AWACSMortgage compliance intelligence from Flightline

Fannie Mae · Servicing Guide Announcement SVC-2025-01 · Published

Servicing Guide update: cybersecurity requirements and shared equity clarifications for community land trusts

Servicers and seller/servicers must fully implement new cybersecurity requirements (Information Security and Business Resiliency Supplement) by Aug. 12, 2025, including reporting Cybersecurity Incidents no later than 36 hours after discovery. Fannie Mae will also accept Freddie Mac's equivalent of the Community Land Trust Ground Lease Rider, effective immediately.

Action requiredEffective Aug 12, 2025 · may adopt nowAll checks passedRead the announcement ↗ (opens in a new tab)

Loan impact

From the announcement text · verified

Applies to: All Fannie Mae servicers and seller/servicers must implement the cybersecurity requirements; the shared equity clarification affects community land trust ground lease loans.

Investor
Fannie Mae
Programs
Conventional
Affected documents
Information Security and Business Resiliency Supplement; Community Land Trust Ground Lease Rider
Effective
Aug 12, 2025Sellers may implement immediately
Applicability confidence
Verified: every row above is supported by the source text
Supporting quotes from the announcement
  • guide sections“A2-1-01 Overview of General Servicer Duties and Responsibilities”
  • guide sections“A2-1-09 Compliance with Requirements and Laws”
  • guide sections“A3-1-01, Maintaining Fannie Mae Seller/Servicer Status”
  • guide sections“A-4-1-01, Staffing, Training, Procedures, and Quality Control”
  • guide sections“F-4-01, References to Fannie Mae’s Website”
  • guide sections“A2-1-03, Servicer’s Duties and Responsibilities Related to Mortgage Loans and”
  • guide sections“F-3-03, Acronyms and Glossary of Defined Terms: C”
  • affected documents“These requirements will be part of the new Fannie Mae Information Security and Business Resiliency Supplement (the “Supplement”), which is incorporated by reference as part of the Selling Guide, Servicing Guide and Consolidated Technology Guide.”
  • affected documents“In accordance with Selling Guide Announcement, SEL-2025-01, servicers and seller/servicers are advised in addition to our Community Land Trust Ground Lease Rider (Form 2100), we will now accept use of Freddie Mac’s equivalent form as an alternative.”

What changed

From the announcement text · Sections A2-1-01, A2-1-09, A3-1-01, A-4-1-01, F-4-01, A2-1-03, F-3-03
RequirementPreviouslyNow
New cybersecurity requirements (Information Security and Business Resiliency Supplement)NewRequiredSection A2-1-01, A2-1-09, A3-1-01, A-4-1-01, F-4-01New requirementServicers and seller/servicers must implement new information security, incident management and business resiliency requirements, including reporting Cybersecurity Incidents within 36 hours of discovery
Community Land Trust Ground Lease Rider alternative formRelaxedSection A2-1-03, F-3-03Previously: Community Land Trust Ground Lease Rider (Form 2100)Freddie Mac's equivalent form accepted as an alternative; guide refers to the rider by name rather than form number

Also affected: Sections A2-1-01, A2-1-09, A3-1-01, A-4-1-01, F-4-01, A2-1-03, F-3-03.

What to do

AWACS interpretation · not source language

What to review: "Review the mandatory cybersecurity requirements first, including the 36-hour Cybersecurity Incident reporting and the Aug. 12, 2025 full implementation date, then note that servicers may use the shared equity clarification immediately, which allows Freddie Mac's equivalent of the Community Land Trust Ground Lease Rider as an alternative."

Servicing

Fully implement the new cybersecurity requirements from the Information Security and Business Resiliency Supplement, including reporting Cybersecurity Incidents no later than 36 hours after discovery, by Aug. 12, 2025.

Compliance

Confirm that servicer and seller/servicer practices meet the new cybersecurity requirements, including the 36-hour Cybersecurity Incident reporting obligation, by Aug. 12, 2025.

IT

Implement the information security, incident management and business resiliency requirements of the Supplement by Aug. 12, 2025.

QC implications

  • Test whether Cybersecurity Incidents, including those affecting third parties, are reported as soon as possible and no later than 36 hours after discovery.
  • Check that full implementation of the cybersecurity requirements is in place by Aug. 12, 2025, noting that earlier adoption is encouraged.
  • Where a community land trust ground lease loan uses Freddie Mac's equivalent of the rider, note that this is now an accepted optional alternative and not a defect.

Source and record

Version 1 · archived

Checks passed

  • Schema valid
  • Effective quotes verbatim
  • Document ID appears in the source
  • Doc id matches catalog
  • Mandatory status is backed by requirement language
  • Mandatory entries have requirement language
  • Published on present
  • Title summary length
  • Controlled vocabulary
  • No placeholder tokens
  • Source link resolves
  • Loan impact quotes verbatim
  • Loan impact vocabulary
  • Changes quoted
  • Impact type consistent
  • Every required change is backed by obligation language
  • Only new or tightened changes are marked required
  • Loan impact covers every required change
  • Quotes are complete sentences
  • Unflagged must
  • Diff complete
  • Mandatory date resolved
  • Audience verbatim
  • Scope residential
  • Out of scope
  • Published in window
  • Interpretation schema valid
  • Interpretation separate