What happened
Fannie Mae issued a bulletin on 30 October announcing an updated Information Security and Business Resiliency Supplement, effective 18 January 2027. The supplement is the contract level rulebook that counterparties accept when they do business with the enterprise, so a revision is a revision to a large number of agreements at once.
The headline change is a new section on governance of "Super Intelligence", which replaces the term "Artificial Intelligence" in the document. Fannie Mae says the new wording aligns with evolving industry terminology and is not intended to alter the scope, meaning or applicability of the requirements. Companies that use SI in activities performed under, or relating to, their agreements must meet governance requirements that also cover supply chain management and disclosures to Fannie Mae.
Incident reporting gets tighter. Companies must give Fannie Mae initial notice of a cybersecurity incident within 36 hours, followed by prompt notice of additional details. Reporting now covers all data attributes of affected individuals, and a notification letter must be sent to those individuals with a copy to Fannie Mae.
Several other terms move. The supplement adds an insurance policy requirement, updates implementation requirements for multifactor authentication, and aligns encryption with industry standards. Independent security assessments must now be performed by an "independent third-party security professional" rather than a "qualified independent auditor". Business continuity plans must show the ability to recover from disruption of a relationship with a third party that is material to business conducted with Fannie Mae, and must include a communication strategy for incident response. The prior threat assessment and continuity plan requirement is replaced by a business impact analysis. The update also removes some prior requirements, including the annual threat risk assessment and contingencies for fourth-party vendors.
Why this is a GRC story
The clock is the story. Thirty-six hours is short enough that the first notice will usually go out before an organisation knows scope, cause or data volumes. That changes what incident response has to look like: a notification decision made by a named person, against a prepared template, using the facts available at hour twelve, with a documented route for correcting the record later.
Fourth-party contingencies came out while third-party accountability stayed in. Dropping named contingencies does not remove the obligation, because the supplement still assigns responsibility for third parties' compliance. The practical effect is that assurance has to come from your own vendor oversight rather than a checklist item the contract handed you.
An insurance requirement is an underwriting conversation. Adding a policy condition makes the risk register, the cyber limits and the renewal date into audit evidence, and a gap there is visible to the counterparty.
What to watch
Watch the January effective date. Agreements signed before it may not carry the new terms until renewal, so the work splits into two tracks: mapping which contracts incorporate the supplement by reference, and closing the 36-hour notification gap in the incident response plan.
Attribution: Analysis based on JD Supra (Orrick client alert) and related public reporting. This article is original commentary, not a repost of the source material.