Company: AGM-PH
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000845877-25-000033
Chunk: 164

Company: FEDERAL AGRICULTURAL MORTGAGE CORP
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 164
---
Item 1C.Cybersecurity

Risk Management and StrategyFarmer Mac recognizes the importance of assessing, identifying, and managing risks associated with cybersecurity threats. Farmer Mac’s process to identify and assess material risks from cybersecurity threats operates alongside Farmer Mac’s broader overall risk assessment process that contemplates all company risks. As part of this process, appropriate personnel collaborate with subject matter specialists, as necessary, to gather information to identify and assess material cybersecurity threat risks, their severity, and potential mitigations.Farmer Mac has implemented a variety of processes, technologies, and controls to aid in its efforts to identify, assess, and manage cybersecurity risks. Farmer Mac’s approach includes:•an enterprise risk management program that includes an annual cybersecurity risk assessment and management and is periodically refreshed;•security reviews designed to identify risks from many new features, software, and vendors, including a security operations center to monitor our systems;•a team of trained and experienced security professionals to investigate and remediate cybersecurity incidents;•regular cybersecurity training for all employees and network users to raise and maintain awareness of cybersecurity risks and best practices;•a vulnerability management program designed to identify vulnerabilities in the systems and software Farmer Mac uses;•regular cybersecurity testing, including third-party penetration testing on a periodic basis to allow security researchers to help identify vulnerabilities in Farmer Mac’s systems before they mature into real-world cybersecurity threats;•a third-party service provider risk management program designed to identify and mitigate risks associated with third-party vendors and business partners, which includes pre-engagement diligence, risk assessments, contractual security and notification provisions, and ongoing monitoring, as appropriate;•a threat intelligence program designed to model and research potential cybersecurity threat actors to identify vulnerabilities and anticipate attack vectors before they are exploited;

49

•cybersecurity controls designed to segment access to systems and to limit access to sensitive data, which controls are tested and updated regularly;  •patch management controls aimed at reducing system vulnerabilities; and•a generative artificial intelligence policy that describes how users may utilize generative artificial intelligence tools in alignment with Farmer Mac's values, ethical standards, and legal requirements, while also safeguarding sensitive information.  These processes vary in maturity across the business, and Farmer Mac works continually to improve them.Farmer Mac also maintains a privacy and security incident response program to prepare for, detect, respond to, and recover from cybersecurity incidents. That program includes processes to triage, assess severity for, escalate, contain, investigate, and remediate any cybersecurity incident, as well as to comply with any applicable legal obligations (including to