Fannie Mae Information Security and Business Resiliency Supplement Bulletin 26-01

Fannie Mae Information Security and Business Resiliency Supplement Bulletin 26-01 — Supplement Bulletin 26-01

Information Security and Business Resiliency Supplement Bulletin 26-01 Effective Date: January 18, 2027 (90 Days from publication) BULLETIN INFORMATION SECURITY AND BUSINESS RESILIENCY SUPPLEMENT This Bulletin is issued in accordance with the section of the Fannie Mae Information Security and Business Resiliency Supplement (the “Supplement”) entitled General Requirements, Issued Bulletins; Amendments. The purpose of this Bulletin is to notify Companies subject to the Supplement that a new version of the Supplement has been published. In addition to minor clerical and clean-up edits, including typo corrections, renumbering of sections, reformatting and other similar modifications, the updated Supplement includes the following substantive changes: SECTION/ TITLE DESCRIPTION OF CHANGE 1 - Introduction New component of Super Intelligence1 governance added to the Supplement 2 – Relevant Terms Added the term and corresponding definition of: Super Intelligence and Losses Updated the definitions for the following terms: Data Back-up (formerly Back-up), Company, Confidential Information, Cybersecurity Incident, Fannie Mae Confidential Information, and Underlying Agreements 3 – Information Security Program Added NIST Framework 800-53 as an example industry standard for Company program alignment Added an insurance policy requirement Removed reference to SF Lender providing attestation through annual Form 582 3.1 – Access Management Updated implementation requirements for MFA 3.2 – Human Resources Security Updated code of conduct requirements to reference protection of Confidential Information, generally 3.3 – Audit and Accountability Changed independent security assessment requirement from a “qualified independent auditor” to an “independent third- party security professional” Clarified Company requirement to commission an independent security assessment 1 The term “Super Intelligence” is used in place of “Artificial Intelligence” to align with evolving industry terminology. This terminology update is not intended to alter the scope, meaning, or applicability of the requirements. 2 SECTION/ TITLE DESCRIPTION OF CHANGE 3.5 – Physical and Environmental Controls Removed requirement that Company maintain environmental controls in favor of similar requirements in the Supplement 3.6 – Cybersecurity Incident Management and Response Clarified that notice to Fannie Mae of any disruptions, including those related to technology, must be “prompt” 3.10 – Data Protection and System Security Updated encryption requirements with industry standards alignment Revised to clarify limitations on access to Confidential Information 3.14 – Supply Chain Risk Management Replaced the term “vendor” with the term “third party” (throughout Supplement) Updated Company requirements for responsibility of third party compliance with Supplement 4 – Super Intelligence (SI) (NEW) Added new section on SI governance requirements for Companies that use SI in connection with the activities performed under, or relating, to its Underlying Agreements, to include: an SI Governance Program, supply chain management, disclosure requirements to Fannie Mae 5 – Cybersecurity Incident Management (formerly Section 4) Revised requirements for initial notification to Fannie Mae within 36-hour period followed by “prompt” notification of supplemental details 5.1 – Actions by Fannie Mae (formerly Section 4.1) Clarified that access may be restored at Fannie Mae’s sole discretion 5.3 – Additional Company Requirements (formerly Section 4.3) Expanded Cybersecurity Incident reporting to include all data attributes of impacted individuals and the provision of the notification letter sent by Company to impacted individuals with a copy to Fannie Mae 6.1 – Business Continuity Plan (formerly Section 5.1) Updated requirement that Company’s Business Continuity Plan ensure the ability to recover from disruption of Company relationship with a third party that is material to business conducted with Fannie Mae per the Underlying Agreement Replaced threat assessment and continuity plan requirement with business impact analysis Added requirement Company’s Business Continuity Plan include communication strategy around incident response (removing previous requirement specific to crisis management plan) 6.2 – Additional Requirements Removed requirement for Company to conduct an annual threat risk assessment Removed requirement the Business Continuity Plan is formally 3 SECTION/ TITLE DESCRIPTION OF CHANGE socialized with Company leadership Removed requirement for Company to establish contingencies for fourth party vendors Removed requirement for Company to recover business operations for issues with third party vendors in favor of similar requirements in the Supplement Replaced technology continuity planning with disaster recovery planning and clarified annual testing requirements Removed requirements to share with management and track to resolution lessons learned and after actions 7 – General Requirements; Issued Bulletins; Amendments Updated to clarify that Company is deemed to accept amendments if no rejection within applicable period All changes described above are effective as of the Effective Date indicated in this Bulletin, in accordance with the Section of the Supplement entitled General Requirements, Issued Bulletins; Amendments. All other terms and conditions of the Supplement shall continue in full force and effect. If there is any inconsistency between or among the provisions contained in the Supplement and this Bulletin, the Supplement will govern.

Source: Fannie Mae Information Security and Business Resiliency Supplement Bulletin 26-01 — Supplement Bulletin 26-01 · source URL · snapshot 6ceb5335d5774264