Fannie Mae 2005 Annual Report Download - page 153

Information Security
Recognizing the importance and sensitivity of our information assets, we have established an information
security program designed to protect the security and privacy of confidential information, including non-public
personal information and sensitive business data. Our current information security program was launched in
late 2003 to address acknowledged industry-wide security concerns in areas such as access management,
change management, secure application development and system monitoring.
Our security infrastructure is designed for the protection of sensitive information assets, and includes
sophisticated network defenses and software designed to prevent hackers, spam, virus, phishing and other
types of cyber attack, while our information security practices are intended to minimize risks due to process
failure or misuse. We employ several firms specializing in information security assessment to uncover control
gaps and risks to our information assets. We acknowledge the constant need to update and improve our
defenses in response to changes in the threat environment.
We continue to work to improve our information security program, with the implementation of additional
controls to protect our confidential data. These have included increased information security and privacy
assessment and monitoring within our business units, a multi-year effort to improve access management,
encryption of data on our employees’ computers, as well as improved tools to monitor and block information
loss from within our network, email and other communication systems.
Business Continuity and Crisis Management
Our ORO function has established business continuity and crisis management policies and programs, with
execution of these programs implemented by our technology, operations, human resources and facilities
functions in concert with the business units that are responsible for the affected processes and business
applications. These policies and programs are designed to ensure that our critical business functions continue
to operate under emergency conditions. Our business continuity program is subject to regulatory review by
OFHEO.
We have installed redundant systems within each business critical system, as well as redundant systems in two
geographically separate data centers. These redundant systems are designed to provide continuity of operations
for up to one week without significant loss of service to constituents or significant loss of revenue. We also
have developed longer-term recovery plans. In addition, we have implemented strategies for access to critical
business systems by employees and staff, such as alternate work facilities in geographically diverse locations
for our back office and wire transfer functions. We have also established redundant communications systems
for external partners and customers. For staff functions that are considered most critical, such as cash wire
operations and securities settlements, we have instituted multi-site, simultaneous operations from three separate
locations. Dual-site market room activities are conducted on a quarterly basis for front office functions. We
recently successfully completed a disaster recovery test of critical operations using a recently constructed
alternate data center.
To enable recovery from large-scale, catastrophic events, we copy all production data to backup media on a
real-time or nightly basis. The data is transported and stored in multiple locations, including an offsite storage
facility located out of the region. In addition, a limited tertiary operating site is available out of the region.
The tertiary site complies with the sound practices established by the Federal Reserve Board, Office of the
Comptroller of the Currency, and the SEC for resiliency of key U.S. financial institutions, and is designed to
enable us to fulfill our critical obligations until automated processing is able to resume.
LIQUIDITY AND CAPITAL MANAGEMENT
Liquidity is essential to our business. We actively manage our liquidity and capital position with the objective
of preserving stable, reliable and cost-effective sources of cash to meet all of our current and future operating
financial commitments and regulatory capital requirements. We obtain the funds we need to operate our
business primarily from the proceeds we receive from the issuance of debt. We seek to maintain sufficient
excess liquidity in the event that factors, whether internal or external to our business, temporarily prevent us
from issuing debt in the capital markets.
148