SAM #86615526Q00010

Ginnie Mae Vendor Risk Management Program Support Services

HUD's Ginnie Mae Office of Enterprise Risk is seeking contractor support for its Third Party/Vendor Risk Management (VRM) Program: - Government Buyer: - U.S. Department of Housing and Urban Development (HUD), Government National Mortgage Association (Ginnie Mae), Office of Enterprise Risk (OER) - Services Requested: - Program management and oversight for the VRM Program - Annual updates to the Vendor Risk Management Framework, including assessment plans, tools, and templates - Annual VRM assessments for 4-5 Ginnie Mae vendors, covering all risk focus areas - Service organization monitoring and risk mitigation, including review of up to 6 SOC 1 and SOC 2 reports annually - Support for managing risks for 10-15 additional vendors not subject to detailed assessments - Annual review and updates to VRM governance documents (policies, procedures, flowcharts, RACI matrices) - IT governance support and training services - Special projects and transition services as needed - Key Requirements: - Contractor staff must have relevant certifications: CPA, CISA, CIA, CFE, COSO, and CGFM - Deliverables include reports, dashboards, assessment plans, and quality control plans - Place of Performance: - Primarily at the contractor's facility, with some work at government or vendor facilities for meetings and interviews - No specific OEMs or product part numbers are mentioned; this is a professional services opportunity

Description

Description: Third Party/Vendor Risk Management (VRM) Program

The Department of Housing and Urban Development (HUD) is issuing this Sources Sought synopsis as a means of conducting market research to identify parties having an interest in and the resources to support this requirement for providing Third Party/Vendor Risk Management (VRM) Program. The result of this market research will contribute to determining the method of procurement. The applicable North American Industry Classification System (NAICS) code and Product Service Code (PSC) assigned to this procurement are: 

541211 – Offices of Certified Public Accountants, with a size standard of $26.5M; and R408 Support- Professional: Program Management/Support

The Contractor shall assist the Ginnie Mae OER, Operational Risk Analysis Division (ORAD) with the continued administration, execution, and enhancement of its VRM Program. The VRM Program will provide oversight of Ginnie Mae vendors and related staff to ensure their activities are conducted in compliance with vendor contract requirements and stated applicable laws and regulations.

There is no solicitation at this time. This request for capability information does not constitute a request for quote; submission of any information in response to this market survey is purely voluntary; the government assumes no financial responsibility for any costs incurred. This is not an evaluation of quotes but an assessment of vendors’ capabilities. Therefore, a high-level assessment of the capability statements will be performed. Generic brochures are not being requested. Vendors should provide information to stress their competencies, differentiators, and past performance showing or demonstrating:

The Contractor shall have the following risk and compliance industry expertise in:

Certified Public Accountant (CPA) Certified Information Systems Auditor (CISA) Certified Internal Auditor (CIA) Certified Fraud Examiner (CFE) Committee of Sponsoring Organizations (COSO) Certified Government Financial Manager (CGFM)

Brief description of experience providing support for requirements similar to the requirement in the Draft PWS to include identification of the experience as Federal or Commercial.

Differentiator’s listing/discussing unique factors and benefits of the services that set them apart from others.

While the government will not respond to any questions from this Sources Sought, we are interested in any feedback your company has on the overall content/composition of the draft PWS as a result of reviewing the document.

If your organization has the potential capacity to perform these contract services, please provide the following information:

1) organization name, address, email address, website address, telephone number, and size and type of ownership for the organization; and

2) tailored capability statements addressing the particulars of this effort, with appropriate documentation supporting claims of organizational and staff capability.

If significant subcontracting or teaming is anticipated in order to deliver technical capability, organizations should address the administrative and management structure of such arrangements.

The government will evaluate market information to ascertain potential market capacity to:

1) provide services consistent in scope and scale with those described in this notice and otherwise anticipated;

2) secure and apply the full range of corporate financial, human capital, and technical resources required to successfully perform  similar requirements;

3) implement a successful project management plan that includes compliance with program schedules; cost containment; meeting and tracking performance; hiring and retention of personnel and risk mitigation; and

4) provide services under a performance-based service acquisition contract.

Based on the responses to this Sources Sought/Market Research, this requirement may be further set aside for any of the socio-economic programs, set aside for small business competition, procured through full and open competition, procured through GSA, etc. Interested potential offerors must clearly specify the following: their Unique Entity Identifier (UEI), business size applicable to NAICS, socioeconomic business categories, GSA contract number (if applicable), and any other applicable GWAC numbers. Telephone inquiries will not be accepted or acknowledged, and no feedback or evaluations will be provided to companies regarding their submissions.

Submission Instructions: Interested parties who consider themselves qualified to perform the above-listed services are invited to submit a response to this Sources Sought Notice by April 30, 2026, on or before 2:00 PM EST. All responses under this Sources Sought Notice must be emailed to Cheri Redding at Cheri.L.Redding@hud.gov and Melissa Corum at Melissa.A. Corum@hud.gov. Additional information on the required services is listed below.

If you have any questions concerning this opportunity, please contact the Contracting Officer, Cheri Redding at Cheri.L.Redding@hud.gov and the Contract Specialist, Melissa Corum, at Melissa.A.Corum@hud.gov.

Background:

See PWS, Section 1.2.

General Description of Work:

The Contractor shall assist the Ginnie Mae OER, Operational Risk Analysis Division (ORAD) with the continued administration, execution, and enhancement of its VRM Program. The VRM Program will provide oversight of Ginnie Mae vendors and related staff to ensure their activities are conducted in compliance with vendor contract requirements and stated applicable laws and regulations.

The Contractor will perform annual VRM assessments for Ginnie Mae’s vendors using Ginnie Mae’s VRM Framework. The Contractor will also provide service organization monitoring and risk mitigation and Information Technology Governance support. The Contractor will provide the following services which shall include:

Program Management Updates to VRM Framework Vendor Assessments Service Organization Monitoring and Risk Mitigation Information Technology Governance Governance Document Updates Training Services Special Projects Transition Services (if needed)

Detailed descriptions of specific tasks are provided in Section 5 Specific Tasks and Deliverables.

Below are the characteristics of the requirement:

The tasks require a set of skill categories based on but not limited to the following approximate breakdown:

Partner or Equivalent Senior Manager / Director Program Manager Senior Consultant Consultant

Contemplated performance metrics:

See Draft Performance Works Statement (PWS), Performance Requirements Summary

Contemplated report requirements:

See Draft PWS, Deliverables

Contemplated dollar value of the project:

N/A

Contemplated place of performance:

At the Contractor's facility.

View original listing