Fannie Mae 2004 Annual Report Download - page 174

Our security infrastructure is designed for the protection of sensitive information assets, and includes
sophisticated network defenses and software designed to prevent hackers, spam, virus, phishing and other
types of cyber attack, while our information security practices are intended to minimize risks due to process
failure or misuse. We employ several firms specializing in information security assessment to uncover control
gaps and risks to our information assets. We acknowledge the constant need to update and improve our
defenses in response to changes in the threat environment.
We continue to work to improve our information security program, with the implementation of additional
controls to protect our confidential data. These have included increased information security and privacy
assessment and monitoring within our business units, a multi-year effort to improve access management,
encryption of data on our employees’ computers, as well as improved tools to monitor and block information
loss from within our network, email and other communication systems.
Business Continuity and Crisis Management
Our Operational Risk Oversight function has established business continuity and crisis management policies
and programs, with execution of these programs implemented by our technology, operations, human resources
and facilities functions in concert with the business units that are responsible for the affected processes and
business applications. These policies and programs are designed to ensure that our critical business functions
continue to operate under emergency conditions.
We have installed redundant systems within each business critical system, as well as redundant systems in two
geographically separate data centers. These redundant systems are designed to provide continuity of operations
for up to one week without significant loss of service to constituents or significant loss of revenue. We also
have developed longer-term recovery plans. In addition, we have implemented strategies for access to critical
business systems by employees and staff, such as alternate work facilities in geographically diverse locations
for our back office and wire transfer functions. We have also established redundant communications systems
for external partners and customers. For staff functions that are considered most critical, such as cash wire
operations and securities settlements, we have instituted multi-site, simultaneous operations from three separate
locations. Dual-site market room activities are conducted on a quarterly basis for front office functions. We
recently successfully completed a disaster recovery test of critical operations using a recently constructed
alternate data center.
To enable recovery from large-scale, catastrophic events, we copy all production data to backup media on a
real-time or nightly basis. The data is transported and stored in multiple locations, including an offsite storage
facility located out of the region. In addition, a limited tertiary operating site is available out of the region.
The tertiary site complies with the sound practices established by the Federal Reserve Board, Office of the
Comptroller of the Currency, and the SEC for resiliency of key U.S. financial institutions, and is designed to
enable us to fulfill our critical obligations until automated processing is able to resume.
Our business continuity program is subject to regulatory review by OFHEO.
LIQUIDITY AND CAPITAL MANAGEMENT
Liquidity is essential to our business. We actively manage our liquidity and capital position with the objective
of preserving stable, reliable and cost-effective sources of cash to meet all of our current and future operating
financial commitments and regulatory capital requirements. We obtain the funds we need to operate our
business primarily from the proceeds we receive from the issuance of debt. We seek to maintain sufficient
excess liquidity in the event that factors, whether internal or external to our business, temporarily prevent us
from issuing debt in the capital markets.
Liquidity
Liquidity Risk Management
Liquidity risk is the risk to our earnings and capital that would arise from an inability to meet our cash
obligations in a timely manner. Because liquidity is essential to our business, we have adopted a comprehen-
sive liquidity risk policy that is designed to provide us with sufficient flexibility to address both liquidity
169