On October 21, Fannie Mae published a new edition of its Information Security and Business Resiliency Supplement. It must be fully implemented by January 18, 2027, and it replaces Lender Letter LL-2026-04, Fannie Mae’s April guidance on artificial intelligence (AI).
The headline is a new section on “Super Intelligence” (SI), Fannie Mae’s term for AI. But three obligations could catch companies off guard: a 36-hour clock that starts at suspicion, vendors’ failures that become your own, and governance for every SI use case.
At a Glance
| Category | Requirement |
|---|---|
| Deadline | January 18, 2027 |
| Incident notice | 36 hours from suspicion, including misdirected email and lost paper files |
| Vendors | Their failures count as yours (Section 3.14) |
| AI / SI | Documented governance program, use-case inventory and named owner |
| Every year | Officer attestation, independent assessment and penetration test |
Who It Binds
Single-Family sellers and servicers, Multifamily lenders, technology service providers and document custodians must each comply directly. Through Section 3.14, the Supplement also reaches the vendors that store, process, access or transmit Fannie Mae Confidential Information on their behalf.
1. The 36-Hour Clock Starts Earlier Than You Think
A Company must report a Cybersecurity Incident “no later than 36 hours after identification of the Cybersecurity Incident, or the reasonable conclusion a Cybersecurity Incident may have occurred.” The clock starts at suspicion, not confirmation. Bank regulators have used a 36-hour window since 2022, but their clock starts once an incident is determined.
The definition is broad: ransomware and business email compromise regardless of impact, denial-of-service attacks, compromised credentials, insider threat, and an email sent to the wrong outside recipient with Fannie Mae Confidential Information in it. Lost or misrouted paper files run on the same clock. Fannie Mae may also act first, “without prior notice,” by blocking email, disabling access and suspending integrations until an independent firm or two Company officers attest to recovery.
DECISION: Name who decides “may have occurred,” who notifies Fannie Mae, and which two officers would sign a restoration statement. Test the plan against a misdirected email, not only ransomware.
2. Your Vendors’ Failures Are Now Yours
Section 3.14 says a Company “shall cause its third parties” to meet the Supplement’s controls and “is responsible for all failures by such a third party ... to the same extent as if such failure were committed by the Company.” That covers your loan origination system, document vendor, cloud host and AI tools. Your continuity plan must also show recovery if a material vendor relationship ends.
DECISION: List every third party that touches Fannie Mae Confidential Information or systems. Confirm each contract flows the Supplement down, and plan for the day each relationship stops.
3. The SI Section Is a Governance Program
If a Company uses SI in its Fannie Mae work, it needs a documented governance program, a use-case inventory, risk assessment, controls from model design through retirement, change management and segregation of duties. It must assess for “adversarial manipulation, model inversion, data leakage, prompt injection, and training data integrity issues,” and a designated owner reviews the program yearly. SI output derived from Confidential Information is itself Confidential Information. These additions close the gap with Freddie Mac’s Guide Section 1302.8, so one program built to the stricter standard can satisfy both government-sponsored enterprises (GSEs).
DECISION: Build the use-case inventory first, including AI inside your vendors’ products. Every other SI requirement depends on it.
The Rest Is Familiar
A program aligned with the National Institute of Standards and Technology (NIST) or International Organization for Standardization (ISO) 27001 standards should already cover multi-factor authentication (MFA), unique user IDs, annual access reviews, an annual independent penetration test, software bills of materials, and encryption at rest and in transit. Two items stand out: a corporate officer must attest every year that the program meets the Supplement, and the independent assessment repeats after any Cybersecurity Incident. Watch Fannie Mae’s bulletins, too. A Company that rejects one has 15 calendar days to say so.
How RM Cyber Supports Fannie Mae Alignment
The Supplement asks for evidence, not intentions. As your virtual Chief Information Security Officer (vCISO), RM Cyber builds the program that produces that evidence, so the officer who signs the attestation signs on facts.
| Focus Area | How RM Cyber Supports Alignment |
|---|---|
| Program baseline | A gap assessment against the Supplement, mapped to your existing NIST or ISO controls, with a remediation roadmap to January 18 |
| 36-hour notification | An incident response plan built around a suspicion-based clock, with named decision-makers, a ready-to-send notice and the restoration process, tested in a tabletop exercise |
| Vendors & resiliency | Vendor inventory and risk assessments, contract flow-down review, and continuity plans tested for the loss of a material vendor |
| Super Intelligence | SI policy, use-case inventory, named owner and AI risk assessments, built to meet Freddie Mac 1302.8 as well |
| Annual attestation | An evidence package for the signing officer, coordination of the independent assessment and penetration test, board reporting and bulletin tracking |
What’s Next?
With about eleven weeks to the deadline, the controls are rarely the hard part. The work is in the decisions behind them: who starts the clock, which vendors are in scope, where the models are, and who signs. Companies that settle those now will meet January 18 with evidence on file.
Fannie Mae alignment is a program, not a checklist. Contact us — we'll bring advice and action.