What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2025-03-18 compared with 2024-03-22 · 30 added, 20 removed, 24 unchanged (68% of the section changed)

1 unchanged sentence

Cybersecurity

Cybersecurity risk is the risk of compromising the confidentiality, integrity, or availability of our technology platforms, data, and other systems, which could have an adverse impact on us, our members, Clients, and Network Partners.

We take a strategic, risk-based approach to our cybersecurity program, which emphasizes continual improvement in an effort to protect and enable our business operations.

Our enterprise cybersecurity program is designed to assess, identify, and manage cybersecurity threats through continuous monitoring of our information systems for potential vulnerabilities and through various controls and security tools designed to prevent, detect, escalate, investigate, resolve, and recover from identified and reasonably anticipated vulnerabilities, including any cybersecurity incidents, in a timely manner.

In the event a security risk is detected, or a breach occurs, we are prepared with response protocols based on National Institute of Standards & Technology ("NIST") guidelines.

Our Security Incident Response Plan defines roles and responsibilities, incident severity levels, key contacts, post-incident steps, and guidelines for testing.

As further described below, we take various steps designed to help ensure that our platforms, data, and other systems remain available, resilient, and secure in the face of risks presented both by inadvertent actions (e.g., software that fails to operate properly) and by malicious activities (e.g., threat actors deliberately seeking to steal data or otherwise cause disruption).

In particular, our industry continues to be a target for increasingly sophisticated cyber threats, including those driven by the rapid advancement of AI, adoption of public cloud environments, and reliance on third parties.

We take a security-by-design and risk-based approach to our cybersecurity program, which emphasizes continual improvement to safeguard non-public information and enable our business operations.

Our cybersecurity program is structured to identify, assess, and mitigate risks through continuous monitoring, proactive threat intelligence, and a multi-layered defense strategy.

We implement security controls, tools, and incident response procedures to prevent, detect, escalate, investigate, resolve, and recover from identified and reasonably anticipated vulnerabilities, including cybersecurity incidents.

We emphasize fraud prevention, data protection, and securing our core platforms, while also prioritizing zero trust architecture, third-party risk management, immutable backups, training our staff and others who may have access to our data and systems, and improvement of our security personnel.

In the event of a security risk or breach, we are prepared with response protocols aligned with National Institute of Standards & Technology ("NIST") guidelines.

Our Security Incident Response Plan defines roles and responsibilities, incident severity levels, key contacts, post-incident steps, and testing guidelines.

Our procedures cover response steps for phishing attacks, ransomware, data breaches, and major vulnerabilities.

In addition, we have an organic threat model that evaluates our security controls to help protect against attacker tactics, techniques, and procedures.

In addition, we have an organic threat model to evaluate our security controls against attacker tactics, techniques, and procedures.

This adaptive approach strengthens our ability to anticipate and counter emerging threats.

See “Risk Factors” in Part I, Item 1A of this Form 10-K for further information about cybersecurity risk.

6 unchanged sentences

Our security team seeks to identify security risks by working with state and federal law enforcement, security information-sharing organizations, and 24/7 system surveillance through internal and external detection and response teams.

Additionally, to help ensure our approach to customer privacy and security is effective and in line with industry standards, we publish Service and SOC 2 attestation reports on our risk management standards established by the Statement on Standards for Attestation Engagements 18 (SSAE-18).

We regularly engage external and internal assessors and auditors to evaluate and audit our cybersecurity policies, procedures, standards, and practices.

1 unchanged sentence

We have obtained, or are working toward obtaining, industry certifications and attestations and have aligned our cybersecurity program with the NIST Cybersecurity Framework and related controls.

As part of our Partner Security Risk Management program, we perform initial risk assessments prior to engaging third-party service providers and ongoing risk assessments annually thereafter, which follow an established process designed to identify, assess, and periodically review our exposure to risk through our partners.

As part of our Third Party Risk Management program , we perform initial risk assessments prior to engaging third-party service providers and ongoing risk assessments annually thereafter, which follow an established process designed to identify, assess, and periodically review our exposure to risk through our partners.

During the fiscal year ended January 31, 2025, no known cybersecurity threats materially affected , or we believe are reasonably likely to materially affect, our business, our business strategy, financial reporting, or results of operations.

4 unchanged sentences

The Cybersecurity and Technology Committee updates the full board of directors at each quarterly board meeting, or more frequently if needed.

Our enterprise cybersecurity program is led by the CSO who oversees both information technology and information security functions.

Our CSO brings more than 20 years of cybersecurity experience in various leadership positions, both in technology and finance industries.

He holds a doctorate degree from the University of Michigan and holds over 100 US and global security-related patents.

Our enterprise cybersecurity program is led by the CSO, who brings more than two decades of cybersecurity leadership experience and oversees both information technology and information security functions.

In order to assess and manage our material risks from cybersecurity threats, our CSO works with cross-functional teams, which are staffed with subject matter experts and leaders from each of the following areas:

• Cybersecurity:

We follow a defense-in-depth security model with a Joint Security Operations Center (JSOC), Attack Surface Management, and Data Protection team working with security architects and engineers deploying controls designed to prevent or limit the success of an attack.

• Privacy and Governance:

Our Data Privacy and Governance team helps our technology teams build a lasting roadmap to creating our products, services, and standards with privacy by design, and transparency at the forefront.

• People Safety and Crisis Management:

Led by federal law enforcement veterans, our People and Partner Safety team is responsible for ensuring the security of our team members across the US.

We also conduct regular tabletop exercises to ensure we are ready to respond to crises, including cybersecurity incidents.

• Threat & Vulnerability Management:

We follow a defense-in-depth security model with a Joint Security Operations Center, Attack Surface Management, and Data Protection team working with security architects and engineers deploying controls designed to prevent or limit the success of an attack.

• Governance, Risk, and Compliance:

Our Security Governance, Risk, and Compliance team helps drive trust, compliance, and data protection by managing risks, including supply chain risks, to strengthen customer confidence, support innovation, and protect our reputation.

• Fraud Prevention:

Our Fraud Strategy and Prevention team leverages industry best practices of fraud prevention, identity and access management, and cybersecurity monitoring to protect the transactions of our members and Clients.

Our Fraud Strategy and Prevention team seeks to employ industry best practices of fraud prevention, identity and access management ("IAM"), and cybersecurity monitoring to protect the

transactions of our members and Clients.

We continue to invest in people, processes, and technology solutions to enhance our fraud prevention program.

• Security Engineering & Architecture:

Our Security Engineering & Architecture team designs and implements resilient security solutions, embedding security into cloud and on-premise environments while automating controls and integrating security into development lifecycles.

• Identity & Access Management:

Our IAM team enforces zero trust principles, least privilege access, and adaptive authentication, managing multi-factor authentication, privileged access management, and just-in-time access to protect critical systems while ensuring seamless and compliant user access.

We do not currently own any of our facilities.

Our principal executive offices are located in Draper, Utah, and we lease additional office space in Texas.

Our principal executive offices are located in Draper, Utah.

Since a majority of our workforce is now permanently working remotely, we no longer use portions of our office space and we have subleased, or are seeking opportunities to sublease, these offices.

Legal proceedings

For information regarding legal proceedings in which we are involved, refer to Note 6—Commitments and contingencies to our financial statements included in Part II, Item 8 of this Annual Report on Form 10-K.

Mine safety disclosures

Not applicable.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments