Company: GDOT
Filing Date: 2025-03-04
Form Type: 10-K
Source: 0001386278-25-000009
Chunk: 60

Company: GREEN DOT CORP
Filing Date: 2025-03-04
Form: 10-K
Item: Item 1C
Chunk 60
---
, which covers all company risks. As part of this program appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.We routinely engage with assessors, consultants, auditors, and other third-parties, including by annually having an independent Qualified Security Assessor review our Information Security Program to help identify areas for continued focus, improvement and/or compliance, including undergoing annual compliance audits with respect to PCI DSS and SOC 2 compliance.

28

Table of Contents

Our processes also address oversight and identification of cybersecurity risks from our use of third-party service providers. This involves, among other things, conducting pre-engagement risk-based diligence, implementing contractual security and notification provisions, and ongoing monitoring as needed.Risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. Although our cybersecurity risk management program, as described above, is designed to help prevent, detect, respond to, remediate, and mitigate the impact of cybersecurity incidents, there is no guarantee that a future cybersecurity incident would not materially adversely affect the Company's business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see the headings "Our business is dependent on the efficient and uninterrupted operation of computer network systems and data centers, including third party systems" and "A cyber-attack, incident or security breach could expose us to liability and protracted and costly litigation, regulatory penalties, and could negatively impact our reputation and operating revenues" included as part of our risk factor disclosures in "Part I, Item 1A, Risk Factors," of this Annual Report on Form 10-K.

Governance

The Risk Committee of our Board of Directors provides structured oversight of the Company’s Enterprise Risk Management Program, including the oversight of risks from cybersecurity threats. The Risk Committee regularly receives an overview from management of our cybersecurity risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Risk Committee generally receives materials including a cybersecurity scorecard and other materials indicating current and emerging material cybersecurity threat risks, and describing the company’s ability to mitigate those risks, and discusses such matters with our Chief Information