About Us: Counterparty Operational Risk Evaluation

Freddie Mac's Counterparty Operational Risk Evaluation (CORE) team conducts reviews of Seller/Servicers, Document Custodians, Mortgage Insurers and Freddie Mac Exclusionary List vendors (each a “Counterparty,” collectively referred to as “Counterparties”) to assess the effectiveness of their internal controls and processes in managing risk. These reviews are part of Freddie Mac’s broader risk framework, which aligns with our Freddie Mac Single-Family Seller/Servicer Guide (Guide).

The insights gained from CORE reviews help identify areas where Freddie Mac can better support our business stakeholders and strengthen their mortgage operations. Unlike a traditional audit, the CORE review is a collaborative assessment focused on risk management, compliance with Freddie Mac and regulatory guidelines and adherence to industry best practices.

Seller/Servicer Review Scope

For a comprehensive overview of each CORE area of focus, including review of written policies and procedures, management reporting and detailed control testing, please refer to this document.

CORE Review Process Overview

For a comprehensive guide to the review process, including review confirmation, information requests, follow-up steps and issue management, please refer to this document.

Freddie Mac Cybersecurity and Information Security Requirements 

Freddie Mac is committed to working closely with our Seller/Servicers to reduce third-party cybersecurity risks and protect the integrity of the housing finance system. Cyber threats targeting the real estate industry have increased significantly in recent years, and the use of artificial intelligence is adding to these risks. As a result, Seller/Servicers are responsible for maintaining an information security program. Use the below resources to understand cybersecurity review expectations, prepare for a cybersecurity risk assessment and help report cybersecurity incidents. 

How Should I Prepare for a Freddie Mac Cybersecurity Review? 

Guide Chapter 1302 requires Seller/Servicers to establish and maintain an information security program aligned with their institution's risk tolerance and review its effectiveness annually. 

A Freddie Mac cybersecurity risk assessment evaluates information security and cybersecurity risk as part of a CORE review or as a standalone assessment. Assessments may be conducted on-site or virtually, depending on applicable threat and risk considerations.

Readiness Checklist
InfoSec Questionnaire

Reporting a Cybersecurity Incident

When should a cybersecurity incident be reported?

  • Immediate: Report immediately if an actual or suspended incident causes the organization to shut down, disable or stop using any system or technology used for Freddie Mac mortgage origination or servicing.
  • Within 36 hours: All other incidents must be reported as soon as possible, but no later than 36 hours.
  • Quarterly: Certain incidents may be reported quarterly only if they affect, or may affect, fewer than 10 Freddie Mac borrowers and meet the other criteria specified in the Guide.

Report Incident

Please refer to Guide Section 1302.5 for additional information.