PWS-EAD Sept23.docx

Performance Work Statement (PWS) Electronic Appraisal Delivery Portal Services

(EAD)

September 23, 2022

Vision Statement……………………………….……………………………………………..4

4 Contractor-Furnished Items and Services…………………………………………………10

5.6 Transition………………………………………………………………………………..22

8 Related documents………………………………………………………………………

PERFORMANCE WORK STATEMENT (PWS)

ELECTRONIC APPRAISAL DELIVERY PORTAL SERVICES

Vision Statement The vision of this requirement is to obtain Contractor support to assist the Department of Housing and Urban Development (HUD) with Electronic Appraisal Delivery (EAD) Portal Services. These services will enable Federal Housing Administration (FHA)-approved mortgagees and/or their third-party service providers access to the portal to electronically upload, submit and/or view appraisal data for loans submitted to FHA for insuring. The portal data will be submitted to FHA insuring systems for processing.

1 General Information

1.1 Introduction

HUD’s Office of Single Family Housing (SFH), is seeking contractor support to provide a transaction based electronic appraisal delivery portal with approved government Mortgagees and service providers.

1.2 Background

On June 27, 2016, FHA made it mandatory for Mortgagees to submit electronic appraisals through a centralized portal for case numbers issued on or after that date. The EAD portal is a centralized database that allows uploading of electronic appraisal files to a central location where they are processed and checked against an FHA defined rule set and the original file scored, and securely transferred to HUD servers. A major component of the FHA insuring process is the collection of an appraisal. The Home Valuation Policy Division is responsible for the policy and solutions supporting the collection of the appraisal.

1.3 Constraints

The Contractor shall maintain compliance with all current and future Federal IT security requirements. The Contractor shall:

A. Maintain IT security and comply with all terms and conditions of the contract throughout the term of the contract with respect to all data and information technology requirements.

B. Use, maintain, enhance, develop, and upgrade all information technology software and system documentation under this Contract in accordance with Federal Laws, best practices, and regulations.

C. Maintain Security Assessment and Authorization (SA&A) standards in accordance with guidance published by NIST. An independent SA&A will be performed by HUD during the period of performance of this contract.

D. Follow HUD’s Project Planning and Management (PPM) Life Cycle and industry best practices in the analysis, design, development, testing and implementation of proposed new systems and/or the enhancement to existing systems.

E. Review and update system documentation to ensure accuracy, compliance, and completeness.

F. The Contractor shall prepare its security plan as part of its demonstration that it meets the requirements for SA&A per the applicable requirements from HUD, OMB, NIST, etc., which will require the preparation of several related documents.

G. Each mixed or financial system that the contractor manages, develops, modifies, enhances, releases and/or upgrades will be assessed under the Federal Information System Controls Audit Manual (FISCAM) methodology.

H. Each mixed or financial system that the contractor manages, develops, modifies, enhances, releases and/or upgrades must comply with identified OMB A–123 Appendix A “Management's Responsibility for Internal Control", and Appendix D “Compliance with the Federal Financial Management Improvement Act of l996” key controls; and the Federal Information Security Management Act of 2002 (FISMA).

I. The Contractor shall not release, mingle, nor re-use data extracted from FHA appraisal reports as authorized by HUD.

Additional specific information on these constraints can be found in Section 5.1.1 through 5.1.2. 1.4 Description of Services HUD seeks a Contractor who shall provide a solution that will configure and align appraisals and appraisal information into the FHA environment, that shall include hosting and services support. The Contractor shall provide and host a web-based EAD portal for FHA-approved mortgagees and/or their designated third-party service provider(s) prior to loan endorsement to electronically submit appraisal reports to FHA. The EAD portal shall allow mortgagees to simultaneously submit multiple appraisal reports, search for previously submitted appraisal report files, clear “hard stops”, and view reports. The appraisal support services shall include:

· Electronic Appraisal Delivery Portal

· Solution Services Support

· Hosting Services Support

· Project Management Plan and Reporting The configuration and solution service support of an EAD portal will allow uploading of electronic appraisal files to a central location where they are processed and checked against an FHA defined rule set and the original file scored and securely transferred to HUD servers.

Detailed descriptions of specific tasks are provided in PWS Section 5.

1.5 Non-Personal Services

The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual Contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services.

If the Contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the Contractor's responsibility to notify the Contracting Officer (CO) immediately. These services shall not be used to perform work of a policy, decision making, or management nature, i.e. inherently Government functions. All decisions relative to programs supported by the Contactor shall be the sole responsibility of the Government.

1.6 Period of Performance

The period of performance shall be for one base period of 12-months and four option periods of 12-months each for a total of 60-months.

1.7 Place of Performance

The services performed under this contract shall be performed at the Contractor’s facility.

1.8 Hours of Operation

The Portal shall be available 24/7 except when specifically indicated and announced in advance of routine maintenance. The Contractor is responsible for providing customer service representatives between the hours of 8AM – 8PM Eastern Time Monday thru Friday except for Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closing, or similar Government directed facility closings. Weekly hours shall not exceed a forty (40) hour work week and a typical workday will be 8 hours each day Monday through Friday. The Government reserves the right to change hours of operation or restrict contractor access. Work outside of these daily hours is prohibited without Contracting Officer approval. Government agencies will not be available during scheduled holidays, inclement weather, weekends, and after duty hours.

The Contractor shall at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within the contract when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce is essential.

1.9 Special Qualifications

N/A

1.10 Post Award/Kickoff Conference

The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The Government intends to convene a Post Award Conference with the Contractor within ten business days after contract award. The Contracting Officer will notify the Contractor of the specific date, location, and agenda within five business days after contract award.

1.11 Status Meetings

The Contracting Officer, Contracting Officer’s Representative (COR) and other Government personnel, as appropriate may meet periodically with the Contractor to also review Contractor performance, requirement status, etc. At these meetings, the Contracting Officer will apprise the Contractor of how the Government views the Contractor's performance or progress of the requirement. The Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government. Post Award Conference and subsequent meetings may be held via teleconference.

1.12 Contractor Travel

Prior to travel, the Contractor shall coordinate with and receive Government authorization from the COR for all travel. Reimbursement of travel costs will be in accordance with the Federal Travel Regulation and in accordance with FAR 31.205-46. The Contractor shall travel using the lower cost mode of transportation commensurate with the mission requirements. When necessary to use air travel, the Contractor shall use the tourist class, economy class or similar lodging accommodations to the extent they are available and commensurate with the mission requirements. HUD will not reimburse Contractor’s local travel. Local travel is defined as travel within fifty (50) miles of Washington, DC. All other travel will be reimbursed on a cost reimbursable basis; no profit or fee with be paid.

1.13 Transition In

The Contractor shall, upon the Contracting Officer's written notice, furnish Transition-In services as required. As a successor, the Contractor shall have sufficient personnel on board during the 6-month Transition-In period to ensure a smooth transition with the incumbent Contractor. The Contractor shall provide an orderly transition of work acceptance and accomplishment such that any impact to the program is minimized. During the Transition-In period, the Contractor shall become familiar with the requirements in order to commence full performance of services by the end of the contract Transition-In period. Transition-In is not required if the successor Contractor is the incumbent Contractor.

1.14 Transition Out

To minimize any decrease in productivity and to prevent possible negative impacts on additional services, the Contractor shall have sufficient personnel on board during the 6-month Transition-Out period. The incumbent Contractor shall ensure a smooth transition with the successor Contractor during the Transition-out period, prior to completion of contractual performance. This period will allow for proper end-to-end testing, adequate data migrating, and onboarding. The incumbent Contractor shall aid in the development of plans, procedures, methods for the assumption of all on-going work. The Contactor shall provide an orderly transition of work acceptance and accomplishment, such that full control by the successor Contractor is achieved by the end of the new contract Transition-In period.

2 Definitions and Acronyms

2.1 Definitions

Business/Workdays - Every official workday of the week which are days between and including Monday to Friday. This does not include public holidays and weekends.

Calendar Day - Any day of the week.

Contractor - A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Contracting Officer (CO) - A person with authority to enter into, administer, and/or terminate contracts and make related determinations and findings on behalf of the Government. Note: the only individual who can legally bind the Government.

Defective Service - A service output that does not meet the standard of performance associated with the Performance Work Statement.

Deliverable Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

Government Furnished Property (GFP) - Government-furnished property means property in the possession of, or directly acquired by, the Government and subsequently furnished to the Contractor for performance of a contract. Government-furnished property includes, but is not limited to, spares and property furnished for repair, maintenance, overhaul, or modification. Government-furnished property also includes contractor-acquired property if the contractor-acquired property is a deliverable under a cost contract when accepted by the Government for continued use under the contract.

Government Technical Monitor (GTM) - An individual designated by the Contracting Officer to assist in providing technical direction and monitoring performance under the contract.

Contracting Officer’s Representative (COR) - An employee of the U.S. Government appointed by the Contracting Officer to perform contract administration activities in regard to technical issues. This individual has authority to provide technical direction to the Contractor as long as direction is within the scope of the contract, does not constitute a change and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

Performance Requirements Summary (PRS) - A listing of the performance requirements under the contract that are to be evaluated by the Government on a regular basis, performance indicators for these requirements, performance standards for these requirement and surveillance methods to be used to determine if performance standards are met.

Performance Standard - The Contractor's performance level required by the Government.

Performance Work Statement (PWS) - A statement of work for performance-based acquisitions that describe the required results in clear, specific and objective terms with measurable outcomes.

Physical Security - Actions that prevent the loss or damage of Government property.

Quality Assurance (QA) - Policies and procedures adopted by the Government to ensure that supplies and services acquired under Government contracts conform to the contracts quality requirements.

Quality Assurance Surveillance Plan (QASP) - A plan describing how the agency will survey, observe, test, sample, evaluate and document the Contractor's performance in meeting critical performance standards identified in the contract.

Quality Control (QC) - All necessary measures taken by the Contractor to assure that the quality of an end product of service shall meet contract requirements.

Service Contract - A contract that directly engages the time and effort of a Contractor whose primary purpose is to perform an identifiable task rather than to furnish an end item of supply.

Subcontractor - Any person, other than the prime Contractor, who offers to furnish or furnishes any supplies, material, equipment, or services of any kind under a prime contract or a subcontract entered into in connection with such prime contract, and any person who offers to furnish or furnishes general supplies to the prime contractor or a higher tier subcontractor. The Government does not have privity of contract with a subcontractor.

Work Week - Monday through Friday, unless specified otherwise.

2.2 Acronyms

AQL - Acceptable Quality Level

ARAMS - Automated Renewal and Amendment System

BAA - Business Area Analysis Study

CBT - Computer-Based Training

CCB - Change Control Board

CCMB - Configuration Change Management Board

CMMI - Capability Maturity Model Integration

CFO or OCFO - Office of the Chief Financial Officer of HUD

CFR - Code of Federal Regulations

CIO or OCIO - Office of the Chief Information Officer of HUD

CO - Contracting Officer

COR - Contracting Officer Representative

COTS - Commercial Off-the-Shelf

CPO - Office of the Chief Procurement Officer of HUD

EST - Eastern Standard Time (U.S.)

ETC - Estimate to Completion

GAO - U.S. General Accounting Office

GTM - Government Technical Monitor

COR - Contracting Officer’s Representative

HUD - U.S. Department of Housing and Urban Development

HUDAR - HUD Acquisition Regulation

HUD/ISG - Internet Services Group within the Telecom Processing Division

HUD Web - HUDs Intranet Web Site and related WEB pages.

IG or OIG - Inspector General (Office of)

IT - Information Technology

IV&V - Independent Validation and Verification

LOOCS - Line of Credit Control System

OCPO - Office of the Chief Procurement Officer

OIG - Office of Inspector General

OMB - Office of Management and Budget

PL Public Law

PM - Project Manager

POC - Point of Contact

PPM - Project Planning and Management

QA - Quality Assurance

QASP - Quality Assurance Surveillance Plan

QCP - Quality Control Plan

SF - Standard Form

TBD - To be determined

U.S.C - United States Code

3 Government-Furnished Property and Services The Contractor shall ensure accurate control and accountability of all Government-Furnished Property in accordance with the terms and conditions of this contract. The Government will furnish, at no cost to the Contractor, the GFP shown below.

3.1 Government Services

No Government services will be provided.

3.2 Facilities

No Government facilities will be provided.

3.3 Equipment

No Government equipment will be provided.

3.4 Materials

The Government will provide Standard Operating Procedures and Policies, project management templates and the Single Family Housing Policy Handbook 4000.1.

Copies of required materials may be provided to the Contractor in hard copy or soft copy. All materials will remain the property of the Government and will be returned to the COR upon request or at the end of the contract period.

3.5 Quality Assurance (QA)

The Government shall evaluate the Contractor's performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable quality level.

4 Contractor-Furnished Items and Services The Contractor shall furnish, all facilities, equipment, and supplies required to perform the work under this contract that are not listed under Government-Furnished Property and Services.

4.1 Facilities

The Contractor shall furnish all necessary facilities.

4.2 Equipment

The Contractor shall furnish all necessary equipment.

4.3 Material

The Contractor shall furnish all necessary materials.

4.4 Contractor Responsibilities

The Contractor shall only conduct business with designated Government personnel listed as points of contact (POCs). Names of authorized personnel shall be provided to the Contractor by the Government, in writing, and updated as necessary throughout the contract period.

U.S. Government records, copies of original results and reports, verified original data, corrected data and corrected supporting final reports which are maintained by the Contractor remain the property of the U.S. Government. These files/results must be surrendered to the COR.

4.5 Contractor Personnel

The Contractor shall provide a Contract/Project Manager who shall be responsible for the performance of work. An alternate shall also be designated to act in the absence of the Contract/Project Manager. These Contractor personnel (main point of contact and alternate point of contact) are considered Key Personnel by the Government and shall be listed as such in accordance with HUDAR 2452.237-70, "Key Personnel. The Contract/Project Manager and alternate shall have full authority to act on all contact matters relating to daily operations of this contract. Accordingly, at a minimum, the points of contact shall have the technical knowledge of the requirement and be in the position to actually receive assignment, guidance, and direction from the COR, GTM and CO per HUDAR 2452.237-73, "Conduct of Work and Technical Guidance" and shall be allocated enough hours to the requirement to ensure successful performance. These points of points of contact shall each be an employee of the Contractor. An employee of a subcontractor is not acceptable for either of these positions. The Contract/Project Manager or alternate shall be available between the hours of 8:00am to 4:30pm Monday through Friday EST, except Federal Holidays or when the Government facility is closed for administrative reasons.

4.6 Identification of Contractor Employees

All Contractor/subcontractor personnel shall wear company picture identification badges as to distinguish themselves from Government employees. When conversing with Government personnel during business meetings, over the telephone, or via electronic mail, Contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees. Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation. Where practicable, Contractor/subcontractors occupying collocated space with their Government program customer shall identify their workspace area with their name and company affiliation, or at a minimum, "Contractor" after name.

4.7 Quality Control

The Contractor shall establish and maintain a complete quality control program that shall ensure services are performed in accordance with this contract. The Contractor shall develop and implement procedures to identify, prevent, and ensure non reoccurrence of defective services. The Contractor's quality control program is the means by which he assures himself that his work complies with the requirements of the contract. The Contractor shall provide the associated Quality Control Plan to the Government as directed.

4.7.1 Quality Control Plan

The Contractor shall develop, maintain, enforce, and document a Quality Control Plan (QCP). The QCP shall ensure the Government receives the level of quality that is consistent with the requirements specified in this contract. The QCP shall be sufficiently detailed to provide the Contractor's methodology for identifying and recruiting qualified personnel. The QCP shall also provide the Contractor's methodology for resolving problems identified by the Government during reviews conducted in accordance with its Quality Assurance Surveillance Plan (QASP). The QCP shall also provide the Contractor's methodology for establishing an internal feedback system for support personnel, and for resolving problems identified by that feedback system. The QCP shall demonstrate and validate that the services or deliverables to be provided under the contract are completed with a level of quality that meets the minimum performance threshold established in the Government's QASP. The QCP shall address Quality Management Approach, Quality Assurance, Quality Control and Quality Standards.

5 Specific Tasks

5.1 EAD Portal Transactions.

The Contractor shall provide a web-based solution that shall collect, analyze and store data in a repository for retrieval by HUD.

· The Contractor shall create and submit a Configuration Management Plan within 5 business days from the post-award conference. This report shall be updated and approved annually.

· The solution shall adhere to the following:

· EAD Operational Readiness Testing Plan

· UAD and FHA Rule Results

· UAD Rules with FHA Requirements

· Appraisal Logging Screen Final Requirements

· Catalyst-EAD Interface Control Document

· EAD and CHIMS Linkage file requirements

· HUD’s Single Family Policy Handbook 4000.1

· The Contractor shall provide an industry tested and recognized Automated Valuation Model (AVM) tool that generates a property market value estimate, confidence score and forecast standard deviation for valuation risk assessment with this data delivered to FHA for each appraisal submission.

· The AVM shall have a national hit rate of exceeding 90% and a P10, or equivalent, exceeding 80%. The P10 is the percentage of time the AVM is within 10% of the expected true value of “benchmark”.

· AVM Testing results must be provided with the proposal an annually to validate the accuracy of the model(s).

· The Contractor shall provide a comprehensive scoring tool, with results delivered to FHA for all appraisals submitted, which provides scores that represents appraisal quality, valuation risk, market risks and overall risk. Valuation risks include both overvaluation and undervaluation. Additional details and support for the scoring risks of a submission shall be available upon request and delivered in a single Pdf format through the interface.

· The solution shall have a single point entry capability

· The solution shall have interface capability

· The solution shall have the capability to use the Mortgage Industry Standards Maintenance Organization (MISMO) 2.6 (includes MISMO 2.6 Errata 1 GSE Extended format for UAD forms and MISMO 2.6 Errata 1 format for the non-UAD forms), or the most current version utilized by the industry.

· The solution shall have capability to capture business requirements:

· Industry Standard Completeness and Compliance Rules of equivalent

· FHA Completeness and Compliance Rules to be provided by FHA SME based on http://portal.hud.gov/hudportal/HUD?src=/program_offices/administration/hudclips/ /

· FHA Custom Appraiser and Risk Scoring Rules based on Underwriting Guidelines to be provided by FHA SME. Sample FHA rules are provided using "Sample FHA Rules Scoring Form in Section J List of Attachments. There will be no more than 5000 business rules put in place on the appraisal system.

· The solution shall adhere to the appropriate Federal Regulations:

· 44 USC 3601 et seq. - E-Government Act of 2002

· Pub L. 105-277, 44 USC 3504 et seq.- Government Paperwork Elimination Act http://www.whitehouse.gov/omb/fedreg/gpea2.html

· Pub. L. 105-220, 29 USC 701 et seq. - Section 508 of the Rehabilitation Act of 1998

· HUD Handbook 1325.01, REV-01 Privacy Act Handbook

· NIST SP 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems, September 1996

· HUD’s Release and Deployment Management Process, April 2014

· HUD’s Information Security Continuous Monitoring (ISCM) Strategy and Program, April 2014

· NIST SP 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, September 2011

· HUD Handbook 2400.25, Rev 4.1, It Security Policy, March 2016

· The solution shall have appraisal audit log capability.

· The solution shall have capability to receive data.

· The solution shall have capability to receive Uniform Appraisal Dataset (UAD) rules.

· The solution shall comply with Uniform Collateral Data Portal (UCDP) Standard Hard-Stops.

· The solution shall have the capability to match appraisal versions submitted to the portal.

· The solution shall have the capability to store data.

· The solution shall adhere to HUD IT Security Policy.

· The solution shall adhere to HUD IT Privacy Requirements.

· The solution shall have the capability to process appraisals in real-time or near real-time.

· The solution shall have the capability to process a minimum of 15,000 or greater appraisals per day.

· The solution shall have the capability to support end user response time of approximately 30 seconds for appraisal uploads.

· The solution shall have the capacity to maintain an appraisal history or log for 3 years of FHA appraisal volume.

· The solution shall store the appraisal reports for a minimum of 90 days of transmitting the file to FHA to ensure that the report was transmitted and received.

· The solution shall have the capability to upload appraisal data to FHA solutions via calls to an FHA web service or SFTP.

· The solution shall have capability to provide web services to be called by FHA solutions and provide appraisal data on request.

· The solution shall have the capability to provide integration testing and user acceptance testing.

· The solution shall have the capability to detect and reject an ill-formatted or non-compliant file format at upload and control the transmission of defective data to FHA.

· The solution shall have the capability to accept daily linkage files from FHA and include the files in the rule set that, at minimum, allows the ability to authenticate users, validate Mortgagees, validate appraisers, validate case numbers and shall be capable of utilizing the files in the rule set.

· The solution shall have the capability to utilize FHA data to manage user registration, authentication, and account management.

· The solution shall have capability to allow navigation from screen to screen without losing the case number data.

· The solution shall have capability to allow Mortgagees the ability to search all submissions by property address.

· The solution shall have capability to allow Mortgagees the ability to search all submissions by and FHA case number.

· The solution shall have capability to allow Mortgagees the ability to retrieve all submissions by property address.

· The solution shall have capability to allow Mortgagees the ability to retrieve all submissions by FHA case number

· The solution shall have capability to allow Mortgagees the ability to track all submissions by property address.

· The solution shall have capability to allow Mortgagees the ability to track all submissions by FHA case.

· The solution shall have the capability to detect an ill-formatted or non-compliant file format at upload.

· The solution shall securely transmit discrepancies, findings and other feedback messages to users, based on FHA's requirements.

· The solution shall have the capability to support historical data verification.

· The solution shall have the capability to support data address standardization.

· The solution shall have the capability to support data transformation.

· The solution shall have the capability to support appraisal forms below:

Number Form Website

Number Form Website

Fannie Mae 1004 (Hybrid) https://singlefamily.fanniemae.com/media/22761/display

Individual Condominium Unit Appraisal Report

Individual Condominium Unit Appraisal Report

Manufactured Home Appraisal Report

1004MC

https://www.fanniemae.com/content/guide_form/1004mc.pdf

One-Unit Residential Appraisal Field Review Report

One-Unit Residential Appraisal Field Review Report

820.05 http://www.appraisalinstitute.org/assets/1/7/Interactive820.04-

ResidentialGreenandEnergyEffecientAddendum.pdf

Addendum

Small Residential Income Property Appraisal Report

Small Residential Income Property Appraisal Report

Performance Standards

a) Standard: 100% compliance with all security requirements.

AQL: Zero deviation

b) Standard: Integrated testing for rules engine shall be ready at contract award.

AQL: Zero deviation

c) Standard: Final web-based solution shall be ready at contract award.

AQL: Zero deviation Deliverables 0001 Configuration Management Plan 0002 Completed rules engine within the EAD web-based solution 0003 Completed EAD web-based solution 0004 AVM testing results

5.1.1 Information Technology Compliance, Security Support, and Privacy Requirements

1. The Contractor shall maintain compliance with all current and future Federal IT security requirements. The Contractor shall:

A. Maintain IT security and comply with all terms and conditions of the contract throughout the term of the contract with respect to all data and information technology requirements.

B. Use, maintain, enhance, develop, and upgrade all information technology software and system documentation under this Contract in accordance with Federal Laws, best practices, and regulations. This includes, but is not limited to:

i. Federal Information Security Management Act – https://www.dhs.gov/fisma

ii. The Privacy Act – https://www.archives.gov/about/laws/privacy–act–1974.html

iii. The E–Government Act – https://www.archives.gov/about/laws/egov–act–section– 207.html;

iv. The Clinger–Cohen Act – https://www.fismacenter.com/Clinger%20Cohen.pdf

v. Government Paper Reduction Act – http://www.hhs.gov/ocio/policy/collection/;

vi. Office of Management and Budget Circulars A–130, and A–I27 – https://www.whitehouse.gov/omb/circulars_default;

vii. Office of Management and Budget Memorandum 17–12

viii. https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/ 2017/m– 17–12_0.pdf;

ix. Department of Housing and Urban Development regulations, Handbooks and Policies – http://www.HUD.gov;

x. GAO directives;

xi. Federal Financial Manager Integrity Act (FFMIA);

xii. National Institute of Standards and Technology (NIST)– https://www.nist.gov;

C. Maintain Security Assessment and Authorization (SA&A) standards in accordance with guidance published by NIST. An independent SA&A will be performed by Housing and Urban Development (HUD) during the period of performance of this contract. The Contractor shall complete the SA&A within 6 months after the award of the contract and again at the expiration of the SA&A and to include any revisions or updates.

D. Follow HUD’s Project Planning and Management (PPM) Life Cycle and industry best practices in the analysis, design, development, testing and implementation of proposed new systems and/or the enhancement to existing systems. This includes prohibiting live data from being used in any environment other than Production and Disaster Recovery (DR) environments. Specifically, no live data should be used in development, testing, or staging environments.

E. Review and update system documentation to ensure accuracy, compliance, and completeness. Reviews and revisions must be completed and delivered to HUD quarterly.

F. The Contractor shall prepare its security plan as part of its demonstration that it meets the requirements for SA&A per the applicable requirements from HUD, OMB, NIST, etc., which will require the preparation of several related documents, including but not limited to:

i. NIST FIPS 199/200 Security Categorization Analysis;

ii. NIST SP–800 Security Controls Self–Assessment;

iii. Application and network vulnerability scans;

iv. Business Impact Assessment;

v. Privacy Impact Assessment;

vi. Create System Security Plan, Risk Assessment, Technical Architecture, COOP and Contingency Plans, Quality Control Plan, ST&E Plan and other relevant

vii. SA&A supporting documentation for each new application;

viii. Security Assessment Tests (formerly ST&E Testing);

ix. Security Assessment Reports (formerly ST&E Report);

x. POA&M; and

xi. Accreditation Documentation.

G. Each mixed or financial system that the contractor manages, develops, modifies, enhances, releases and/or upgrades will be assessed under the Federal Information System Controls Audit Manual (FISCAM) methodology that include control families for both General Computer and Business Process Application controls:

i. General Controls:

1. Security Management

2. Access Controls

3. Configuration Management

4. Contingency Planning

ii. Business Process Application Controls:

1. Application Security

2. Business Process Controls

3. Interfaces

4. Data Management

H. Each mixed or financial system that the contractor manages, develops, modifies, enhances, releases and/or upgrades must comply with identified OMB A–123 Appendix A "Management's Responsibility for Internal Control", and Appendix D “Compliance with the Federal Financial Management Improvement Act of l996” key controls; and the Federal Information Security Management Act of 2002 (FISMA) to include:

i. National Institute of Standards and Technology Special Publication (SP) 800–53, Security and Privacy Controls for Federal Information Systems and Organizations, Revision 5 (NIST SP 800–53, Rev. 5);

ii. NIST SP 800–18 Rev. 5 – Guide for Developing Security Plans for Federal Information Systems;

iii. NIST SP 800–23 – Guidelines to Federal Organizations on Security Assurance and Acquisition/Use of Tested/Evaluated Products;

iv. NIST SP 800–30 Rev. 5 – Guide for Conducting Risk Assessments;

v. NIST SP 800–34 Rev. 5 – Contingency Planning Guide for Federal Information Systems; NIST SP 800–37 Rev. 5 – Guide for Applying the Risk Management Framework to Federal Information Systems;

vi. NIST SP 800–47 – Security Guide for Interconnecting Information Technology Systems;

vii. NIST SP 800–53A Rev. 5 – Guide for Assessing the Security Controls in Federal Information Systems and Organizations, Building Effective Security Assessment Plans;

viii. NIST SP 800–59 – Guideline for Identifying an Information System as a National Security System;

ix. NIST SP 800–60 Rev. 5 – Guide for Mapping Types of Information and Information Systems to Security Categories;

x. NIST SP 800–84 – Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities;

xi. Federal Information Processing Standards (FIPS) 199/200 – Security Categorization Analysis;

xii. FIPS 191 – Guideline for the Analysis of Local Area Network Security.

2. HUD’s Office of the Chief Information Officer (OCIO) will have responsibility for maintaining the FISCAM–based mapping of security controls that will be required in order to maintain compliance with FISMA, OMB A–123, and HUD security requirements.

3. The Contractor shall support and provide system security to ensure availability, confidentiality, and integrity of the HUD data applications (e.g., maintaining access control, user identification, password protection and authentication, confidentiality of customer profiles and traffic, physical and personnel security required under this PWS). Provide SA&A support, including potential off cycle or unanticipated SA&A support, over the life of the contract.

4. The HUD System Security Plans (Risk Assessment, Incidence Response Plan and IT Contingency Plan) shall be reviewed and presented to HUD’s Chief Information Security Officer for approval.

5. The Contractor shall maintain compliance with OMB Memorandum 17–12 (Preparing for and Responding to a Breach of Personally Identifiable Information), which requires contractors and subcontractors (at any tier) to:

A. Cooperate with and exchange information with agency officials, as determined necessary by the agency, in order to effectively report and manage a suspected or confirmed breach.

B. Properly encrypt PII in accordance with OMB Circular A–130 and other C. applicable policies and to comply with any agency–specific policies for protecting PII;

D. Provide and participate in mandatory training on how to identify and report a breach;

E. Report a suspected or confirmed breach in any medium or form, including paper, oral, and electronic, as soon as possible and without unreasonable delay, consistent with the agency's incident management policy and US–CERT notification guidelines;

F. Maintain capabilities to determine what Federal information was or could have been accessed and by whom, construct a timeline of user activity, determine methods and techniques used to access Federal information, and identify the initial attack vector;

G. Allow for an inspection, investigation, forensic analysis, and any other action necessary to ensure compliance with OMB M 17–12, the agency's breach response plan, and to assist with responding to a breach;

H. Identify roles and responsibilities, in accordance with OMB M 17–12 and the agency's breach response plan; and, I. Explain that a report of a breach shall not, by itself, be interpreted as evidence that the contractor or its subcontractor (at any tier) failed to provide adequate safeguards for PII.

J.

6. The Contractor shall provide and present a Security Self–Assessment Report to HUD’s Chief Information Security Officer on an annual basis, due no later than August 31st of each calendar year.

7. Plans of Action and Milestones (POA&Ms) shall be reviewed and updated on a semiannual basis (1st week of March and 1st week of October) and presented to HUD’s Chief Information Security Officer for review and approval.

8. Failure to adhere to the above NIST requirements could result in penalties, to include a contract performance stop–work order until compliance can be demonstrated. Disregard of these NIST requirements could also lead to other criminal, civil, administrative, or contract penalties, including, but not limited to:

A. Breach of Contract damages B. False Claims Act damages C. Liquidated Damages D. Termination for Default E. Termination for Convenience F. Poor Past Performance G. Suspension/Debarment Performance Standards

a) Standard: 100% compliance with all security requirements.

AQL: Zero deviation

5.1.2 Information Security Support Requirements

The Contractor shall:

· Designate a System Security Administrator (SSA) for its business services. The SSA shall be responsible for the maintenance of user IDs including establishing business rules for access (add, change, and terminate) as well as defining user roles and role–based user access. The Contractor shall notify the COR of the designated SSA. The SSA shall work with the COR to submit all necessary security forms to ensure that all of the Contractor’s staff has appropriate secure access to HUD sensitive data and sensitive information systems.

· The SSA shall ensure that all contractor staff completes Annual Security Awareness and Ethics training. The SSA shall provide the COR with evidence that all contractor staff have completed the required training within seven business days of completion. The SSA shall have the authority to create and delete user IDs for all users and reset passwords if the user cannot remember a password. The SSA shall receive approval from HUD’s Information System Security Officer (ISSO) and the program area SMEs before adding, changing, or deleting a user’s access.

· Notify the ISSO of any subsequent changes to the individual designated as the SSA.

Performance Standards

a) Standard: 100% compliance with all security requirements.

AQL: Zero deviation

5.2 Solution Support Services.

The Contractor shall support the operation and service of the EAD portal solution. This support shall include:

· Provide analytical services that shall include the analysis of the EAD data for operational issues, risk management and fraud trends. These findings shall be submitted in the weekly EAD portal and quarterly EAD analysis reports.

· Develop EAD user guides to be used by Mortgagees, third-party service providers and FHA staff. The user guides should be updated prior to or simultaneous to solution releases throughout the contract period. The guides shall include a User Desk Guide, a Lender Admin Guide, a General User Guide, and a Lender Agent Administrative Guide. All User Guides shall be reviewed and updated annually.

· Provide training webinar updates on an annual basis.

· Provide tier two customer service to Mortgagees, third-party service providers and FHA staff. This includes password resets, assigning user access, direct integration and other portal issues. The customer service representative shall respond to all service requests, inquiries and complaints within 24 hours and answer 75% of incoming phone calls within 20 seconds. This information shall be submitted in the monthly tier two customer service report.

· Provide escalated solution support to Mortgagees and third-party service providers. The Contractor shall provide escalated support services. If the end-user’s response time exceeds 30 seconds, then the contractor shall correct issues within 4 hours of the reported time. Portal shall not exceed downtime in excess of 4 hours each base period or subsequent option periods.

Provide post-implementation support service to HUD, to correct EAD portal issues, errors, flaws, failures or faults in the original design.

Performance Standards

a) Standard: 100% of weekly, monthly, and quarterly reports AQL: Zero Deviation

b) Standard: 100% development of user desk guides within 90 days of contract award and updated as needed throughout the length of the contract.

AQL: Zero Deviation

c) Standard: 100% development of the FHA EAD Lender Admin Guide within 90 days of contract award and updated as needed throughout the length of the contract.

AQL: Zero Deviation d.) Standard: FHA EAD General User Guide developed within 90-days of contract award and updated as needed throughout the length of the contract.

AQL: Zero Deviation

e) Standard: FHA EAD Lender Agent Administrator Guide developed within 90-days of contract award and updated as needed throughout the length of the contract.

AQL: Zero Deviation

f) Standard: EAD Port Technical Integration Guide developed within 90-days of contract award and updated as needed throughout the length of the contract.

AQL: Zero Deviation

Deliverables 0005 Weekly EAD Portal Report 0006 Quarterly EAD Analysis Report 0007 User Desk Guide 0008 FHA EAD Lender Admin Guide 0009 FHA EAD General User Guide 0010 FHA EAD Lender Agent Administrator Guide 0011 EAD Portal Technical Integration Guide 0012 Monthly Tier Two Customer Service Report

5.3 Hosting Services Support.

The Contractor shall provide specialized web hosting services at their facility, that shall include web and application hosting in support of the EAD portal located at https://www.ElectronicAppraisalDelivery.com. The website shall be available to users as identified in PWS Section 1.8 – Hours of Operation and shall adhere to all the requirements specified in PWS Section 5.1.

Performance Standards

a) Standard: No more than 3 incidences (not to exceed 4 total hours, annually) of site downtime which the Contractor is responsible for and outside of maintenance requirements.

AQL: Zero deviation from standard.

5.4 Project Management Plan, Support, and Reporting.

The Contractor shall provide a project management plan that includes a description of the proposed management approach, standard operating procedures and a work breakdown structure for transition to the EAD system and each system release afterwards.

The Contractor shall provide a monthly status report to the CO, COR, and SME by the 10th business day of each month, using Microsoft Office format. The report shall be brief, factual, and shall include, but not limited to: Activities during the reporting period. Problems and corrective actions taken. Issues and recommended resolutions. Actions needing Government action/input. Schedule - show major tasks, milestones, and deliverables; planned and actual start and completion dates for each. Transactions processed in period and total to date for current contract period.

In conjunction with Status Meetings, the Contracting Officer, Contracting Officer’s Representative (COR) and other Government personnel, as appropriate may meet periodically with the Contractor to also review the Technical Status of the solutions. This shall include technical progress, issues, actions needing Government input/decisions, if any. Appropriate action shall be taken to resolve outstanding issues. A technical status meeting notes report shall be submitted to the COR no later than 10-business days following the meeting.

The Contractor shall deliver…