Freddie Mac Single-Family Seller/Servicer Guide 1302.1 — Overview of information security and business continuity planning requirements

Freddie Mac Single-Family Seller/Servicer Guide 1302.1 — Overview of information security and business continuity planning requirements

Effective 2025-09-11 · Freddie Mac's stamp for this section

This section contains requirements related to: ■ Information security, business continuity and disaster recovery planning ■ Minimizing Freddie Mac’s risk of loss ■ Information security, business continuity and disaster recovery (a) Information security, business continuity and disaster recovery planning This chapter contains the minimum information security program requirements Seller/Servicers must implement to reduce the impact and likelihood of unauthorized persons (or authorized persons with malicious or unlawful intentions) from gaining access to Freddie Mac’s proprietary information, data and Protected Information in: ■ Systems, as defined in Section 2401.1(b) ■ Seller/Servicers’ files, records, storage facilities and systems ■ Files, records, storage facilities and systems of any Related Third Party This chapter also includes the minimum requirements for a Seller/Servicer’s business continuity plan and disaster recovery plan to support continuation of critical business processes necessary to comply with the Seller/Servicer’s Purchase Documents. (b) Minimizing Freddie Mac’s risk of loss To minimize Freddie Mac’s risk of loss in the event of a disaster or unexpected disruption to critical business processes, a Seller/Servicer must have and maintain an information security program, business continuity and disaster recovery plan(s) that ensure its ongoing ability to conduct business operations with Freddie Mac. Information security program, business continuity plan and disaster recovery plan requirements must extend to the confidentiality, integrity and availability of Freddie Mac confidential information (as defined in Section 1201.8(a)) and Protected Information (as defined in Section 8101.4(d)) retained by a Seller/Servicer following Freddie Mac’s termination of the Seller/Servicer’s right to sell or service Mortgages. (c) Information security, business continuity and disaster recovery The information security, business continuity and disaster recovery minimum requirements (together, the “Minimum Requirements”) are not intended to replace the Seller/Servicer’s standards, policies and procedures but are intended to require certain minimum controls that must be in place as part of such standards, policies and procedures. If a Seller/Servicer’s regulator has established information security and/or business continuity plan and/or disaster recovery plan requirements that exceed Freddie Mac’s Minimum Requirements, or if a provision of the Guide or the Seller/Servicer’s other Purchase Documents requires more stringent minimum requirements, then the more rigorous requirements shall apply. A Seller/Servicer’s compliance with the Minimum Requirements will not relieve the Seller/Servicer from any liability arising or accruing under any other provision in the Purchase Documents. A Seller/Servicer’s failure to comply with the Minimum Requirements may result in termination of the Seller/Servicer’s access to any or all Systems. In addition, Freddie Mac may take other actions available under the Guide, the Seller/Servicer’s other Purchase Documents, any user agreement or law. The National Institute of Standards and Technology and International Organization for Standardization/International Electrotechnical Commission provide detailed guidance on the components of a successful information security program, business continuity plan and related activities. Seller/Servicers are strongly encouraged to review these standards and guidance to ensure their practices align with industry best practices.

Source: Freddie Mac Single-Family Seller/Servicer Guide 1302.1 — Overview of information security and business continuity planning requirements · source URL · snapshot 4c94f67729042dd6