Company: FMCCN
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0001026214-25-000040
Chunk: 179

Company: FEDERAL HOME LOAN MORTGAGE CORP
Filing Date: 2025-02-13
Form: 10-K
Item: Item 15
Chunk 179
---
 political environment. Remote work environments may increase the risk that we may experience cybersecurity incidents as a result of our employees, vendors, counterparties, service providers, and other third parties with which we interact working remotely on less secure systems and environments.

Because we are interconnected with and dependent on third-party vendors, counterparties (e.g., seller/servicers), exchanges, clearinghouses, fiscal and paying agents, and other financial institutions, we could be adversely affected if any of them are subject to a successful cybersecurity incident. Third parties with which we do business have been, and may continue to be, sources of cybersecurity or other technology risks. We routinely transmit and receive confidential, proprietary, and other information (including personal information) by electronic means. This information could be subject to interception, misuse, or mishandling. Our exposure to these risks could increase as a result of our migration of core systems and applications to a third-party cloud environment. While we generally perform cybersecurity diligence on our key vendors, because we do not control third parties with whom we do business and our ability to monitor their and their supply chain's cybersecurity posture is limited, we cannot ensure that the cybersecurity measures they take will be sufficient to protect any information we share with them. Due to applicable laws and regulations or contractual obligations, we may have liability for certain data breaches resulting from cybersecurity incidents attributed to third parties with whom we do business in relation to the information we share with them.

Our measures designed to protect critical assets and provide employee awareness training about phishing, malware, and other cybersecurity risks may not provide effective security. Our computer systems, software, end point devices, and networks may be vulnerable to cybersecurity incidents, supply chain disruptions, or other attempts to harm them or misuse or steal information (including personal information). The scale and effectiveness of such attempts may be further enhanced by the use of Artificial Intelligence-based technologies and methods. We routinely identify cybersecurity threats as well as vulnerabilities in our systems and work to address them, but these efforts may be insufficient. Outside parties may attempt to induce employees, customers, third parties, including suppliers, sellers and servicers, financial market utilities, and other third parties, or other users of our systems or networks to disclose confidential, proprietary, or other information (including personal information) in order to gain access to our systems and networks and the information they contain. Unauthorized access or disclosure, or breaches of our security, also may result from human error. Insider threats remain a risk given our workforce diversification to include contractors, remote workers, part-time employees, and full-time