMCC), Information Security (InfoSec), and Infrastructure Management Team (IMT) and Customer Experience Group (CXG).

(9) As part of the PPM process, participate in PMO Control Gate Reviews or other technical project reviews as requested by the TPOC.

(10) Depending on the type and size of the project, the Contractor may provide project support to Ginnie Mae’s Change Control Board (CCB), CXG and Policy Development Group (PDG). This typically would involve providing technical advice, impact assessments, cost estimates and other information necessary to reach a common understanding of the project scope, requirements and business impacts.

(11)…