Company: FMCCN
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0001026214-25-000040
Chunk: 104

Company: FEDERAL HOME LOAN MORTGAGE CORP
Filing Date: 2025-02-13
Form: 10-K
Item: Item 15
Chunk 104
---
 continue to work together to monitor the operational effectiveness of the platform.

We rely on CSS and the CSP for the operation of many of our single-family securitization activities. Our business activities would be adversely affected and the market for Freddie Mac securities would be disrupted if the CSP were to fail or otherwise become unavailable to us or if CSS were unable to perform its obligations to us. As the CSP has an operational dependency on Fannie Mae to administer Freddie Mac issued commingled securities, an operational failure at Fannie Mae could also adversely impact the ability of CSS to perform its obligations to Freddie Mac. In the event of a CSS operational failure, we may be unable to issue certain new single-family mortgage-related securities, and investors in mortgage-related securities hosted on the CSS platform may experience payment delays or errors. 

For additional information, see Risk Factors - Operational Risks - A failure in our operational systems or infrastructure, or those of third parties, could impair our ability to provide market liquidity, disrupt our business operations, damage our reputation, expose us to legal risk, and cause financial losses.

Cybersecurity RiskCybersecurity Risk Management and StrategyWe manage cybersecurity risk using a three lines risk management model and governance structure that is integrated into our enterprise-wide Risk Framework with oversight by the Board of Directors and its committees and senior management positions, including our EVP – EO&T and Chief Information Security Officer (who reports to our EVP – EO&T). For additional information on our enterprise Risk Framework, see Risk Management – Overview, Risk Management – Enterprise Risk Framework, and Risk Management – Enterprise Risk Governance Structure. Our cybersecurity program continues to evolve based on the changing needs of our business, the evolving threat landscape, and the evolving legal and regulatory requirements. Our cybersecurity program is designed to implement a defense in depth strategy. This approach employs overlapping layers of protection at the perimeter, network, platform, application, and data levels with security incident response and identity lifecycle management employed at all levels. This strategy is designed so that if one safeguard fails then additional layers are in place to prevent, detect or mitigate risks from cybersecurity threats. Our key capabilities include solutions designed to protect our perimeter and network, manage our authentication and access, scan to identify vulnerabilities, monitor and respond to suspicious activity and protect our most sensitive data. We validate our capabilities according to the Risk Framework and use third-party vendors and service providers to help enhance our cybersecurity capabilities and to assist us with cybersecurity program assessments and testing. Our cybersecurity program is also designed to align with the National Institute of Standards and Technology 800-53 moderate