PWS GNMA Technology Operations_DRAFT.pdf

Performance Work Statement (PWS)

Ginnie Mae Technology Operations

07/16/2026

Vision Statement

1 General Information

1.1 Scope of Work

1.2 Background

1.3 Constraints

1.4 Non-Personal Services

1.5 Period of Performance

1.6 Place of Performance

1.7 Hours of Operation

1.8 Special Qualifications

1.9 Post Award/Kickoff Conference

1.10 Status Meetings

1.11 Contractor Travel

1.12 Transition In

1.13 Transition Out

2.1 Definitions

3.1 Government Services

3.2 Facilities

3.3 Equipment

3.4 Materials and Information

3.5 Quality Assurance (QA)

4 Contractor-Furnished Items and Services

4.1 Facilities

4.5 Contractor Personnel

4.6 Identification of Contractor Employees

5 Specific Tasks

5.1 Transition-In Services (Initial)

5.2 Program Management

5.3 Desktop as a Service (DaaS)

5.4 Technology Operations, Maintenance and Integrator Support (Infrastructure and Applications) Transition from Digital Service Software Development Contract Base Year ..32

5.5 DevSecOps CI/CD Pipeline Operations and Support

5.6 Identity and Access Management (IAM):

5.7 Infrastructure and Application Integrator (Optional)

5.8 Cloud Infrastructure and Application Operations and Maintenance (Optional)

5.9 Risk Application Operations Maintenance and Integrator Support (Infrastructure and Applications) (Transition from VMMR Contract) (Optional)

5.10 Securities Operations Application Operations, Maintenance and Integrator Support (Infrastructure and Applications) (Transition from MBSOA Contract) (Optional)

5.11 Financial Application Operations, Maintenance and Integrator Support (Infrastructure and Applications) (Transition from GFIT Contract) (Optional)

5.12 System and Cyber Security Support

5.13 Technology Operations, Maintenance and Integrator Support (Infrastructure and Applications) Transition from Digital Service Software Development Contract Option Year One (1) (Optional)

5.14 Technology Operations, Maintenance and Integrator Support (Infrastructure and Applications) Transition from Digital Service Software Development Contract Option Year TWO (2) (Optional)

5.15 Technology Operations, Maintenance and Integrator Support (Infrastructure and Applications) Transition from Digital Service Software Development Contract Option Year Three (3) (Optional)

5.16 Technology Operations, Maintenance and Integrator Support (Infrastructure and Applications) Transition from Digital Service Software Development Contract Option Year Four (4) (Optional)

5.17 Transition Out Services

6 Deliverables

6.1 Quality Control Plan

6.2 Acceptance Criteria

7 Related Documents

8 Performance Requirements Summary

Performance Work Statement (PWS)

Technology operations

Vision Statement

To achieve operational excellence through the operation and maintenance of mission critical systems that are secure and improve solutions and support.

The vision is to deliver consolidated, technology operations that empower the organization to achieve its mission and security of IT systems, fostering collaboration, and driving continuous improvement through solutions and support.

1 General Information

1.1 Scope of Work

The Department of Housing and Urban Development (HUD), Government National Mortgage Association (GNMA) has a requirement for IT technology operations and maintenance support services. Services shall include:

Transition-In

Project Management (PMP)

Desktop as a Service (DaaS)

Technology Operations, Maintenance and Integrator Support (Infrastructure and Applications) (Transition from Digital Service Software Development Contract – Base Year)

DevSecOps CI/CD Pipeline Operations and Support

Identity and Access Management (IAM)

Infrastructure and Application Integrator

Cloud Infrastructure and Application O&M

Risk Application Operations Maintenance and Integrator Support (Infrastructure and Applications) (Transition from VMMR Contract)

Securities Operations, Applications Operations, Maintenance and Integrator Support (Infrastructure and Applications) (Transition from MBSOA Contract)

Financial Application Operations, Maintenance and Integrator Support (Infrastructure and Applications) (Transition from GFIT Contract)

System and Cyber Security Support

Technology Operations, Maintenance and Integrator Support (Infrastructure and Applications) (Transition from Digital Service Software Development Contract –

OY1)

Technology Operations, Maintenance and Integrator Support (Infrastructure and Applications) (Transition from Digital Service Software Development Contract –

OY2)

Technology Operations, Maintenance and Integrator Support (Infrastructure and Applications) (Transition from Digital Service Software Development Contract –

OY3)

Technology Operations, Maintenance and Integrator Support (Infrastructure and Applications) (Transition from Digital Service Software Development Contract –

OY4)

Transition-Out

Detailed descriptions of specific tasks are provided in Section 5 – Specific Tasks.

1.2 Background

Modernization of Ginnie Mae’s proprietary systems and securitization platform includes the continuation and implementation of major business applications which are in progress, and other MBS services related to implementing new securitization products and application infrastructure. These major IT initiatives are critical, highly specialized, and necessary to support Ginnie Mae’s role in supporting the housing market and economic recovery.

The vital goal of the Technology operations Program is to consolidate all technology, infrastructure and applications operations and maintenance under one effort.

Consolidating technology, infrastructure and application operations and maintenance will achieve greater efficiency, reduce costs, improve service quality, strengthen security and compliance, improve consistency and strategic alignment (Simplified IT) in IT service delivery across the organization. This includes:

1. Operational Efficiency

a. Streamlined Processes: Reduces duplication of effort, eliminates redundant processes, and standardizes workflows.

b. Centralized Management: Simplifies oversight and coordination, making it easier to manage resources, schedules, and priorities.

2. Cost Savings

a. Reduces Cost: Consolidates support from across many to one (unified support) to reduce overall costs.

b. Reduced Administrative Overhead: Minimizes contract management complexity and associated administrative expenses.

3. Improved Service Quality

a. Consistent Service Levels: Enables the establishment of uniform SLAs, performance metrics, and reporting standards across all environments.

b. Faster Issue Resolution: Centralized support teams can address incidents and problems more quickly and effectively.

4. Enhanced Security and Compliance

a. Unified Security Posture: Standardizes security controls, monitoring, and compliance practices across all systems and applications.

b. Simplified Auditing: Eases the process of compliance reporting and audit preparation by consolidating documentation and processes.

5. Strategic Alignment

a. Business-IT Alignment: Ensures technology operations are aligned with organizational goals and priorities across all applications and services.

b. Agility and Innovation: Facilitates the adoption of new technologies and best practices across the enterprise.

6. Resource Optimization

a. Better Utilization: Allows for more flexible allocation of personnel and technical resources based on organizational needs.

b. Knowledge Sharing: Promotes cross-training and sharing of expertise among teams.

7. Improved Vendor Management

a. Single Point of Accountability: Establishes clear ownership and accountability for service delivery.

b. Simplified Communication: Reduces the complexity of managing multiple vendor relationships.

1.2.1 Technical Environment Background Information:

There are existing conditions within Ginnie Mae’s current environment which will have a direct impact on overall acquisition. The Ginnie Mae platform currently supported is a mix of modernized and legacy applications. All legacy applications are currently moving through modernization. This effort will provide a supporting role to those modernization efforts but will not perform application or infrastructure modernization. This effort will assume operations and maintenance of some existing applications and applications that have been developed or modernized under the Ginnie Mae Digital Services (Software Development) effort.

1.2.1.1 Technology Highlights

Endpoints: 1800 to include 600 servers and 500 workstations Security Operations Technologies: Sailpoint, Okta, Centrify, Trellix, Crowd Strike, Palo Alto Prism, Threat Connect, Tenable IO, Splunk Security Information and Event Management (SIEM)/SOAR, DLP, SKYHigh., AWS Security Tools, AWS Shield, Service Now, Datadog, Beyond Trust, Morpheus, RSA, Akamai WAF, Akamai API Security

GSS is hosted in AWS GovCloud, and all Technology and Security tools have FEDRAMP SaaS Accreditation

External Cloud integrations with Salesforce, ARRIA, BOX, ServiceNow, Appian, Informatica Cloud, Adobe Cloud, SAS Cloud, Jira Cloud, GIT, Veracode Cloud, EKS, Oracle EPBCS, Oracle Fusion Middleware, Cloud based data services, NiceOne, Adobe LMS, Arris, Databricks, Mulesoft

Technology and Application Operations is 24x7x365 Technology and Application Maintenance/Changes cannot be performed during the first 8 business days unless approved by the CISO, CTA and Business Stakeholder

1 production GSS and 1 non-production GSS 9 Major Applications and multiple minor applications Average of 10-15 major infrastructure projects completed each year.

Average of 35-45 software development projects supported each year.

Average of 1500 application changes supported each year.

1.2.1.2 Ginnie Mae Major Applications

Ginnie Mae’s current infrastructure technology portfolio consists of 9 key systems (Major Applications) and one General Support System (GSS) and are as follows:

System Name Brief Description Operating Environment

RFS –

Reporting and Feedback System

Consists of business applications that support the post-settlement collection and processing of monthly pool and loan level investor reporting data, which is used for creation/generation of data disclosures, Ginnie Mae’s analytics and internal reporting, and monitoring of Issuers compliance with program requirements.

System of Systems: Includes 23 Business Applications

Dev, SIT, UAT, TRN, TST, PROD, DR

WebServices – GinnieMae.gov

Provides comprehensive information on Ginnie Mae’s program guidelines, policies, training materials, and critical data disclosures to support the needs of the Investor Community, Issuer Base and other counterparties, and the general public.

Dev, SIT, UAT, PROD, DR

MGM –

MyGinnieMae Portal

Provides a secure portal for Issuers and Ginnie Mae Operations staff to access Ginnie Mae's suite of business applications. In addition, it consists of a multiple business applications that support Issuer management, pool issuance and bond administration.

System of Systems: Includes Portal + 24 Additional Business Applications

Dev, SIT, UAT, TRN, TST, PROD, DR

GinnieNet Facilitates the electronic processing and management of HMBS issuance and related transactions. Provides access to Document

Dev, SIT, UAT, PROD, DR

Custodians to certify or reject MBS submissions.

GFAS / SLDB

– Ginnie Mae Financial Account System

Tracks, records, and reports Ginnie Mae’s accounting information to ensure accurate handling of government revenues, fundings, and expenditures. Manages detailed transaction data related to Ginnie Mae’s defaulted portfolio, and it supports the preparation of financial statements.

Dev, SIT, UAT, PROD, DR

IPMS –

Integrated Pool Management System

Contains the master record of pools issued and ownership as well as the certificate/positions for payment; it facilitates the collection of P&I from Issuers; it records the certification and approval of loan and pool documents to issue new MBS; it performs updates needed to complete pool transfers.

Dev, UAT, PROD, DR

GMC – Ginnie Mae Central

Provides a platform that facilitates the communication and review between their program participants and reviewers to streamline compliance reviews for Insurance, Financials, and Compliance & Monitoring of Issuers.

Dev, UAT, PROD, DR

VMMR /

EMAD

Mission critical application for Ginnie Mae’s quarterly financial reporting modeling production, annual credit subsidy production, quarterly counterparty risk management surveillance production and bi-annual guaranty fee adequacy and capital adequacy assessment.

Dev, UAT, PROD, DR

ServiceNow Provides Enterprise IT, Customer, Security, Governance and Risk Service Management and Business Workflow Services.

Dev, UAT, Prod

AWS GSS Provides the cloud IT infrastructure, network backbone and cyber security resources where all Ginnie Mae systems and applications reside. AWS-GSS is deployed on AWS GovCloud and supports 8 system boundaries.

GSS Production and GSS Non- Production

1.2.1.3 Ginnie Mae IT Environment

Ginnie Mae utilizes several environments as part of the overall systems development and integration process. Not all Major Applications have all listed environments. The environments and associated descriptions are listed below:

Demonstration (DEMO): Contains sample configuration and transaction data. The DEMO environment is leveraged to conduct additional testing for new function functionality. It is also used to apply patches released by PeopleSoft for testing prior to migrating to other environments.

Development (DEV): The development (DEV) environment is used by Vendors and Ginnie Mae to conduct development and integration testing prior to official system testing in SIT and UAT. Code is promoted here from the developer’s local machine and tested to ensure correctness. Once code is successfully integrated and tested here, it is considered ready for system testing.

Disaster Recovery (DR): The disaster recovery environment is configured to support Ginnie Mae applications in the event the primary hosting facility is rendered inoperable.

The disaster recovery environment will include a dedicated production environment including dedicated servers for each production (PROD) application. Connectivity will be secured through a secure VPN internet connection.

Production (PROD): This is the production environment for Ginnie Mae. Only software that has passed system testing and been fully accepted and baselined by Ginnie Mae can be promoted to production. These are considered the critical servers hosting live data and systems for use by the public and require the highest uptime.

Quality Assurance (QA): The QA environment is for testing upgrade procedure against data, hardware, and software that closely simulate the Production environment and where intended users test the resulting application.

Staging (STG)(PreProd): This environment mirrors the production environment and its purpose is to enable Quality Assurance tests after the DEV environment before moving to the PROD environment.

System Integration Testing (SIT): The SIT testing environment is where pieces of Ginnie Mae application code are uploaded and tested for interoperability with other applications. The code is integrated after normal software testing is conducted and approved.

Test (TST): The Test environment is reserved for testing single pieces of Ginnie Mae application code. Prior to moving the code through SIT and UAT testing, the code must be tested and approved in this environment.

Training (TRN): The Training Environment is designated for educating end users on how to operate Ginnie Mae applications. The Training environments are also paired with QA environments in some instances. These environments are typically closed off from PROD environments and enable users to experiment and learn.

User Acceptance Testing (UAT): The UAT Environment is where Ginnie Mae applications are tested to confirm that the functionality is working properly for end users.

Code will have already passed through the TST and SIT environments to reach this stage of the Software Development Lifecycle.

1.3 Constraints

The services identified in this PWS will adhere to the rules, regulations, laws, standards, and conventions identified by HUD as well as within the Federal Government.

Constraints include the following:

1. Federal Information Security Modernization Act of 2014 (FISMA 2014), Public Law No: 113-283 (12/18/2014), S.2521 - 113th Congress (2013-2014): Federal Information Security Modernization Act of 2014 | Congress.gov | Library of Congress

2. Clinger-Cohen Act of 1996 (40 USC 1401) 40 U.S. Code Subtitle III - INFORMATION TECHNOLOGY MANAGEMENT | U.S. Code | US Law | LII / Legal Information Institute

3. Paperwork Reduction Act (44 USC §§3501 -3521) 44 USC CHAPTER 35, SUBCHAPTER I: FEDERAL INFORMATION POLICY

4. Office of Management, and Budget Circular A-I23 https://www.whitehouse.gov/omb/information-for-agencies/circulars/

5. Department of Housing and Urban Development regulations, Chief Information Officer Handbooks and Policies 2400 series, 3150 series, 3200 series, 3300 series, 3400 series and 3500 series.

https://www.hud.gov/hudclips/handbooks/cio

6. Federal Information Processing Standards (FIPS) Publication 199, Standards for Security Categorization of Federal Information and Information Systems FIPS 199, Standards for Security Categorization of Federal Information and Information Systems

7. National Institute of Standards and Technology Special Publication (NIST SP) 800-53 Rev.5, Security and Privacy Controls for Information Systems and Organizations SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations | CSRC and all future revisions

8. NIST SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations: A System Live Cycle Approach for Security and Privacy, SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy | CSRC

9. NIST SP 800-160 Vol. 1 Rev. 1, Engineering Trustworthy Secure Systems, SP 800-160 Vol. 1 Rev. 1, Engineering Trustworthy Secure Systems | CSRC and SP 800-160 Vol. 2 Rev. 1, Developing Technology operations- Resilient Systems: A Systems Security Engineering Approach, SP 800-160 Vol. 2 Rev. 1, Developing Technology operations-Resilient Systems: A Systems Security Engineering Approach | CSRC.

10. NIST SP 800-30 https://csrc.nist.gov/pubs/sp/800/30/r1/final

11. Ginnie Mae Technology Management Division Policies and Procedures

12. Ginnie Mae Chief Information Security Officer Sub-policies and procedures

13. Executive Orders Executive Orders – The White House and OMB “Memoranda” for Information Technology and Security Memoranda – OMB – The White House and Cybersecurity and Infrastructure Security Agency (CISA) “Binding Operational Directives (BODs)” and “Emergency Directives (Eds)” Cybersecurity Directives | CISA

14. GAO directives - https://www.gao.gov/technology operationssecurity -https://www.gao.gov/fiscam -

15. Federal Managers’ Financial Integrity Act of 1982 (31 USC 3512)(Public Law No:

97-255) Text - H.R.1526 - 97th Congress (1981-1982): Federal Managers Financial Integrity Act of 1982 | Congress.gov | Library of Congress

16. E-Government Act of 2002, 44 U.S.C. 3601et seq.)-https://www.federalregister.gov/

17. Homeland security Presidential Directive-12

18. Federal Manual 0-8530.-1M, Federal Computer Network Defense (CND) Service

Provider Certification and Accreditation Process https://www.cool.osd.mil/usmc/ia_documents/DoD_8570.01M.pdf

19. FSO Evaluator’s Scoring Metrics: Certification and Accreditation of Computer Network Defense Service Providers

20. Federal Directive 8570.1, Information Assurance Training, Certification, and Workforce Management https://www.cool.osd.mil/usmc/ia_documents/DoD_8570.01M.pdf

21. Federal 8570.01M, Federal Information Assurance Workforce Improvement Program https://www.cool.osd.mil/usmc/ia_documents/DoD_8570.01M.pdf

22. Computer Network Defense (CND)

23. Ginnie Mae’s Information Assurance Manual

24. Federal Security Technical Implementation Guides (STIGs)

1.3.1 Project Planning and Management

All HUD IT projects, including all information systems acquired, developed, enhanced, or maintained shall follow the policy, procedures, standards, and guidelines set forth within the IT Management Framework using the Project Planning and Management (PPM) Life Cycle located at HUD’s PPM Life Cycle Website:

http://portal.hud.gov/hudportal/HUD?src=/program_offices/cio/ppm/PPMV20HOME

PPM was designed based on the best practices from Capability Maturity Model Integration (CMMI) for systems development and PMBok for project management.

While at its foundation, PPM is designed as a Waterfall methodology, HUD encourages tailoring the PPM to use the many modern solution development methodologies available to enable the planning, development and delivery of usable functionality within 6-to-9-month increments.

Contractors are encouraged to propose a preferred methodology whether their solution(s) are for custom development, including prototypes or pilots, Commercial Off the Shelf (COTS)/ Government Off the Shelf (GOTS) configuration, or Software as a Services. Working with the HUD Project Manager(s), the Contractor shall tailor PPM to take advantage of Contractor proposed expertise in using other methodologies in a manner that will provide HUD the best value and address all of the work necessary for successful project completion, on time, within budget, and delivering intended functionality.

The decisions of PPM tailoring are captured in the Project Tailoring Agreement (PTA), which documents the specific agreement for creating, combining, referring or omitting specific artifacts applicable to the project, as well as adjusting project control gate reviews to be consistent with the tailoring. All tailoring of PPM must be approved by HUD’s Deputy Chief Information Officer (DCIO) for Business & IT Modernization. As a default, any project without an approved project tailoring agreement is required to follow all PPM phases and artifacts as presented.

1.4 Non-Personal Services

The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks or prepare work schedules for individual Contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services.

If the Contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the Contractor's responsibility to notify the Contracting Officer (CO) immediately. These services shall not be used to perform the work of a policy, decision making, or management nature, i.e. inherently Government functions.

All decisions relative to programs supported by the Contactor shall be the sole responsibility of the Government.

1.5 Period of Performance

The period of performance shall be for one (1) 12-month base period and nine (9) 12-month option periods.

1.6 Place of Performance

The services to be performed under this contract shall be performed at the Contractor’s facility.

1.7 Hours of Operation

N/A

1.8 Special Qualifications

The Contractor shall possess and maintain ISO/IEC 20000 and IT Infrastructure Library (ITIL) certifications relevant to IT Service Management (ITSM).

1.9 Post Award/Kickoff Conference

The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance HUD Acquisition Regulation (HUDAR) clause 2452.237-79 - Post Award Conference.

1.10 Status Meetings

The Contracting Officer, Contracting Officer’s Representative (COR) and other Government personnel, as appropriate, may meet periodically with the Contractor to also review Contractor performance, requirement status, etc. At these meetings, the Contracting Officer will apprise the Contractor of how the Government views the Contractor's performance or progress of the requirement. The Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government. Post Award Conference and subsequent meetings may be held via teleconference at the Contracting Officer's discretion

1.11 Contractor Travel

N/A

1.12 Transition In

The Contractor shall, upon the Contracting Officer's written notice, furnish Transition-In services as required. As a successor, the Contractor shall have sufficient personnel on board during the 180 calendar days Transition-In period to ensure a smooth transition with the incumbent Contractor and the Government. The Contractor shall provide an orderly transition of work acceptance and accomplishment such that any impact on the program is minimized. During the Transition-In period, the Contractor shall become familiar with the requirements to commence full performance of services by the end of the contract transition-In period. Transition-in is not required if the successor Contractor is the incumbent Contractor.

1.13 Transition Out

To minimize any decrease in productivity and to prevent possible negative impacts on additional services, the Contractor shall have sufficient personnel on board during the 180 calendar days Transition-Out period. The incumbent Contractor shall ensure a smooth transition with the successor Contractor during the Transition-Out period, prior to completion of contractual performance. The incumbent Contractor shall aid the successor in the development of plans, procedures, and methods for the assumption of all on going work. The Contractor shall provide an orderly transition of work acceptance and accomplishment, such that full control by the successor Contractor is achieved by the end of the new contract Transition-In period. Definitions and Acronyms

2.1 Definitions

Business Day - Every official day of the week which are days between and including Monday to Friday. This does not include public holidays and weekends.

Contracting Officer (CO) - A person with authority to enter into, administer, and/or terminate contracts and make related determinations and findings on behalf of the Government. Note: the only individual who can legally bind the Government.

Contracting Officer's Representative (COR) - An employee of the U.S. Government appointed by the Contracting Officer to perform contract administration activities regarding technical issues. This individual has authority to provide technical direction to the Contractor if direction is within the scope of the contract, does not constitute a change and has no funding implications. This individual does NOT have the authority to change the terms and conditions of the contract.

Contractor - A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

Defective Service - A service output that does not meet the standard of performance as Technology operations associated with the Performance Work Statement.

Deliverable - Anything that can be physically and electronically delivered but may include non-manufactured things such as meeting minutes or reports.

Demonstration (DEMO) - Contains sample configuration and transaction data. The DEMO environment is leveraged to conduct additional testing for new function functionality. It is also used to apply patches released by PeopleSoft for testing prior to migrating to other environments.

Development (DEV) - The development (DEV) environment is used by Vendors and Ginnie Mae to conduct development and integration testing prior to official system testing in SIT and UAT. Code is promoted here from the developer’s local machine and tested to ensure correctness. Once code is successfully integrated and tested here, it is considered ready for system testing.

Disaster Recovery (DR) - The disaster recovery environment is configured to support Ginnie Mae applications in the event the primary hosting facility is rendered inoperable.

The disaster recovery environment will include a dedicated production environment including dedicated servers for each production (PROD) application. Connectivity will be secured through a secure VPN internet connection.

Government Furnished Property (GFP) - Government-furnished property means property in the possession of, or directly acquired by, the Government and subsequently furnished to the Contractor for performance of a contract. Government-furnished property includes spares and property furnished for repair, maintenance, overhaul, or modification. Government-furnished property also includes Contractor-acquired property if the Contractor-acquired property is deliverable under a cost contract when accepted by the Government for continued use under the contract.

Performance Standard - The Contractor's performance level required by the Government.

Performance Work Statement (PWS) - A statement of work for performance-based acquisitions that describe the required results in clear, specific, and objective terms with measurable outcomes.

Production (PROD) - This is the production environment for Ginnie Mae. Only software that has passed system testing and been fully accepted and baselined by Ginnie Mae can be promoted to production. These are considered the critical servers hosting live data and systems for use by the public and require the highest uptime.

Quality Assurance (QA) - Policies and procedures adopted by the Government to ensure that supplies and services acquired under Government contracts conform to the contract’s quality requirements.

Quality Assurance (QA) - The QA environment is for testing upgrade procedure against data, hardware, and software that closely simulate the Production environment and where intended users test the resulting application.

Quality Assurance Surveillance Plan (QASP) - A plan describing how the agency will survey, observe, test, sample, evaluate and document the Contractor's performance in meeting critical performance standards identified in the contract.

Quality Control (QC) - All measures taken by the Contractor to ensure that the quality of an end product of service shall meet contract requirements.

Staging (STG)(PreProd) - This environment mirrors the production environment and its purpose is to enable Quality Assurance tests after the DEV environment before moving to the PROD environment.

Subcontractor - Any person, other than the prime Contractor, who offers to furnish or furnishes any supplies, material, equipment, or services of any kind under a prime contract or a subcontract entered into in connection with.

System Integration Testing (SIT) - The SIT testing environment is where pieces of Ginnie Mae application code are uploaded and tested for interoperability with other applications. The code is integrated after normal software testing is conducted and approved.

Test (TST) - The Test environment is reserved for testing single pieces of Ginnie Mae application code. Prior to moving the code through SIT and UAT testing, the code must be tested and approved in this environment.

Training (TRN) - The Training Environment is designated for educating end users on how to operate Ginnie Mae applications. The Training environments are also paired with

QA environments in some instances. These environments are typically closed off from PROD environments and enable users to experiment and learn.

User Acceptance Testing (UAT) - The UAT Environment is where Ginnie Mae applications are tested to confirm that the functionality is working properly for end users.

Code will have already passed through the TST and SIT environments to reach this stage of the Software Development Lifecycle.

2.2 Acronyms

AQL - Acceptable Quality Level CND – Computer Network Defense CIO or OCIO - Office of the Chief Information Officer of HUD CISA – Technology operations security and Infrastructure Security Agency CISO – Chief Information Security Officer CO - Contracting Officer COR - Contracting Officer's Representative CTA – Chief Technology Architect DEMO - Demonstration DEV - Development DR - Disaster Recovery FISMA – Federal Information Security Management Act GAO - U.S. General Accountability Office HUD - U.S. Department of Housing and Urban Development IA – Information Assurance IAM – Information Assurance Manager IT - Information Technology NIST – National Institute of Standards and Technology OCPO - Office of the Chief Procurement Officer OIG - Office of Inspector General OMB - Office of Management and Budget POAM – Plan of Action and Milestones PM - Project Manager POC - Point of Contact PPM - Project Planning and Management PROD - Production QA - Quality Assurance QASP - Quality Assurance Surveillance Plan QCP - Quality Control Plan SIT - System Integration Testing SA&A – Security Authorization and Accreditation STG - Staging STIG - Federal Security Technical Implementation Guides TBD - To be determined TRN - Training TST – Test UAT - User Acceptance Testing U.S.C - United States Code

3 Government-Furnished Property and Services The Contractor shall ensure accurate control and accountability of all Government- Furnished Property (GFP) in accordance with the terms and conditions of this contract.

The Government will furnish, at no cost to the Contractor, the GFP shown below.

3.1 Government Services

No Government services will be provided.

3.2 Facilities

The Government will not provide facilities.

3.3 Equipment

The Government will provide HUD or Ginnie Mae issued laptops when required, but all other IT equipment required will be furnished by the Contractor.

3.4 Materials and Information

The Government will provide documentation or access to information via the Government provided document storage location(s). Copies of the required materials may be provided to the Contractor in hard copy or soft copy. Access to all existing technology operations tools, environments, programs, services, software and licenses will be provided by the Government. The Contractor will be given access after completing successful onboarding. All materials will remain the property of the Government and will be returned to the Government through the COR upon request or at the end of the contract period of performance.

3.5 Quality Assurance (QA)

The Government shall evaluate the Contractor's performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable quality level.

4 Contractor-Furnished Items and Services

The Contractor shall furnish, all facilities, equipment, and supplies required to perform the work under this contract that are not listed under Government-Furnished Property and Services.

4.1 Facilities

The Contractor shall furnish all facilities.

4.2 Equipment

The Contractor shall furnish all equipment.

4.3 Material

The Contractor shall furnish all materials.

4.4 Contractor Responsibilities

The Contractor shall only conduct business with designated Government personnel listed as points of contact (POCs). Names of authorized personnel shall be provided to the Contractor by the Government, in writing, and updated as necessary throughout the contract period.

U.S. Government records, copies of original results and reports, verified original data, corrected data and corrected supporting final reports which are maintained by the Contractor remain the property of the U.S. Government. These files/results must be surrendered to the COR.

4.5 Contractor Personnel

See HUDAR clause 2452.237-70 - Key Personnel in the Key Personnel section of the contract.

4.6 Identification of Contractor Employees

All Contractor/subcontractor personnel shall wear company picture identification badges to distinguish themselves from Government employees. When conversing with Government personnel during business meetings, over the telephone, or via electronic mail, Contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees. Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation. Where practicable, Contractor/subcontractors occupying collocated space with their Government program customer shall identify their workspace area with their name and company affiliation, or at a minimum, "Contractor" after name.

5 Specific Tasks

5.1 Transition-In Services (Initial)

The Contractor shall provide Transition-In support services that shall provide uninterrupted and continuing services of all existing maintenance services. The Contractor shall submit a draft Transition-In Plan five (5) business days after the contract award. The plan shall include:

A description of all activities necessary to ensure continuity of operations and limits disruption to services and daily operations until operational responsibility is completely assumed.

A description of the technical approach, organizational resources, resource allocations and management controls to be employed to meet the cost, performance and schedule requirements to transition-in the services required by the Contract.

The technical approach, planned transition activities, Transition activity timelines and milestones, Transition resource requirements, Transition security requirements, Transition risks and mitigation or avoidance strategies, Transition communication plan

A Work Breakout Structure (WBS) in Microsoft Project format addressing schedule and work products.

Knowledge transfer to ensure continuity of technology operations. This includes documenting processes, procedures, and configurations, and providing training for incoming personnel to ensure a smooth transition.

The Contractor shall submit a final Transition-In Plan within fifteen (15) business days of receiving GNMAs comments on the draft plan.

The Contractor shall participate in weekly planning sessions with GNMA and the incumbent Contractor(s) and provide updates during the meeting to its transition plan(s) to address any specific changes because of these discussions. The incumbent Contractor shall transition all required information.

The Contractor shall coordinate with the incumbent Contractor to complete the necessary forms or documentation for the transference of Services, Service Accounts and all maintenance services needed to support the requirements and tasks.

The Contractor shall send an email to the COR within 5 business days after the completion of the transference of each of the services. The email shall include the transference account information, account POC, account number, provider information, period of performance, cost of service, confirmation from provider of the completed transference. The transition period will not exceed 180 days.

The Contractor shall submit a Transition-In Completion Report 10 Business Days after Transition-In is complete via email to the COR. The report shall include the final status of all the transition tasks and activities to include the completion date as annotated in the Transition In Plan and work breakdown structure.

5.1.1 System Review/Fit Gap Analysis

The Contractor shall review application tools, platforms and configurations to determine if setup, configuration and deployments meet Original Equipment Manufacturer (OEM) and technology best practices and deployment guidelines. If not, the Contractor shall identify the need to re-configure/re-design/update deployments to meet best practices and deployment guidelines. The Contractor shall review and determine if gaps exist in the current application architecture and review and recommend alternative products to fill the identified gaps. If, during the system review and fit/gap analysis, it is determined that an existing application platform or product cannot be configured to meet certain entity-specific mandatory requirements or best practices, the Contractor shall provide a plan to scope, design, develop, test, and implementation of an approved replacement to accommodate the entity-specific mandatory functionality and/or best practices.

The Contractor shall review the following existing technology operations program to include:

Documenting the Current State o Review existing technology operations, processes, tools and services.

o Collect all relevant documentation (SOPs, runbooks, architecture diagrams, asset inventories).

Defining Recommended Future State o Clarify the organization’s desired outcomes, performance metrics, and compliance requirements.

o Identify any new or changed requirements.

Capability Assessment.

o Assess the current’s tools, technologies, processes, and operations.

o Map these capabilities against the organization’s current and future requirements.

o Identify where the current environment fully meets or exceeds the organization’s needs.

o Document best practices or recommended enhancements to the current environment.

Gap Identification o Identify current capabilities, tools or process that do not meet requirements o Highlight missing skills, unsupported technologies or process differences o Assess the potential impact of each gap on service delivery, continuity and performance o Identify the risks associated with each gap, including potential service disruptions or compliance failures Remediation Recommendation o Develop plans and recommendations to address each identified gap (e.g., training, process, changes, tool acquisition or update/replacement) o Provide a recommended schedule / notional timeline to address / close each identified gap.

Finalize Report o Review findings and recommended remediation plans with the

Government for validation.

o Deliver a comprehensive Fit/Gap Analysis Report that summarizes the fits, gaps, impacts, risks and recommended actions.

Transition Plan o Update the Transition Plan to incorporate any fit/gap findings and approved remediation actions into the overall transition plan.

o Track closure/resolution of all gaps as part of the transition milestones and regular status reporting

The fit/gap analysis shall include proof of concept sessions to review the approved solutions against requirements and business processes and identify the fits and gaps.

The Contractor shall review the results of the fit/gap analysis to assess the level of effort required to meet the gaps and shall support and generate all activities necessary to conduct the fit/gap analysis for the system, including:

a. Review of functional and other requirements.

b. Identification of potential business process impact areas.

c. Conducting proof of concept sessions and demonstrating the new system capabilities and workflow.

d. Creating fit/gap analysis and comparison reports.

e. Providing specific recommendations and developing the level of effort to configure and enhance (if required through an extension) the system.

The Contractor shall submit a Fit/Gap Analysis Report via email to the COR ten (10) business days after completion of transition-in activities. The report shall include:

a. an executive summary with detailed findings and recommendations.

b. All identified Application, and Services / Products / Deployments and Validation of Configuration as per OEM Best Practices.

c. Requirements review results (identifying the fits and gaps).

d. Products, functions and services impacted by the gap.

e. Functional and technical gaps and how the Contractor recommends the

Government can fill the gap.

f. External requirements, including licensing, services, methods to address ensuring / maintaining operations and maintenance of/for the system.

g. Review infrastructure, applications and services configurations to determine if alternative configurations are required.

h. Identify application and services impact. The Contractor shall incorporate into the design and implement a best practice, zero impact approach for all environments.

i. Technology operations roadmap recommendation.

j. Application and Service O&M migration strategy and plan.

k. Inventory Report of all technology operations applications, tools, platforms and configurations that identifies if setup, configuration and deployments meet Original Equipment Manufacturer (OEM) best practices and deployment guidelines.

Performance Standards

a. Standard: Submit a draft Transition-In plan 5 business days after contract award AQL: Five (5) business day deviation from standard

b. Standard: Submit a final Transition-In plan 15 business days after receiving Government Comments AQL: Five (5) business day deviation from standard

c. Standard: Send a Transference of Services email within 5 business days after completion of the transference of each service AQL: Five (5) business day deviation from standard

d. Standard: Submit a Transition-In Completion 10 business days after completion of transition-in activities AQL: Five (5) business day deviation from standard

e. Standard: Submit a Fit/Gap Analysis Report via email to the COR ten (10) business days after completion of transition-in activities.

AQL: Five (5) business day deviation from standard

Deliverables A001 Draft Transition-In Plan A002 Final Transition-In Plan A003 Transference of Services Emails A004 Transition-In Completion Report A005 Fit/Gap Analysis Report

5.2 Program Management

The Contractor shall provide program management support under this effort. This includes management and oversight of all activities performed by contractor personnel, including subcontractors, to satisfy the requirements identified in this Performance Work Statement (PWS). The Contractor shall identify a Program Manager (PM) by name that shall provide management, direction, administration, quality assurance, and leadership of the execution of this effort.

The Contractor shall facilitate Government and contractor communications; use the best industry standards and proven methodologies to track and document requirements and activities to allow for continuous monitoring and evaluation by the Government; and ensure all support and requirements performed are accomplished in accordance with the PWS. The Contractor shall notify the Contracting Officer Representative (COR) and Technical Point of Contract (TPOC) of any technical, financial, personnel, and general managerial problems encountered throughout the period of performance (PoP).

All labor hours and work will be documented and accounted for through Service Now ticketing. The Vendor shall ensure all work completed has associated Service Now tickets recording work completed and hours associated with each ticket and assignment.

The Contractor shall recommend the overall communication management structure to provide collaborative, responsive interfacing with the Government and a mechanism to facilitate rapid problem resolution and approval of contractor recommendations by the required authorities. The Contractor shall ensure that Information Technology Infrastructure Library (ITIL) methodologies are incorporated into the Program management structure and guide the overall execution of the requirements.

The Contractor shall develop and submit to the COR a draft Program Management Plan (PMP) 10 business days after the contract Post Award/ Kick-off Conference. At a minimum, the plan shall include the following:

Description of proposed management approach, timelines, and tools to be used in the execution of the contract services;

Detailed Standard Operating Procedures (SOPs) for all tasks including milestones, tasks, and subtasks required;

Overall Work Breakdown Structure (WBS); and The PMP must comply with the HUD PPM process and Ginnie Mae's IT governance program.

A communications plan annotating:

Key Stakeholders Primary Client Contact Contact Information Contractor Team Personnel Roles and Responsibilities Contact Information Management Structure Escalation Path for issue Resolution Communications Method Communications Type Meeting Schedule Risk Management Plan annotating:

How Risks will be identified, managed and mitigated Key Stakeholders and responsibilities Monitoring and Review Processes

A final PMP shall be submitted to the COR within ten business days of receipt of COR comments.

Performance Standards

a. Standard: Submit to the COR a draft Program Management Plan (PMP) 10 business days after the contract Post Award/ Kick-off Conference

AQL: Five (5) business days deviation from standard

b. Standard: A final PMP that incorporates 100% of the requested information and revisions shall be submitted to the COR within 10 business days of receipt of COR comments

AQL: Five (5) business days deviation from standard

Deliverables

A006 Draft Program Management Plan A007 Final Program Management Plan

5.2.1 Project Management

The Contractor shall:

1. Oversee the management of Technology O&M under this requirement, system lifecycle management (conception, design, deployment, operations and maintenance).

2. Attend weekly Ginnie Mae project management meetings.

3. Attend weekly Ginnie Mae Change control meetings.

4. Attend weekly Ginnie Mae technology governance meetings.

5. Manage on average 10-15 major infrastructure projects per year.

6. Support on average 35-45 application software development projects per year.

7. Manages all daily assignments and priorities in support of this requirement.

8. Coordinate with all necessary Infrastructure and Applications Teams.

9. Assist in the coordination of all O&M projects performed under this effort.

(Upgrades, Changes, Implementations, Deployments, Compliance, Cloud, Enhancements, Changes, Tech Refresh, etc.).

10. Coordinate change management.

11. Maintain a variety of program deliverables (e.g. Risk Register, Action Items, Issues Log, external and internal Program Status Reports, etc.).

12. Coordinating meetings between all stakeholders.

13. Prepare and deliver meeting agenda, notes and minutes.

14. Identify and escalate program issues to COR and Ginnie Mae Program Manager.

15. Work with functional…