Company: FMCCN
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0001026214-25-000040
Chunk: 180

Company: FEDERAL HOME LOAN MORTGAGE CORP
Filing Date: 2025-02-13
Form: 10-K
Item: Item 15
Chunk 180
---
 employees. We may not be able to anticipate, prevent, detect, recognize, or react to threats to our systems, networks, and assets, or implement effective preventative or remedial measures against cybersecurity incidents, especially because the techniques used change frequently or are not recognized until launched. 

A cybersecurity incident could occur and persist for an extended period of time without detection. We expect that any investigation of such an incident would take time, during which we would not necessarily know the extent of the harm or how best to remediate it. Our cybersecurity risk management program may not prevent such a cybersecurity incident from having a material impact. We have obtained insurance coverage relating to cybersecurity risks, but this insurance may not be sufficient to provide adequate loss coverage (including if the insurer denies future claims) and may not continue to be available to us on economically reasonable terms, or at all. Further, we cannot ensure that any limitations of liability provisions in our agreements with vendors, counterparties, customers, and other third parties with which we do business would be enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim in connection with a cybersecurity incident.

The occurrence of one or more cybersecurity incidents could result in thefts of important assets (such as cash or source code) or the unauthorized loss, disclosure, misuse, or corruption of confidential, proprietary, and other information (including personal and other information about our borrowers, our customers, or our counterparties) or could otherwise cause interruptions, malfunctions, or other failures in our systems, networks, or operations or those of our customers or counterparties. This could result in significant losses or reputational damage, adversely affect our relationships with our customers and counterparties, negatively affect our competitive position, or otherwise harm our business or investors in our securities. We could also face regulatory and other legal action, including for any failure to provide timely disclosure concerning, or to appropriately limit trading in our securities following, an incident. We might be required to expend significant additional resources to modify or add to our internal controls and other protective measures or to investigate and remediate vulnerabilities or other exposures, and we might be subject to litigation and financial losses that are not fully insured, if at all. In addition, customers, third parties, including suppliers, sellers and servicers, financial market utilities, and other third parties, and governmental organizations may not be adequately protecting the information that we share with them. As a result, a cybersecurity incident on their systems and networks, or a breach of their cybersecurity measures, may result in harm