Company: AGM-PH
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000845877-25-000033
Chunk: 165

Company: FEDERAL AGRICULTURAL MORTGAGE CORP
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 165
---
 preserve evidence) and to mitigate brand and reputational damage. Farmer Mac also conducts regular tabletop exercises to test and fortify the controls of its cybersecurity incident response program. Farmer Mac’s security operations center and incident response team assesses the severity and priority of incidents on a rolling basis, with escalations of cybersecurity incidents provided to Farmer Mac’s management team and board as appropriate. If a cybersecurity incident is determined to be a material cybersecurity incident, Farmer Mac’s incident response plan defines the process for any required regulatory disclosures.

Farmer Mac’s risk management approach is supplemented by external and internal enterprise risk management audits, which are designed to test the effectiveness of Farmer Mac’s security controls. Prior cybersecurity incidents have not materially affected Farmer Mac's business strategy, results of operations, or financial condition. Farmer Mac does not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect its business strategy, results of operations, or financial condition, although the occurrence of both intentional and unintentional incidents could cause a variety of adverse business impacts in the future. For more information on Farmer's Mac's cybersecurity risks see "Operational Risks" in "Risk Factors" in Part I, Item 1A of this report. Those disclosures are incorporated by reference in this section.

Governance

Farmer Mac’s board of directors is actively involved in overseeing the company's cybersecurity risk management. At least once a year, the full board of directors meets with Farmer Mac’s Chief Information Security Officer (“CISO”) to discuss and approve Farmer Mac’s programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of Farmer Mac’s business strategy. The board has created a dedicated cybersecurity subcommittee of the enterprise risk committee to oversee Farmer Mac’s cybersecurity programs and practices, including the identification and mitigation of security and privacy risks. The cybersecurity subcommittee consists of three members of the enterprise risk committee. The cybersecurity subcommittee typically meets on a monthly basis with the CISO and other members of Farmer Mac's management team to discuss the performance and effectiveness of Farmer Mac's cyber program and to receive updates on cybersecurity risks, any cybersecurity incidents, and major cybersecurity initiatives. The materials provided to Farmer Mac’s cybersecurity subcommittee and discussed in the meetings may include updates about cybersecurity risks, controls, and assessments, including those from third parties. At each regular quarterly meeting of the board enterprise risk 

50

committee, the cybersecurity subcommittee reviews a summary of the information discussed in the most recent cybersecurity subcommittee meetings. 

Farmer Mac’s C