Fannie Mae and Freddie Mac are Serious about Cybersecurity Regs

One of the reasons I am passionate about working for The Commonwealth Group is because CWG is passionate about providing quality services to the mortgage industry.  One of these new services is Cybersecurity Consulting. 

As a security professional, the mortgage industry has been “swept under the rug” in outreach about security; CWG wants to change that. The security of information and protection of data has increasingly become a key issue and concern for regulators and businesses.  That concern has now spread into the mortgage industry. As of August 2025, for Fannie Mae seller/servicers and January 2026, for Freddie Mac seller/servicers, lenders who provide their products must comply with the respective information security requirements.  Fannie Mae issued this requirement in the “Information Security and Business Resiliency Supplement.”  Freddie Mac amended the information security rule in Section 1302.2 of the Single-Family Seller/Servicer Guide.

Sadly, how these rules update coupled with distractions in the finance space the last few years, these notices were buried in the noise of legal cases to scare private companies into compliance.  Regardless Fannie Mae and Freddie Mac are serious---information security has entered the mortgage market.  No one is now out of reach lending under these programs.

This is where The Commonwealth Group can help.  We have the experience and the expertise to help companies be prepared.  Right now I am spreading the news that cybersecurity is serious.  Fannie Mae and Freddie Mac are serious about it.  Be serious to and get prepared.

Kevin Robinson, CISSP, DDN.QTE, Associate C|CISO, is Head of Cybersecurity Services for The Commonwealth Group.  He has a 20 year career in cybersecurity, risk assessment, intelligence and counterintelligence.  His previous employers include Thornburg Investment Management, Los Alamos National Laboratory, L3Harris, and the Central Intelligence Agency.