source:
  type: guide
  id: fhlmc-1302.4
  authority: Freddie Mac Single-Family Seller/Servicer Guide Section 1302.4 — Disaster
    recovery plan
  description: Freddie Mac Single-Family Seller/Servicer Guide Section 1302.4 — Disaster
    recovery plan.
  coverage_tier: operative
obligations:
- id: fhlmc-1302.4-full
  canonical_id: fhlmc-1302.4-full
  section: Freddie Mac Single-Family Seller/Servicer Guide Section 1302.4 — Disaster
    recovery plan
  type: do
  tags:
  - regulator-direct
  - fhlmc
  - freddie-guide
  - corpus-expansion
  - tier-operative
  primary_source:
    tier: 1
    authority: Freddie Mac Single-Family Seller/Servicer Guide Section 1302.4 — Disaster
      recovery plan
    source_class: fhlmc-guide
    source_url: https://guide.freddiemac.com/ci-guide
    snapshot_id: 5869ee9e606cd4ae
    fetched_at: '2026-05-23T00:27:40Z'
    content_hash: sha256:9a1b23e5024bb369e7a59d36b3702383c11ace68b5d209fdef791bc8f955c637
    paragraph_quote: '1302.4: Disaster recovery plan (01/01/26) This section contains
      requirements related to: ■ Disaster recovery plans (DRPs) ■ Disaster and event
      response ■ Additional policies and procedures to support the DRP ■ DRP education
      and training (a) DRPs A Seller/Servicer must have a written DRP needed to support
      its business operations following: ■ A natural climate or Freddie Mac Single-Family
      Seller/Servicer Guide Chapter 1302 As of 04/01/26 Page 1302-64 ■ Manmade disaster
      or other event which may cause or causes interruption to Seller/Servicer’s business
      operation, processes or access to systems The DRP should include plans to maintain
      or restore access to Freddie Mac confidential information, Protected Information
      and Systems (as defined in Section 2401.1(b)), including without limitation
      to Mortgage files, data and records, operation at an alternate location, if
      applicable, and back up communication and contact systems. Seller/Servicers
      must maintain a documented process to ensure out of band or immutable backups
      for all critical Freddie Mac data required for processing. A Seller/Servicer
      must be able to maintain and restore any such information it is required to
      retain in accordance with its Purchase Documents, including without limitation,
      any information that it is required to retain pursuant to Chapter 1302, following
      Freddie Mac’s termination of Seller/Servicer’s right to sell and/or service
      Mortgages. If Seller/Servicer’s BCP is inclusive of provisions that would otherwise
      be included in a DRP, no separate DRP is required. (b) Disaster and event response
      Within the DRP or separately, the Seller/Servicer must establish and develop
      a plan for disaster and event response and recovery. The response plan must:
      ■ Identify a formal disaster and event management team which is responsible
      for, among other things: ❑ Implementing a documented disaster and event management
      plan ❑ Determining whether a disaster or event warrants activating the DRP ❑
      Providing guidance and oversight with respect to the DRP and related policies
      and procedures ■ Be reviewed and updated by Seller/Servicer at least annually
      but more frequent assessments may be warranted by material changes to: ❑ The
      environment, including without limitation, the critical personnel responsible
      for DRP processes and functions, facilities, Related Third Parties and technical
      infrastructure ❑ The volume of Mortgages originated and sold to Freddie Mac
      or Serviced on behalf of Freddie Mac ❑ Business operations or systems occur
      Freddie Mac Single-Family Seller/Servicer Guide Chapter 1302 As of 04/01/26
      Page 1302-65 Upon request by Freddie Mac, including in the event of material
      changes to the conditions described above, Seller/Servicer shall promptly conduct
      additional assessments and share the results with Freddie Mac. (c) Additional
      policies and procedures to support the DRP With respect to the DRP requirements
      set forth in Section 1302.4(a) and (b) above, the Seller/Servicer must: ■ Establish,
      maintain and implement policies and procedures which support the DRP. The DRP
      and related policies and procedures must: ❑ Be approved by the Chief Information
      Officer, Chief Technology Officer, Chief Information Security Office or Chief
      Risk Officer (or the equivalents thereof) and in accordance with Seller/Servicer’s
      corporate governance ❑ Address response, restoration and repair of actual, known
      disruptions, as well as prevention of potential disruptions ❑ Be reviewed and
      updated not less than annually ■ Not less than annually, conduct: ❑ A formal
      risk and threat assessment of the organization ❑ More frequent assessments may
      be warranted by material changes to: ■ The environment, including without limitation,
      the critical personnel responsible for DRP processes and functions, facilities,
      Related Third Parties and technical infrastructure ■ The volume of Mortgages
      originated and sold to Freddie Mac or serviced on behalf of Freddie Mac ■ Business
      operations or systems ❑ Upon request by Freddie Mac, including in the event
      of material changes to the conditions described above, Seller/Servicer shall
      promptly conduct additional assessments and share the results with Freddie Mac
      ❑ Testing of the DRP, including recovery of predefined critical business functions
      ❑ A business disruption impact analysis of the organization. Freddie Mac Single-Family
      Seller/Servicer Guide Chapter 1302 As of 04/01/26 Page 1302-66 (d) DRP education
      and training DRP education and training must include the following requirements:
      ■ Seller/Servicer must provide DRP training to all employees, contractors and
      third parties who have responsibility or oversight of DRP functions ■ The training
      must be current in substance and reflect up-to-date continuity threats and restoration
      strategies which are consistent with industry best practices ■ At a minimum,
      the training must provide details on roles and responsibilities for all users
      in executing the DRP, and in protecting Freddie Mac confidential information,
      Protected Information and Systems (as defined in Section 2401.1(b)) Any documents,
      plans or policies, including without limitation the DRP, referenced in this
      section shall be provided by Seller/Servicer to Freddie Mac upon request. 1302.5:
      Incident notification and related obligations (01/01/25) This section contains:
      ■ Security-related requirements ■ Non-critical Privacy Incident requirements
      ■ Requirements related to limitation, restriction or termination of System access
      (a) Security-related requirements If a Seller/Servicer knows or believes, or
      has reasonable information from which to know or believe, or a cybersecurity
      professional could reasonably conclude from the circumstances and available
      information, that there may have been any unauthorized access to or use or acquisition
      of data or computing resources, or any other security related issue that may
      compromise the security, confidentiality, availability, integrity or privacy
      of Freddie Mac confidential information or Protected Information (“Incident”);
      the Seller/Servicer must comply with the requirements below: 1. Notification
      to Freddie Mac Immediately notify Freddie Mac of an Incident via https://privacyportal.onetrust.com/incident-portal/webforms/94b5e41a-aba0-4e51-
      ba48-efa19ce560a1/1b25c37a-a280-44f2-b61e-a693a33c7267 (or by such other means
      as specified by Freddie Mac) in the event that such Incident causes the Seller/Servicer
      to Freddie Mac Single-Family Seller/Servicer Guide Chapter 1302 As of 04/01/26
      Page 1302-67 shut down, disable, or otherwise stop using any or part of any
      system or other technology (whether or not such system or technology is developed
      by the Seller/Servicer or by a third-party and used by the Seller/Servicer)
      that the Seller/Servicer ordinarily uses in connection with its mortgage origination
      processes or Servicing Mortgages on behalf of Freddie Mac. In all other instances,
      as soon as possible, but no later than 36 hours after discovering the Incident,
      notify Freddie Mac of the Incident via https://privacyportal.onetrust.com/incident-portal/webforms/94b5e41a-aba0-4e51-
      ba48-efa19ce560a1/1b25c37a-a280-44f2-b61e-a693a33c7267 (or by such other means
      as specified by Freddie Mac) or by such other means as Freddie Mac may request.
      The notification must include the name, phone number and e-mail address of the
      contact leading the Incident investigation, any law enforcement agencies involved
      and all facts known about the Incident at the time of notification. 2. Obligation
      to investigate and remediate The Seller/Servicer must promptly investigate,
      mitigate and remediate the Incident at the Seller/Servicer’s expense, including
      identifying all Freddie Mac confidential information or Protected Information
      affected by the Incident and preventing the continuation and recurrence of the
      Incident. 3. Information to be provided to Freddie Mac After notifying Freddie
      Mac and providing initial information about the Incident, the Seller/Servicer
      must continue to update Freddie Mac as the investigation progresses, and as
      Freddie Mac may reasonably request, with interim status updates, including new
      details learned and progress made since the last update, until Freddie Mac is
      satisfied that there has been compliance with Applicable Laws and the event
      giving rise to the Incident is fully resolved. remediated and closed. All information
      should be sent to the location designated by Freddie Mac. The information to
      be provided by the Seller/Servicer includes the following: ■ Technical information
      ❑ Related internal and external investigations ❑ Risk factors ❑ Causation factors
      ❑ Technical indicators of compromise (e-mail addresses, hash values, IP addresses,
      malware code, vector of compromise, etc.) Freddie Mac Single-Family Seller/Servicer
      Guide Chapter 1302 As of 04/01/26 Page 1302-68 ❑ Tactics, techniques, and procedures
      associated with the Incident ❑ Details surrounding the attack methodology ❑
      Timing of the Incident ❑ Technical and forensic reports, if available ❑ Other
      information that Freddie Mac may reasonably request to assist Freddie Mac in
      evaluating the potential or actual effect of the Incident on Freddie Mac’s infrastructure
      and impacted Borrowers or employees ❑ Actions that are being taken to remediate
      the Incident and its cause, and to protect individuals, business assets, and
      Freddie Mac confidential information and Protected Information ❑ Remediation
      actions or workarounds or corrections that resolved the incident and restored
      service to its best quality ❑ Eradication and recovery steps taken ❑ Postmortem
      and similar after-action reports generated ❑ Other details and information concerning
      the Incident ❑ Final incident closure report ■ Freddie Mac and Borrower information
      ❑ Whether, and if so the extent to which, Freddie Mac confidential information
      or Protected Information was accessed, taken, or exposed ❑ The nature and details
      of the information accessed, taken, or exposed ❑ All facts relevant to actual
      or potential misuse of the information, including the likelihood of misuse and,
      if applicable, how the information was misused ❑ Whether there is any cyber
      or other insurance coverage for expenses related to the Incident ❑ Potential
      damage estimates associated with the Incident ■ Compliance information ❑ Actions
      that are being taken to comply with Applicable Laws Freddie Mac Single-Family
      Seller/Servicer Guide Chapter 1302 As of 04/01/26 Page 1302-69 ❑ A Certificate
      of Compliance (in form and substance requested by Freddie Mac evidencing, among
      other things, that the Seller/Servicer has, with respect to the incident, complied
      with applicable Federal, State, and local data breach notification laws and
      regulations and all Purchase Documents, including without limitation, the Guide)
      ❑ Copies of any communications to Borrowers, State and federal agencies and
      offices, regulators, credit reporting agencies or others 4. Compliance with
      law The Seller/Servicer must comply in a timely manner with Applicable Laws
      (as defined in Section 1301.2). Where an Incident creates an obligation to notify
      Borrowers, the Seller/Servicer will first give Freddie Mac the opportunity to
      review and comment on any notification that in any way refers to or identifies
      Freddie Mac directly or indirectly. The Seller/Servicer must comply with Applicable
      Laws that require notification to federal or state authorities. Promptly following
      a request by Freddie Mac, the Seller/Servicer will provide Freddie Mac and its
      designees all information and assistance needed to enable Freddie Mac to evaluate
      the need for, and to timely make, any notification it deems necessary or advisable
      concerning the Incident. (b) Non-Critical Privacy Incident requirements Notwithstanding
      the notification requirement set forth in Section 1302.5(a) above, if a privacy-related
      Incident affects, or has the potential to affect fewer than 10 Freddie Mac Borrowers
      (“Non-critical Privacy Incident”), a Seller/Servicer is required to respond
      to the Incident in accordance with all Applicable Laws, but a Seller/Servicer
      is not required to report such Non-critical Privacy Incident to Freddie Mac
      within the 36-hour reporting window referenced above. Instead, Seller/Servicers
      must report Non-critical Privacy Incidents to Freddie Mac on a quarterly basis
      via https://privacyportal.onetrust.com/incident- portal/webforms/94b5e41a-aba0-4e51-ba48-efa19ce560a1/7aa89b26-8f28-4ed8-ae19-
      944470d088c9. Seller/Servicers must submit such reports to Freddie Mac by the
      5th day of each January, April, July and October, in each case covering Non-critical
      Privacy Incidents in the three immediately preceding calendar months. An Incident
      that involves any of the factors listed below is not a Non-critical Privacy
      Incident, and a Seller/Servicer must handle the Incident in accordance with
      Section 1302.5(a) above: 1. The Incident could lead to the compromise of a user
      account or system providing access to any Freddie Mac System (as defined in
      Section 2401.1(b)) 2. A malicious actor caused the Incident Freddie Mac Single-Family
      Seller/Servicer Guide Chapter 1302 As of 04/01/26 Page 1302-70 3. The impacted
      States/territories or federal statute require the Seller/Servicers to notify
      State or federal regulators or the affected Borrowers 4. There is active or
      anticipated media coverage of the Incident 5. Law enforcement has been or will
      be contacted regarding the Incident 6. The Seller/Servicer receives notice from
      a regulator that it is not or may not be compliant with its breach response
      obligations 7. The Seller/Servicer is aware of or reasonably should anticipate
      material risk to Borrowers, investors, Freddie Mac (including without limitation,
      Freddie Mac’s infrastructure) or others, based on specific facts and circumstances
      (c) Requirements related to limitation, restriction or termination of System
      access Whether in connection with the actual or suspected presence of Malicious
      Code (as defined in Section 1302.2), an Incident, or otherwise, Freddie Mac
      reserves the right, in its sole and absolute discretion, at any time with or
      without notice, to limit, restrict and/or terminate a Seller/Servicer’s access
      to any System or the UCDP®, temporarily or permanently. If, and when, Freddie
      Mac determines that restoring any level of System or the UCDP access to a Seller/Servicer
      is appropriate, as a condition to such access restoration, Seller/Servicer shall
      provide to Freddie Mac upon request (i) such assurances and information as Freddie
      Mac may deem necessary, in its sole and absolute discretion; and (ii) an attestation,
      executed by a duly authorized corporate officer, of the adequacy of any applicable
      containment, eradication or remediation of any vulnerability related to such
      Malicious Code, Incident (as defined above), and the eradication of any threat
      actor from the Seller/Servicer’s environment or any system or technology used
      by the Seller/Servicer (whether or not such system or technology is developed
      by the Seller/Servicer or by a third-party and used by the Seller/Servicer).
      Freddie Mac shall have no liability to any Seller/Servicer or third party arising
      out of, related to, or in connection with Freddie Mac’s limitation, restriction,
      or termination of a Seller/Servicer’s access to any System.'
  judgment: false
