Enterprise Risk Management Program (ERM)

Statement of Work (SOW) / Performance Work Statement (PWS)

To strengthen and enhance Ginnie Mae’s Enterprise Risk Management (ERM) Program to effectively manage diverse risks across the organization and achieve strategic goals. The contractor will provide program management support for the continued enhancement, administration, and execution of the ERM Program.

• Program Management Support: Oversee all contractor activities, including weekly status meetings, reports, and minutes; develop and maintain a Project Work Plan.

• ERM Program Execution & Administration: Administer, execute, enhance, and mature the ERM Program. This includes continuous monitoring of enterprise risk information, conducting assessments, and supporting risk communications through dashboards and reports.

• ERM Program Governance & Maturity: Annually review and recommend updates to ERM governance documents (charters, policies, procedures) and assess ERM Program maturity.

• Special Projects: Perform ad-hoc projects related to risk assessments or risk awareness as directed by the government.

• Transition Services: Provide transition-in and transition-out support as needed.

• Weekly Status Reports and Minutes must be completed and delivered accurately and on time.

• Project Work Plan must be accurate, up-to-date, and accessible.

• Risk Appetite, Tools & Templates, Dashboards, Risk Assessments, Risk Response, and Reporting must meet defined standards for comprehensiveness, accuracy, timeliness, and accessibility.

• Governance Document Updates and Maturity Assessment/Implementation Plans must be comprehensive and relevant.

• Deliverables are subject to resubmission within five (5) business days if not accepted.

• Period of Performance: 12-month base period with four 12-month option periods.

• Place of Performance: Primarily at the Contractor's facility.

• Qualifications: Contractors must possess specific industry certifications (e.g., CPA, CISA, CIA, PMP, CISSP).

• Non-Personal Services: Government will not supervise contractor employees or control work methods.

• Government Furnished Property: ERM Program artifacts will be provided by the Government.

• Contractor Furnished Items: Contractor must furnish all necessary facilities, equipment, and materials.

• Key Personnel: Specific key personnel roles are required (Senior Manager/Director, Senior Consultant, Consultant) with defined experience levels.

• Transition: 30-day transition-in and transition-out periods are required.

• Compliance: Adherence to numerous federal statutes, regulations, and standards (e.g., OMB Circulars, FISMA, NIST) is mandatory.

Sources Sought Notice

This Sources Sought Notice (SSN) is issued by the Department of Housing and Urban Development (HUD), Ginnie Mae Office of Enterprise Risk, Operational Risk Analysis Division (ORAD) for market research. The objective is to identify potential sources for Enterprise Risk Management (ERM) Program support services. These services are intended to strengthen and enhance Ginnie Mae’s ERM Program to effectively manage risks across its organization and achieve strategic goals. The results of this market research will inform the procurement method.

• Core Competencies: Vendors must demonstrate expertise in risk and compliance, including specific industry certifications such as CPA, CISA, CIA, CFE, COSO, CGFM, PMP, CISSP, CISM, CCSP, CRISC, CORP, and cybersecurity risk-related certifications.

• Experience: Provide a detailed description of experience supporting similar requirements, identifying whether the experience is Federal or Commercial.

• Differentiators: List and discuss unique factors and benefits of services offered.

• Draft PWS Feedback: Vendors are invited to provide feedback on the composition and content of the attached Draft PWS.

• The NAICS code is 541611 – Administrative Management and General Management Consulting Services ($24.5M size standard).

• The Product Service Code (PSC) is R408 Program Management Support.

• Contractors are sought under Multiple Award Schedule (MAS) SIN 541611.

• Submission Deadline: April 30, 2026, by 2:00 PM EST.

• Submission Method: Email responses to Cheri Redding (Cheri.L.Redding@hud.gov) and Diane Toledo-Gaskins (Diane.e.Toledo-Gaskins@hud.gov).

• Information Required: Organization name, address, email, website, phone number, size, and ownership type. Tailored capability statements addressing the effort, with supporting documentation for organizational and staff capabilities. If subcontracting or teaming is anticipated, address the administrative and management structure.

• Evaluation: A high-level assessment of capability statements will be performed. Generic brochures are not requested.

• The procurement method (e.g., set-aside for small business, full and open competition, GSA procurement) will be determined based on market research responses.

• Interested offerors must specify their Unique Entity Identifier (UEI), business size applicable to NAICS, socioeconomic business categories, GSA contract number (if applicable), and any other applicable GWAC numbers.

• This is a Sources Sought Notice for market research only; it is not a Request for Proposals (RFP).

• The government assumes no financial responsibility for costs incurred in responding.

• No questions will be answered, and no feedback will be provided on submissions.

• A Draft Performance Work Statement (PWS) is attached and provides detailed task descriptions, qualifications, performance metrics, deliverables, and place of performance (Contractor's facility).