Fannie and Freddie's Regulator Rates Its Own Cybersecurity 'Defined'
Summary
The independent FISMA audit of the agency that regulates and conserves Fannie Mae and Freddie Mac rated its information-security program Level 2 of 5 -- 'Defined,' two rungs below the 'Managed and Measurable' a program needs to be called effective. FHFA management disagreed with all four of the auditor's fixes.
Two rungs short of 'effective'
Across the six NIST Cybersecurity Framework functions, two (Govern, Respond) reached Level 3 and four (Identify, Protect, Detect, Recover) sat at Level 2⧉ -- none reached Level 4. Of the ten FISMA metric domains, only Security Training was rated effective (Level 5).
View data as table
| Govern | 3 | Level 3: Consistently Implemented (Not Effective) |
|---|---|---|
| Identify | 2 | Level 2: Defined (Not Effective) |
| Protect | 2 | Level 2: Defined (Not Effective) |
| Detect | 2 | Level 2: Defined (Not Effective) |
| Respond | 3 | Level 3: Consistently Implemented (Not Effective) |
| Recover | 2 | Level 2: Defined (Not Effective) |
What the auditors found
Sikich, the CPA firm performing the audit under contract with FHFA-, flagged 2 new weaknesses spanning 4 of the 6 CSF functions⧉: FHFA had no documented annual security control assessment for 3 of 4 tested systems, including its General Support System; and on a cloud system, 5 of 12 privileged accounts weren't disabled after 35 days of inactivity -- three sat undisabled for up to 538 days.
View data as table
| New recommendations (FY2026) | 4 | For 2 new weaknesses across 4 of 6 CSF functions |
|---|---|---|
| Still-open from prior audits | 5 | Corrective actions in progress |
| New recs FHFA agreed with | 0 | Management disagreed with all four |
The agency disagreed with its own auditor
The audit made 4 new recommendations⧉ and noted 5 from prior audits still open -- nine total. In its formal response, FHFA management disagreed with all four new recommendations⧉; on each, the auditors' reply was the same: 'our recommendation still stands.'
- FHFA's FY2026 FISMA audit rated its information-security program Level 2 of 5 -- 'Defined (Not Effective)' -- two rungs below the Level 4 'Managed and Measurable' the metrics require for an effective rating.
- Only 1 of the 10 FISMA metric domains (Security Training) was rated effective; none of the six cybersecurity functions reached Level 4.
- The audit made 4 new recommendations and noted 5 prior ones still open -- and FHFA management disagreed with all 4 of the new ones, at the regulator and conservator of Fannie Mae and Freddie Mac.
- Concrete gaps behind the score: no documented annual control assessments for 3 of 4 tested systems, and 5 of 12 privileged cloud accounts left enabled -- one for as long as 538 days of inactivity.
The federal role in housing finance that FHFA oversees has sat on 's High-Risk List⧉ since 2009. Figures here are from FHFA- report AUD-2026-004 (Sikich performance audit dated July 22, 2026; transmittal July 30, 2026), covering April 1, 2025 through March 31, 2026. 'The Agency' in the report is FHFA together with FHFA-, rated for combined results.
Sources(3) ▾
- Federal Housing Finance Agency, Office of Inspector General, Audit of the Federal Housing Finance Agency's Information Security Programs and Practices Fiscal Year 2026 (AUD-2026-004) (2026-07-30) — The FHFA-'s own transmittal (July 30, 2026) plus the attached Sikich CPA LLC performance-audit report (dated July 22, 2026) that the contracted under FISMA. Fetched directly from fhfaoig.gov and read in full with pdftotext -layout; byte-for-byte identical (MD5 b4062f148d795677fdba31880263946e) to the copy on the oversight.gov portal. Sourced from it: the overall Level 2 - Defined (Not Effective) maturity rating and the five-level scale (Executive Summary, p.1-2); Table 1's per-function and per-domain maturity levels (p.3); the count of 2 new weaknesses across 4 of 6 CSF functions and 4 of 10 FISMA metric domains and the 4 new recommendations (Executive Summary p.2, Table 2 p.5-7); the prior-recommendations tally -- 17 open at the start, 12 closed, 5 still open (Audit Results, p.3); Finding 1's 3-of-4-systems assessment gap (p.8); Finding 2's 5-of-12 privileged-account gap and the 73-to-538-day inactivity range (p.10); and the Evaluation of Management Comments recording that FHFA management disagreed with all four recommendations (p.13-15, transmittal p.2). The issuer-hosted PDF is the primary; the oversight.gov mirror corroborates it. fhfaoig.gov · original document
- Council of the Inspectors General on Integrity and Efficiency (oversight.gov), Audit of the Federal Housing Finance Agency's Information Security Programs and Practices Fiscal Year 2026 (AUD-2026-004) -- oversight.gov copy (2026-07-30) — The same report on the oversight.gov federal -report portal, used here only to corroborate the issuer-hosted fhfaoig.gov copy: the two PDFs share an identical MD5 hash (b4062f148d795677fdba31880263946e), an independent second reachable copy of the identical file on a different .gov host. oversight.gov · original document
- U.S. Government Accountability Office, High-Risk List: Resolving the Federal Role in Housing Finance (GAO-23-106203, High-Risk Series) (2023-04-20) — 's High-Risk List entry 'Resolving the Federal Role in Housing Finance,' which the High-Risk Series report (-23-106203, Table 7) records as designated high risk in 2009. Used only for context: the federal role in housing finance that FHFA oversees -- as regulator and conservator of Fannie Mae and Freddie Mac -- has carried a high-risk designation since 2009. The gao.gov/high-risk-list landing page redirects to the underlying High-Risk Series report at files.gao.gov. A Wayback Save Page Now request for the landing page returned HTTP 520 during the ongoing archive outage, so no fresh archiveUrl is recorded for this context-only source. gao.gov · original document
Comments
Always open. Logged-in readers can annotate paragraphs in place.
The Federal Housing Finance Agency regulates and conserves Fannie Mae and Freddie Mac -- the two firms behind much of the U.S. mortgage market. Its own inspector general's FY2026 FISMA audit rated the agency's information-security program⧉ Level 2 of 5 -- 'Defined' (Not Effective) -- two rungs below the Level 4 a program needs to be called effective.