Ginnie Mae implements swift cybersecurity incident reporting standards

Ginnie Mae has introduced new cybersecurity incident reporting requirements, the government-owned enterprise announced on Monday. The initiative underscores Ginnie Mae’s commitment to bolstering its companywide information security, business continuity and reporting standards.

Effective immediately, issuers of Ginnie Mae mortgage-backed securities must notify Ginnie Mae of any cybersecurity incident within 48 hours of its detection. 

The company defines a cybersecurity incident as any unauthorized access, disclosure, alteration, transfer or destruction of confidential personal information “that may impact the Issuer’s ability to meet its obligations under the terms of the Guaranty Agreement.”

Furthermore, issuers that subservice for others must specify whether the incident pertains to their own portfolio or subserviced portfolios. Upon notification, Ginnie Mae will seek additional information and assess the necessary level of engagement to contain the incident.

“These Cybersecurity Incident Reporting requirements are an important part of managing cyber risk that could impact our program,” Ginnie Mae President Alanna McCargo said in a statement. “Prompt and clear communication is critical to managing cybersecurity events as they unfold. This new requirement is an important step in further enhancing our cybersecurity framework to meet current and future needs.”

At the Mortgage Bankers Association (MBA) servicing solutions conference held in February, cybersecurity emerged as a focal point for Ginnie Mae. 

“There have been at least half a dozen cybersecurity attacks that were successful within housing finance in the last several months; we’ve had to deal with some of those issues directly ourselves and to others we work with,” Sam Valverde, principal executive vice president at Ginnie Mae, said during a regulatory session at the conference.

Valverde said these problems affect homeowners, investors and insurance companies, and Ginnie Mae is “a bridge for all those counterparties.” These players need to “work well together” and that has been “a new priority” for Ginnie Mae, he said.