Freddie Mac 2015 Annual Report Download - page 191

Risk Factors Operational Risks
Freddie Mac 2015 Form 10-K 189
For information on an operational risk issue relating to the PC master trust agreement, see "MD&A - Risk
Management - Operational Risk."
The threat landscape in cyber security is changing rapidly and growing in sophistication. We may
not be able to protect our systems with complete assurance or fully protect the confidentiality of
our information from cyberattack and other unauthorized access, disclosure, and disruption.
Our operations rely on the secure and accurate receipt, processing, storage, and transmission of
confidential and other information in our computer systems and networks and with our business partners.
Like many corporations and government entities, from time to time we have been, and likely will continue
to be, the target of attempted cyberattacks. Although we devote significant resources to protecting our
various systems and processes, there is no assurance that our security measures will provide effective
security. Our computer systems, software, and networks may be vulnerable to cyberattack, unauthorized
access, supply chain disruptions, computer viruses or other malicious code, or other attempts to harm
them or misuse or steal information. The occurrence of one or more of such events could jeopardize or
result in the unauthorized disclosure, misuse or corruption of confidential and other information (including
information about our borrowers, our customers or our counterparties), or otherwise cause interruptions or
malfunctions in our operations or the operations of our customers or counterparties. This could result in
significant losses or reputational damage, adversely affect our relationships with our customers and
counterparties, negatively affect our competitive position, and otherwise harm our business. We could
also face regulatory and other legal action. We might be required to expend significant additional
resources to modify our protective measures or to investigate and remediate vulnerabilities or other
exposures, and we might be subject to litigation and financial losses that are not fully insured. In addition,
there can be no assurance that business partners, counterparties and governmental organizations are
adequately protecting the information that we share with them. As a result, a cyberattack on their systems
and networks, or breach of their security measures, may result in harm to our business and business
relationships.
We rely on third parties for certain important functions. Any failures by those vendors and service
providers could disrupt our business operations or expose us to loss of confidential information
or intellectual property.
At times, we outsource certain key functions to external parties, including some that are critical to
financial reporting, our mortgage-related investment activity, and loan underwriting. We may enter into
other key outsourcing relationships in the future. If one or more of these key external parties were not
able to perform their functions for a period of time, perform them at an acceptable service level, or handle
increased volumes, or if one of them experiences a disruption in its own business or technology from any
cause, our business operations could be constrained, disrupted, or otherwise negatively affected. Our use
of vendors also exposes us to the risk of losing intellectual property or confidential information and to
other harm, including to our reputation. Our ability to monitor the activities or performance of vendors may
be constrained, which may make it difficult for us to assess and manage the risks associated with these
relationships.