Fannie Mae recently issued a bulletin announcing an updated version of its Information Security and Business Resiliency Supplement, effective January 18, 2027. The update adds a new section on governance of “Super Intelligence” (SI), which replaces the term “Artificial Intelligence” to “align with evolving industry terminology,” but “is not intended to alter the scope, meaning, or applicability of the requirements.” Companies that use SI in activities performed under, or relating to, their agreements with Fannie Mae are subject to SI governance requirements that also address supply chain management and disclosures to Fannie Mae. Companies must also give Fannie Mae initial notice of a cybersecurity incident within 36 hours, followed by “prompt” notice of additional details. Incident reporting is expanded to include all data attributes of affected individuals and requires a notification letter to be sent to impacted individuals, with a copy to Fannie Mae.

Among other changes, the supplement: (i) adds an insurance policy requirement; (ii) updates implementation requirements for multifactor authentication; (iii) aligns encryption requirements with industry standards; (iv) requires independent security assessments to be performed by an “independent third-party security professional” rather than a “qualified independent auditor”; and (v) updates companies’ responsibility for third parties’ compliance with the supplement. In addition, business continuity plans must now ensure the ability to recover from disruption of a relationship with a third party that is material to business conducted with Fannie Mae, and include a communication strategy for incident response. The supplement also replaces the prior threat assessment and continuity plan requirement with a business impact analysis. Finally, the update removes several prior requirements, including an annual threat risk assessment and contingencies for fourth-party vendors.