Third Party/Vendor Risk Management (VRM) Program

Statement of Work (SOW) / Performance Work Statement (PWS)

To strengthen and enhance Ginnie Mae's Third Party / Vendor Risk Management (VRM) Program, enabling an optimized approach to identifying and remediating compliance issues, and implementing effective risk mitigation strategies through consistent reporting and monitoring of vendors.

This PWS requires contractor support for the U.S. Department of Housing and Urban Development (HUD), Government National Mortgage Association (Ginnie Mae) Office of Enterprise Risk (OER). The contractor will assist in the continued enhancement, administration, and execution of the VRM Program, including service organization monitoring, risk mitigation, and Information Technology (IT) governance support. Key services include:

• Program Management
• Updates to the VRM Framework
• Annual Vendor Assessments (4-5 per year)
• Service Organization Monitoring and Risk Mitigation (reviewing up to 6 vendor SOC reports annually)
• Information Technology Governance support
• Governance Document Updates
• Training Services
• Special Projects (optional, Time & Materials)
• Transition Services (if needed)

The contractor will perform annual VRM assessments for Ginnie Mae’s vendors using Ginnie Mae’s VRM Framework, focusing on mission-critical vendors. The scope includes identifying, assessing, and managing risks associated with third-party vendors.

Performance will be evaluated based on adherence to the Project Work Plan (PWP), accuracy of deliverables, and meeting specified Acceptable Quality Levels (AQLs). Specific performance standards and AQLs are detailed for each task, with potential deductions for missed deadlines.

• Period of Performance: 12-month base period with four (4) 12-month option periods.

• Place of Performance: Contractor's facilities, with potential travel to government or vendor sites for meetings and interviews.

• Qualifications: Contractor personnel should possess expertise in risk and compliance, including certifications such as CPA, CISA, CIA, CFE, COSO, and CGFM.

• Non-Personal Services: The government will not supervise contractor employees or control the method of performance.

• Reporting: Weekly status reports and a Project Work Plan are required.

• Compliance: Services must adhere to HUD and Federal Government rules, regulations, laws, and standards, including SSAE No. 18, COSO ERM Framework, The Green Book, HUDAR, FAR, FISMA, FISCAM, and NIST standards.

• Security: Contractor personnel must wear company-issued identification badges and identify themselves as contractors when interacting with government personnel.

Sources Sought Synopsis

This is a Sources Sought synopsis for market research to identify potential vendors capable of providing Third Party/Vendor Risk Management (VRM) Program support to the Department of Housing and Urban Development (HUD), specifically for Ginnie Mae's Operational Risk Analysis Division (ORAD). The VRM Program aims to oversee Ginnie Mae vendors and staff to ensure compliance with contract requirements, laws, and regulations.

The contractor will assist with the administration, execution, and enhancement of the VRM Program. Key services include:

• Program Management
• Updates to VRM Framework
• Vendor Assessments
• Service Organization Monitoring and Risk Mitigation
• Information Technology Governance
• Governance Document Updates
• Training Services
• Special Projects
• Transition Services (if needed)

Required expertise includes:

• Certified Public Accountant (CPA)
• Certified Information Systems Auditor (CISA)
• Certified Internal Auditor (CIA)
• Certified Fraud Examiner (CFE)
• Committee of Sponsoring Organizations (COSO)
• Certified Government Financial Manager (CGFM)

Vendors should demonstrate competencies, differentiators, and past performance in similar federal or commercial requirements. Feedback on the draft PWS is also requested.

• Contemplated performance metrics, report requirements, and dollar value are detailed in the Draft PWS.

• Place of performance is at the Contractor's facility.

• This is NOT a request for quote; submission of information is voluntary.

• Vendors must submit capability statements, not generic brochures.

• Responses are due by April 30, 2026, on or before 2:00 PM EST.

• Submissions must be emailed to Cheri Redding (Cheri.L.Redding@hud.gov) and Melissa Corum (Melissa.A.Corum@hud.gov).

• No questions will be answered, and no feedback will be provided on submissions.

Based on market research, the requirement may be set aside for socio-economic programs, small businesses, or procured through full and open competition or GSA. Interested parties must specify their UEI, business size (NAICS 541211, size standard $26.5M), socioeconomic categories, and GSA contract number if applicable.

• The North American Industry Classification System (NAICS) code is 541211 – Offices of Certified Public Accountants.
• The Product Service Code (PSC) is R408 Support- Professional: Program Management/Support.