Freddie Mac Single-Family Seller/Servicer Guide 1302.4 — Disaster recovery plan

Freddie Mac Single-Family Seller/Servicer Guide 1302.4 — Disaster recovery plan

Effective 2026-01-01 · Freddie Mac's stamp for this section

This section contains requirements related to: ■ Disaster recovery plans (DRPs) ■ Disaster and event response ■ Additional policies and procedures to support the DRP ■ DRP education and training (a) DRPs A Seller/Servicer must have a written DRP needed to support its business operations following: ■ A natural climate or ■ Manmade disaster or other event which may cause or causes interruption to Seller/Servicer’s business operation, processes or access to systems The DRP should include plans to maintain or restore access to Freddie Mac confidential information, Protected Information and Systems (as defined in Section 2401.1(b)), including without limitation to Mortgage files, data and records, operation at an alternate location, if applicable, and back up communication and contact systems. Seller/Servicers must maintain a documented process to ensure out of band or immutable backups for all critical Freddie Mac data required for processing. A Seller/Servicer must be able to maintain and restore any such information it is required to retain in accordance with its Purchase Documents, including without limitation, any information that it is required to retain pursuant to Chapter 1302, following Freddie Mac’s termination of Seller/Servicer’s right to sell and/or service Mortgages. If Seller/Servicer’s BCP is inclusive of provisions that would otherwise be included in a DRP, no separate DRP is required. (b) Disaster and event response Within the DRP or separately, the Seller/Servicer must establish and develop a plan for disaster and event response and recovery. The response plan must: ■ Identify a formal disaster and event management team which is responsible for, among other things: ❑ Implementing a documented disaster and event management plan ❑ Determining whether a disaster or event warrants activating the DRP ❑ Providing guidance and oversight with respect to the DRP and related policies and procedures ■ Be reviewed and updated by Seller/Servicer at least annually but more frequent assessments may be warranted by material changes to: ❑ The environment, including without limitation, the critical personnel responsible for DRP processes and functions, facilities, Related Third Parties and technical infrastructure ❑ The volume of Mortgages originated and sold to Freddie Mac or Serviced on behalf of Freddie Mac ❑ Business operations or systems occur Upon request by Freddie Mac, including in the event of material changes to the conditions described above, Seller/Servicer shall promptly conduct additional assessments and share the results with Freddie Mac. (c) Additional policies and procedures to support the DRP With respect to the DRP requirements set forth in Section 1302.4(a) and (b) above, the Seller/Servicer must: ■ Establish, maintain and implement policies and procedures which support the DRP. The DRP and related policies and procedures must: ❑ Be approved by the Chief Information Officer, Chief Technology Officer, Chief Information Security Office or Chief Risk Officer (or the equivalents thereof) and in accordance with Seller/Servicer’s corporate governance ❑ Address response, restoration and repair of actual, known disruptions, as well as prevention of potential disruptions ❑ Be reviewed and updated not less than annually ■ Not less than annually, conduct: ❑ A formal risk and threat assessment of the organization ❑ More frequent assessments may be warranted by material changes to: ■ The environment, including without limitation, the critical personnel responsible for DRP processes and functions, facilities, Related Third Parties and technical infrastructure ■ The volume of Mortgages originated and sold to Freddie Mac or serviced on behalf of Freddie Mac ■ Business operations or systems ❑ Upon request by Freddie Mac, including in the event of material changes to the conditions described above, Seller/Servicer shall promptly conduct additional assessments and share the results with Freddie Mac ❑ Testing of the DRP, including recovery of predefined critical business functions ❑ A business disruption impact analysis of the organization. (d) DRP education and training DRP education and training must include the following requirements: ■ Seller/Servicer must provide DRP training to all employees, contractors and third parties who have responsibility or oversight of DRP functions ■ The training must be current in substance and reflect up-to-date continuity threats and restoration strategies which are consistent with industry best practices ■ At a minimum, the training must provide details on roles and responsibilities for all users in executing the DRP, and in protecting Freddie Mac confidential information, Protected Information and Systems (as defined in Section 2401.1(b)) Any documents, plans or policies, including without limitation the DRP, referenced in this section shall be provided by Seller/Servicer to Freddie Mac upon request.

Source: Freddie Mac Single-Family Seller/Servicer Guide 1302.4 — Disaster recovery plan · source URL · snapshot 4c94f67729042dd6