Company: GDOT
Filing Date: 2025-04-11
Form Type: DEF 14A
Source: 0001386278-25-000020
Chunk: 24

Company: GREEN DOT CORP
Filing Date: 2025-04-11
Form: DEF 14A
Chunk 24
---
isory or Internal Audit input. Any substantive changes to the program are recommended by the CISO to the Risk Committee and the Risk Committee reviews and approves the Information Security Program.

The Risk Committee regularly briefs the full Board on these matters, and the Board receives regular updates on all significant matters discussed, reviewed, considered and approved by the committee since the last regularly scheduled Board meeting.

Risk Identification and Assessment

Our information security department routinely identifies foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer information systems. The CISO establishes specific procedures to assess the likelihood and potential damage of these threats, taking into consideration the sensitivity of customer, employee and business information and the adequacy of policies, procedures, information systems and other arrangements to control risk. Risk identification and assessment procedures address risks inherent in Green Dot’s operations, including the operations of Green Dot’s service providers, as well as risks arising from proposed changes to Green Dot’s operations.

Our information security department performs a risk assessment no less than annually, evaluating all information systems and identifying and assessing the risks to Green Dot’s assets and the impact these risks pose

<div align='center'>20</div>

Table of Contents

to Green Dot. Our information security department identifies information and the information systems to be protected including electronic and physical systems used to access, store, and transmit information. The risk assessment may be updated upon the acquisition of a new information system or the identification of a previously unidentified security risk. Based on the risk assessment(s) results, the program is evaluated to ensure it addresses the identified risks commensurate with information sensitivity as well as the complexity and scope of Green Dot’s activities. Risk assessments are presented to the Risk Committee for review.

Information Security Risk Insurance

Green Dot maintains information security risk insurance coverage to help defray the costs of an information security breach. This policy is currently active and is reviewed at least annually to ensure the amount of coverage we carry meets or exceeds our peer group. In the last three years, we have not experienced any incidences of information security breach, nor have we incurred any expenses, penalties or settlements as a result.

Service Provider Arrangements

Our Vendor Management Program is designed to ensure that sourcing decisions are made after evaluating the risks and performing robust due diligence. Our vendor management department works with internal business owners and third-party service providers to identify the access that a service provider may have to our systems and data and then collects the necessary documentation to obtain reasonable assurance of appropriate service provider controls. This documentation is provided