Third Party/Vendor Risk Management (VRM) Program

There is no solicitation at this time. This request for capability information does not constitute a request for quote; submission of any information in response to this market survey is purely voluntary; the government assumes no financial responsibility for any costs incurred. This is not an evaluation of quotes but an assessment of vendors’ capabilities. Therefore, a high-level assessment of the capability statements will be performed. Generic brochures are not being requested. Vendors should provide information to stress their competencies, differentiators, and past performance showing or demonstrating:

The Contractor shall have the following risk and compliance industry expertise in:

• Certified Public Accountant (CPA)
• Certified Information Systems Auditor (CISA)
• Certified Internal Auditor (CIA)
• Certified Fraud Examiner (CFE)
• Committee of Sponsoring Organizations (COSO)
• Certified Government Financial Manager (CGFM)

Brief description of experience providing support for requirements similar to the requirement in the Draft PWS to include identification of the experience as Federal or Commercial.

Differentiator’s listing/discussing unique factors and benefits of the services that set them apart from others.

While the government will not respond to any questions from this Sources Sought, we are interested in any feedback your company has on the overall content/composition of the draft PWS as a result of reviewing the document.

If your organization has the potential capacity to perform these contract services, please provide the following information:

1) organization name, address, email address, website address, telephone number, and size and type of ownership for the organization; and

2) tailored capability statements addressing the particulars of this effort, with appropriate documentation supporting claims of organizational and staff capability.

If significant subcontracting or teaming is anticipated in order to deliver technical capability, organizations should address the administrative and management structure of such arrangements.

The government will evaluate market information to ascertain potential market capacity to:

1) provide services consistent in scope and scale with those described in this notice and otherwise anticipated;

2) secure and apply the full range of corporate financial, human capital, and technical resources required to successfully perform  similar requirements;

3) implement a successful project management plan that includes compliance with program schedules; cost containment; meeting and tracking performance; hiring and retention of personnel and risk mitigation; and

4) provide services under a performance-based service acquisition contract.

Based on the responses to this Sources Sought/Market Research, this requirement may be further set aside for any of the socio-economic programs, set aside for small business competition, procured through full and open competition, procured through GSA, etc. Interested potential offerors must clearly specify the following: their Unique Entity Identifier (UEI), business size applicable to NAICS, socioeconomic business categories, GSA contract number (if applicable), and any other applicable GWAC numbers. Telephone inquiries will not be accepted or acknowledged, and no feedback or evaluations will be provided to companies regarding their submissions.

Submission Instructions: Interested parties who consider themselves qualified to perform the above-listed services are invited to submit a response to this Sources Sought Notice by April 30, 2026, on or before 2:00 PM EST. All responses under this Sources Sought Notice must be emailed to Cheri Redding at [email protected] and Melissa Corum at Melissa.A. [email protected]. Additional information on the required services is listed below.

If you have any questions concerning this opportunity, please contact the Contracting Officer, Cheri Redding at [email protected] and the Contract Specialist, Melissa Corum, at [email protected].

Background:

• See PWS, Section 1.2.

General Description of Work:

The Contractor shall assist the Ginnie Mae OER, Operational Risk Analysis Division (ORAD) with the continued administration, execution, and enhancement of its VRM Program. The VRM Program will provide oversight of Ginnie Mae vendors and related staff to ensure their activities are conducted in compliance with vendor contract requirements and stated applicable laws and regulations.

The Contractor will perform annual VRM assessments for Ginnie Mae’s vendors using Ginnie Mae’s VRM Framework. The Contractor will also provide service organization monitoring and risk mitigation and Information Technology Governance support. The Contractor will provide the following services which shall include:

• Program Management
• Updates to VRM Framework
• Vendor Assessments
• Service Organization Monitoring and Risk Mitigation
• Information Technology Governance
• Governance Document Updates
• Training Services
• Special Projects
• Transition Services (if needed)

Detailed descriptions of specific tasks are provided in Section 5 Specific Tasks and Deliverables.

Below are the characteristics of the requirement:

The tasks require a set of skill categories based on but not limited to the following approximate breakdown:

• Partner or Equivalent
• Senior Manager / Director
• Program Manager
• Senior Consultant
• Consultant

Contemplated performance metrics:

• See Draft Performance Works Statement (PWS), Performance Requirements Summary

Contemplated report requirements:

• See Draft PWS, Deliverables

Contemplated dollar value of the project:

• N/A

Contemplated place of performance:

• At the Contractor's facility.