Company: FMCCN
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0001026214-25-000040
Chunk: 106

Company: FEDERAL HOME LOAN MORTGAGE CORP
Filing Date: 2025-02-13
Form: 10-K
Item: Item 15
Chunk 106
---
 in periodic cybersecurity exercises and internal cybersecurity incident simulations, including tabletop exercises relating to cyberattacks, ransomware, and other security events. Escalation of specific incidents from our cybersecurity personnel to senior management follow written, risk-based procedures. Our management periodically reports to the Board of Directors, and its committees. These reports include information regarding management's ongoing efforts to manage cybersecurity risk and the steps management has taken towards addressing and mitigating the evolving cybersecurity threat environment. Management discusses cybersecurity developments with the Chairs of the Operations and Technology Committee and the Risk Committee and other Board members between Board and committee meetings, as necessary. Our cybersecurity personnel, and those senior managers who oversee them, including our EVP – EO&T and Chief Information Security Officer, possess demonstrated expertise with cybersecurity matters. For example, our Chief Information Security Officer and members of the Chief Information Security Officer’s leadership team have, on average, over 15 years of work experience in information security or cybersecurity fields and achieved such professional certifications as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and Factor Analysis of Information Risk (FAIR). For additional information on the background of our EVP - EO&T, see Directors, Corporate Governance, and Executive Officers - Executive Officers. Board of DirectorsAs discussed above, the Operations and Technology Committee and Risk Committee are the committees of the Board of Directors that oversee our cybersecurity risks. Members of the Board of Directors also receive reports from management regarding certain internal and industry-wide trends and exercises relating to these matters to assist with their oversight responsibilities. The company has written, risk-based procedures to escalate information regarding certain cybersecurity incidents to the appropriate Board members in a timely fashion. Board members have also participated in cybersecurity training exercises. Additionally, certain Board members are informed of, and have an opportunity to provide feedback on management's internal cybersecurity incident simulations referenced above. The Board of Directors and its committees also have authority, as they deem appropriate, to fulfill Board or committee responsibilities, to engage outside consultants or advisors, including technology and cybersecurity experts, and oversee the company's information security program. See Directors, Corporate Governance, and Executive Officers - Corporate Governance - Board of Directors and Board Committee Information for additional information on the Board of Directors' committees.

Third-Party Risk

Third-party risk is the risk of failure of an individual or entity engaged to deliver a product, service, or process to, or on behalf of, Freddie Mac. We rely on third parties, and their supply chains, to support critical processes and core functions, and are exposed to operational risks as a result of