XML 24 R9.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

The IT Security Team consists of five members, led by the VP of IT of the Company’s CoreCard Software subsidiary, and focuses on the Company’s overall data and cybersecurity. The PCI Compliance Force consists of six members, is led by the subsidiary’s Chief Technology Officer, and focuses on the Company’s compliance with PCI standards. Both teams hold regular meetings to discuss and report on, as applicable, meaningful cybersecurity risks, threats, incidents, and vulnerabilities, and changes in and compliance with industry data and cybersecurity standards. The teams also develop and oversee mitigation and remediation activities within their areas of responsibility. The teams, in conjunction with senior management, work to ensure that the Company is meeting requirements of applicable regulations and that the Company’s third-party vendors are also meeting compliance requirements. The teams are also tasked with the development and maintenance of business continuity plans, security policies and procedures. The Company’s Emergency Management Team, which consists of seven members and is led by the Company’s Chief Executive Officer, has developed business incident response runbooks designed to guide operational staff with a set framework for response and mitigation to cybersecurity incidents and threats.

 

The Company has also designed its information technology systems and infrastructure to protect its and its customers’ data with industry standard security, and the Company must pass an annual PCI audit with rules specific to the Company’s operation of cardholder data environments. The Company’s cybersecurity defensive protections are focused on detecting and mitigating cybersecurity threats before they can cause harm. The Company performs periodic penetration and vulnerability scan testing on both its internal and external facing infrastructure and systems. All Company employees are required to take cybersecurity training on an annual basis and must pass an examination designed to ensure knowledge transfer. CoreCard also utilizes a third-party security auditor for PCI audits, security training, and cybersecurity risk consulting. This partnership enables us to leverage specialized knowledge and insights, with the goal of ensuring our cybersecurity strategies and processes remain current.

 

Our business is managed under the direction of our Board of Directors (the “Board”), which guides our long-term strategy and represents the highest level of oversight at the Company. Our full Board oversees our enterprise risk management, which includes oversight of risks from cybersecurity threats. Our Board views the identification and effective management of cybersecurity threats as a critical component of its overall risk management and oversight responsibilities. Our management team provides regular updates to the Board on cybersecurity risks and threats. These updates cover, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, and the emerging threat landscape. In turn, the Board reviews and discusses these cyber risks and threats and provides advice and guidance on the adequacy of our initiatives on cybersecurity risk management.

 

The Company faces a number of cybersecurity risks in connection with its business. Based on the information the Company has as of the date of this Form 10-K, the Company does not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company’s business strategy, results of operations or financial position. However, cybersecurity threats are constantly evolving, and many of the security measures that the Company has implemented must also evolve over time. While CoreCard seeks to utilize industry standard measures and tools to monitor and address these evolving threats, the Company may not be able to anticipate, prevent or mitigate its cybersecurity risks, the occurrence of which could result in significant legal and financial exposure, theft, damage to the Company’s reputation, interruption of the Company’s business operations, the loss of confidence in the Company’s security measures, and harm to the Company’s business.

Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] The Company has also designed its information technology systems and infrastructure to protect its and its customers’ data with industry standard security, and the Company must pass an annual PCI audit with rules specific to the Company’s operation of cardholder data environments. The Company’s cybersecurity defensive protections are focused on detecting and mitigating cybersecurity threats before they can cause harm. The Company performs periodic penetration and vulnerability scan testing on both its internal and external facing infrastructure and systems. All Company employees are required to take cybersecurity training on an annual basis and must pass an examination designed to ensure knowledge transfer. CoreCard also utilizes a third-party security auditor for PCI audits, security training, and cybersecurity risk consulting. This partnership enables us to leverage specialized knowledge and insights, with the goal of ensuring our cybersecurity strategies and processes remain current.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]

The IT Security Team consists of five members, led by the VP of IT of the Company’s CoreCard Software subsidiary, and focuses on the Company’s overall data and cybersecurity. The PCI Compliance Force consists of six members, is led by the subsidiary’s Chief Technology Officer, and focuses on the Company’s compliance with PCI standards. Both teams hold regular meetings to discuss and report on, as applicable, meaningful cybersecurity risks, threats, incidents, and vulnerabilities, and changes in and compliance with industry data and cybersecurity standards. The teams also develop and oversee mitigation and remediation activities within their areas of responsibility. The teams, in conjunction with senior management, work to ensure that the Company is meeting requirements of applicable regulations and that the Company’s third-party vendors are also meeting compliance requirements. The teams are also tasked with the development and maintenance of business continuity plans, security policies and procedures. The Company’s Emergency Management Team, which consists of seven members and is led by the Company’s Chief Executive Officer, has developed business incident response runbooks designed to guide operational staff with a set framework for response and mitigation to cybersecurity incidents and threats.

 

The Company has also designed its information technology systems and infrastructure to protect its and its customers’ data with industry standard security, and the Company must pass an annual PCI audit with rules specific to the Company’s operation of cardholder data environments. The Company’s cybersecurity defensive protections are focused on detecting and mitigating cybersecurity threats before they can cause harm. The Company performs periodic penetration and vulnerability scan testing on both its internal and external facing infrastructure and systems. All Company employees are required to take cybersecurity training on an annual basis and must pass an examination designed to ensure knowledge transfer. CoreCard also utilizes a third-party security auditor for PCI audits, security training, and cybersecurity risk consulting. This partnership enables us to leverage specialized knowledge and insights, with the goal of ensuring our cybersecurity strategies and processes remain current.

 

Our business is managed under the direction of our Board of Directors (the “Board”), which guides our long-term strategy and represents the highest level of oversight at the Company. Our full Board oversees our enterprise risk management, which includes oversight of risks from cybersecurity threats. Our Board views the identification and effective management of cybersecurity threats as a critical component of its overall risk management and oversight responsibilities. Our management team provides regular updates to the Board on cybersecurity risks and threats. These updates cover, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, and the emerging threat landscape. In turn, the Board reviews and discusses these cyber risks and threats and provides advice and guidance on the adequacy of our initiatives on cybersecurity risk management.

 

The Company faces a number of cybersecurity risks in connection with its business. Based on the information the Company has as of the date of this Form 10-K, the Company does not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company’s business strategy, results of operations or financial position. However, cybersecurity threats are constantly evolving, and many of the security measures that the Company has implemented must also evolve over time. While CoreCard seeks to utilize industry standard measures and tools to monitor and address these evolving threats, the Company may not be able to anticipate, prevent or mitigate its cybersecurity risks, the occurrence of which could result in significant legal and financial exposure, theft, damage to the Company’s reputation, interruption of the Company’s business operations, the loss of confidence in the Company’s security measures, and harm to the Company’s business.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Our business is managed under the direction of our Board of Directors (the “Board”), which guides our long-term strategy and represents the highest level of oversight at the Company. Our full Board oversees our enterprise risk management, which includes oversight of risks from cybersecurity threats. Our Board views the identification and effective management of cybersecurity threats as a critical component of its overall risk management and oversight responsibilities. Our management team provides regular updates to the Board on cybersecurity risks and threats. These updates cover, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, and the emerging threat landscape. In turn, the Board reviews and discusses these cyber risks and threats and provides advice and guidance on the adequacy of our initiatives on cybersecurity risk management.
Cybersecurity Risk Role of Management [Text Block] Our business is managed under the direction of our Board of Directors (the “Board”), which guides our long-term strategy and represents the highest level of oversight at the Company. Our full Board oversees our enterprise risk management, which includes oversight of risks from cybersecurity threats. Our Board views the identification and effective management of cybersecurity threats as a critical component of its overall risk management and oversight responsibilities. Our management team provides regular updates to the Board on cybersecurity risks and threats. These updates cover, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, and the emerging threat landscape. In turn, the Board reviews and discusses these cyber risks and threats and provides advice and guidance on the adequacy of our initiatives on cybersecurity risk management.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true