GREAT SOUTHERN BANCORP, INC.

Cybersecurity and Risk Management

The Company’s cybersecurity risk management processes areintegrated into the overall risk management process managed by the Chief Information Officer through reporting of cyber risks to the Information Security Steering Committee (ISSC). The ISSC is chaired by the Managing Director of Information Security, who has 19 years of information technology (IT) and information security experience in the financial services industry. Key metrics are monitored on an ongoing basis by the IT Risk Management and IT Security teams, with oversight by the ISSC. IT Risk Management performs regular information security-focused risk assessments aligned to the Federal Financial Institutions Examination Council standards.

IT Risk Management maintains processes for prevention, detection, and mitigation of cybersecurity incidents. The Company maintains an Incident Response Plan (IRP) that covers response and remediation processes for managing cybersecurity incidents. The Incident Response Team (IRT) members include senior management and other relevant personnel, with defined roles and responsibilities. IRP metrics related to monitoring and detection are presented to the ISSC andreported to the board. The IRT is notified of all incidents, and incidents are elevated to the board when warranted.

Engagement of Third Parties

The Company utilizes third parties for some cybersecurity services, including but not limited to managed security services, external and internal penetration testing, social engineering tests, third party risk reviews and tabletop exercises.

Oversight and Identification of Risks Associated with Third Parties

Third Party Risk Management, a component of IT Risk Management, reviews new vendors prior to onboarding tooversee and identify potential risks and performs ongoing monitoring of emerging risks related to third-party service providers. Third-party service provider reviews include completion of a standardized questionnaire and risk reviews for financial, reputation, information security, cybersecurity, and business resiliency risk. These reviews are reported to the Information Technology Steering Committee (ITSC) for approval of new applications. The ITSC is chaired by the Chief Information Officer, who has more than 20 years’ experience in IT management and cybersecurity, predominantly in the financial services industry. IT Risk Management performs contract reviews for security controls and notification processes. IT Risk Management also conducts annual IT risk assessments on critical and high-risk applications.

Risks from Cybersecurity Threats

In the last fiscal year, the Companydid not experience any material cybersecurity incidents. For additional discussion of cybersecurity-related risks facing the Company, see Item 1A. Risk Factors.

Board Oversight

In connection with the board’s oversight of risk management, cybersecurity updates are provided to the board at least quarterly, including, but not limited to, the following materials: Annual Gramm-Leach-Bliley Act Information Security Program (ISP) Report, IT Risk Management and IT Security Metrics, Penetration Testing and Tabletop Exercise updates, IT Risk Assessments, Disaster Recovery Test Results, Third Party Risk Management Metrics, Incident Response Metrics, Security Awareness Training Metrics and additional cybersecurity education topics.