Company: FMCCN
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0001026214-25-000040
Chunk: 105

Company: FEDERAL HOME LOAN MORTGAGE CORP
Filing Date: 2025-02-13
Form: 10-K
Item: Item 15
Chunk 105
---
 baseline control framework.We exercise due diligence over our third parties and service providers, including risk assessments and contractual expectations. However, our control over the security posture of our third-party vendors and service providers and their supply chain connections is limited. Material Effects from Cybersecurity IncidentsOur operations rely on the secure, accurate and timely receipt, storage, transmission, use, disclosure, and other processing of confidential and other information (including personal information) in our systems and networks. We also rely on the secure, accurate and timely receipt, storage, transmission, use, disclosure, and other processing of confidential and other information (including personal information) in the systems and networks of our customers and third parties, including suppliers, sellers and 

FREDDIE MAC  |  2024 Form 10-K81

Management's Discussion and AnalysisRisk Management

servicers, financial market utilities, and other third parties. Cybersecurity risks for companies like ours continue to increase. Like many companies and government entities, from time to time we have been, and expect to continue to be, the target of attempted cybersecurity incidents and other information security threats, including those from nation-state and nation-state supported actors. With respect to third parties, there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the systems, networks, and other technology assets owned or controlled by our third parties.To date, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the company, including our business strategy, results of operations, or financial condition. However, there is no assurance that our cybersecurity risk management program will prevent cybersecurity incidents from having such impacts in the future.For additional information, see Risk Factors - Operational Risks - Cybersecurity threats are changing rapidly and advancing in sophistication. We may not be able to protect our systems and networks, or the confidentiality of our confidential or other information (including personal information), from cybersecurity incidents and other unauthorized access, disclosure, and disruption.       Cybersecurity GovernanceThe Board of Directors and two of its committees, the Operations and Technology and Risk Committees, oversee the company's information and cybersecurity operations and risks from cybersecurity threats by receiving periodic reports from our EVP – EO&T, the Chief Information Security Officer, and other members of management. ManagementOur management is responsible for assessing and managing cybersecurity risks by establishing and maintaining processes and programs designed to prevent, detect, respond to, and mitigate potential cybersecurity risks. Senior management is regularly informed by our cybersecurity personnel on cybersecurity matters. Our management also engages