source:
  type: gse_supplement
  id: fnma-infosec-resiliency-supplement
  authority: Fannie Mae Information Security and Business Resiliency Supplement
  source_class: gse_supplement
  source_url: https://www.fanniemae.com/media/document/pdf/information-security-and-business-resiliency-supplement
  snapshot_id: fnma-isbrs-2025-09-02-d538c02def3b
  fetched_at: '2026-06-11'
  content_hash: d538c02def3bf0cc0fbc90b626eb5bc5917edfe30335e87a85a0cda1594cb284
  description: Fannie Mae Information Security and Business Resiliency Supplement
    (published Sept 2, 2025) — the cybersecurity, incident-management, and business-resiliency
    requirements LL-2026-04 requires sellers/servicers to comply with.
obligations:
- id: isbrs-infosec-program
  section: 3. Information Security Program
  description: Maintain a formal, documented information security program aligned
    with (or exceeding) NIST or ISO 27001, under a designated senior executive.
  type: requirement
  tags:
  - information-security
  - business-resiliency
  - fnma-ll-2026-04
  primary_source:
    authority: Fannie Mae Information Security and Business Resiliency Supplement
    source_class: gse_supplement
    source_url: https://www.fanniemae.com/media/document/pdf/information-security-and-business-resiliency-supplement
    snapshot_id: fnma-isbrs-2026-06-16-pdf
    fetched_at: '2026-06-11'
    content_hash: sha256:7dd12d5b7684be0ddbd5df1f42e3c5e36b61848dee28c46a59b2ff0c44f61cee
    paragraph_quote: "align its Information Security Program with, or exceed, a current\
      \ industry standard such as the \nNational Institute of Standards in Technology\
      \ (NIST) Framework or the International \nOrganization for Standardization (ISO)\
      \ 27001 Standard; \n• \ndesignate and keep a senior executive responsible for\
      \ the development, implementation, and \nmaintenance of its Information Security\
      \ Program; \n\n \n© 2025 Fannie Mae         Page 8 of 27"
- id: isbrs-incident-36hr
  section: Incident Management and Reporting
  description: Notify Fannie Mae of a Cybersecurity Incident without undue delay and
    no later than 36 hours after identification.
  type: requirement
  tags:
  - information-security
  - business-resiliency
  - fnma-ll-2026-04
  primary_source:
    authority: Fannie Mae Information Security and Business Resiliency Supplement
    source_class: gse_supplement
    source_url: https://www.fanniemae.com/media/document/pdf/information-security-and-business-resiliency-supplement
    snapshot_id: fnma-isbrs-2026-06-16-pdf
    fetched_at: '2026-06-11'
    content_hash: sha256:7dd12d5b7684be0ddbd5df1f42e3c5e36b61848dee28c46a59b2ff0c44f61cee
    paragraph_quote: "Without undue delay and no later than 36 hours after identification\
      \ of the \nCybersecurity Incident, or the reasonable conclusion a Cybersecurity\
      \ Incident \nmay have occurred, and promptly thereafter as requested, provide\
      \ Fannie Mae \nvia e-mail at privacy_office@fanniemae.com (or by such other\
      \ means as Fannie \nMae may otherwise request) all known details of the Cybersecurity\
      \ Incident, \nincluding:"
- id: isbrs-business-continuity
  section: Business Continuity
  description: Maintain a Business Continuity Plan addressing continuity and disaster-recovery
    procedures, with testing.
  type: requirement
  tags:
  - information-security
  - business-resiliency
  - fnma-ll-2026-04
  primary_source:
    authority: Fannie Mae Information Security and Business Resiliency Supplement
    source_class: gse_supplement
    source_url: https://www.fanniemae.com/media/document/pdf/information-security-and-business-resiliency-supplement
    snapshot_id: fnma-isbrs-2026-06-16-pdf
    fetched_at: '2026-06-11'
    content_hash: sha256:7dd12d5b7684be0ddbd5df1f42e3c5e36b61848dee28c46a59b2ff0c44f61cee
    paragraph_quote: "Business Continuity Plan must: \n• \naddress Business Continuity\
      \ Procedures and Disaster Recovery Procedures and \nprovide a level of preparation,\
      \ coordination, facilitation, resiliency, and testing that \naddresses disruptions\
      \ that could impact normal operations and processing and"
- id: isbrs-vendor-risk-program
  section: Supply Chain Risk Management
  description: Maintain a formal vendor risk management program governing the controls
    of new and existing vendors (the LL vendor-governance bridge).
  type: requirement
  tags:
  - information-security
  - business-resiliency
  - fnma-ll-2026-04
  primary_source:
    authority: Fannie Mae Information Security and Business Resiliency Supplement
    source_class: gse_supplement
    source_url: https://www.fanniemae.com/media/document/pdf/information-security-and-business-resiliency-supplement
    snapshot_id: fnma-isbrs-2026-06-16-pdf
    fetched_at: '2026-06-11'
    content_hash: sha256:7dd12d5b7684be0ddbd5df1f42e3c5e36b61848dee28c46a59b2ff0c44f61cee
    paragraph_quote: The Company must develop, document, and implement a formal vendor
      risk management program to ensure the controls of new and existing vendors
- id: isbrs-thirdparty-bc-diligence
  section: Supply Chain Risk Management
  description: Perform business-continuity due diligence on third parties to ensure
    they meet service requirements and maintain a BC program.
  type: requirement
  tags:
  - information-security
  - business-resiliency
  - fnma-ll-2026-04
  primary_source:
    authority: Fannie Mae Information Security and Business Resiliency Supplement
    source_class: gse_supplement
    source_url: https://www.fanniemae.com/media/document/pdf/information-security-and-business-resiliency-supplement
    snapshot_id: fnma-isbrs-2026-06-16-pdf
    fetched_at: '2026-06-11'
    content_hash: sha256:7dd12d5b7684be0ddbd5df1f42e3c5e36b61848dee28c46a59b2ff0c44f61cee
    paragraph_quote: Perform related business continuity due diligence on its third
      parties to ensure they meet contracted service requirements and maintain a business
      continuity program that aligns with industry best practices
