Fannie Mae Information Security and Business Resiliency Supplement

Any of the following related to Confidential Information:

• loss of;
• accidental or unauthorized acquisition, use, modification, disclosure, deletion, or destruction of;
• accidental or unauthorized access to;
• circumvention, disabling, or deactivation of security measures protecting; OR
• an occurrence affecting the confidentiality, integrity, or availability of.

Examples include one or more of the following occurring at the Company or at the Company’s third party(ies):

• ransomware;
• denial of service attack which may affect the delivery of the services to Fannie Mae;
• business e-mail compromise (BEC);
• vulnerabilities that may affect the delivery of services, loans, or data to or for Fannie Mae;
• misdirected external e-mail containing Fannie Mae Confidential Information;
• social engineering attempts resulting in the successful compromise of Company credentials; and
• insider threat resulting in unauthorized access to, compromise of, or impact to Company network and/or Confidential Information.

Without undue delay and no later than 36 hours after identification of the Cybersecurity Incident, or the reasonable conclusion a Cybersecurity Incident may have occurred, and promptly thereafter as requested, provide Fannie Mae via email at [email protected] (or by such other means as Fannie Mae may otherwise request) all known details of the Cybersecurity Incident, including:

• identification date of the event;
• mitigation and/or containment status including details of actions taken; and
• indication of business operations suspended as a result.

In addition, and when available, the Company must promptly provide to Fannie Mae:

• related internal and external investigations and technical indicators of compromise (email addresses, hash values, IP addresses, malware code, indicator of compromise, etc.);
• all tactics, techniques, and procedures associated with the Cybersecurity Incident, details surrounding the attack methodology, timing of the Cybersecurity Incident, and whether Fannie Mae’s systems or Fannie Mae Confidential Information have been accessed, potentially accessed, or otherwise compromised;
• the name(s) of any third-party incident response or remediation service providers with whom Company is working;
• any law enforcement agencies that the Company has engaged involved;
• contact information and titles for the individual(s) leading the Cybersecurity Incident investigation within or on behalf of the Company; and
• details and information as to whether and if so, the extent to which (including the data attributes of), Fannie Mae Confidential Information was accessed, taken, or exposed.

Fannie Mae will determine if access to systems needs to be restricted based on the details of the incident reported. If access is restricted, Fannie Mae teams will provide guidance and requirements for restoring access (see Section 4.1: Actions by Fannie Mae).

Yes. In addition to the Cybersecurity Incident reporting requirements, if Company:

• Inadvertently or by intentional action, loses;
• Has stolen from; or,
• Incorrectly routes outside of Company;

physical information, such as paper files or other media, which includes Fannie Mae Confidential Information, without undue delay and no later than 36 hours after identification of the matter, or the reasonable conclusion one may have occurred, and promptly thereafter as requested, Company must provide notice to Fannie Mae via e-mail at [email protected] (see Section 4.4: Lost/Stolen/Incorrectly Routed Physical Information).

In addition to the provisions in the Supplement, Company may have other notification obligations to Fannie Mae as outlined in their applicable agreements, Guides and other requirements with Fannie Mae.

The Supplement requires Companies subject to the Supplement align their Information Security Program with, or exceed, a current industry standard such as the National Institute of Standards in Technology (NIST) Framework (800-53) or the International Organization for Standardization (ISO) 27001 Standard.

Yes. A Company subject to the Supplement that uses service providers (which are a related third party), to store, process, access or transmit Fannie Mae Confidential Information must require their service providers to comply with substantially similar information security and business continuity requirements defined in the Supplement (see Section 3.14: Supply Chain Risk Management).

No. The term "Super Intelligence" is used in the Supplement in place of "Artificial Intelligence" to align with evolving industry terminology. This terminology update is not intended to alter the scope, meaning, or applicability of the Supplement’s requirements.