Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments
None.
Item 1C. Cybersecurity
Risk Management and Strategy Overview
Customers depend
on the
Company to
safeguard
nonpublic personal
information
gathered and
stored in
connection
with the
services we
provide. The
Company understands
that cyber
incidents can
have financial,
reputational, legal,
and
operational impacts
that can
adversely affect
our customers,
capital, and
earnings. Therefore,
we integrate
cybersecurity
processes throughout the
Company as part of
our enterprise-wide governance
process. Regulatory agencies
are charged
with
ensuring
the
Company’s
cybersecurity
controls
and
procedures
are
compliant
with
the
intent
of
the
cybersecurity
expectations set forth
by the Federal
Financial Institutions
Examination Council
(“FFIEC”). The
FFIEC framework
offers a
set
of
guidelines
and
best
practices
to
help
financial
institutions
manage
and
mitigate
cybersecurity
risks
effectively.
It
focuses on ensuring the confidentiality,
integrity, and availability
of sensitive information and systems.
The Information
Security Officer
(“ISO”) is
an integral
member of
the Risk
Management and
Compliance Department
(“RMCD”) of
the Bank
and provides
expert counsel
on matters
of cybersecurity
and presents
periodic reports
to the
Risk
Committee of our Board of Directors.
As part
of the
program, periodic
risk assessments
are performed
to determine
the Company’s
inherent and
residual
cybersecurity risk, the
maturity level of the program,
the risk of cyber
threats, and the effectiveness
of controls currently
in
practice. The Company utilizes the National Institute of Standards and
Technology
(“NIST”) Framework and the Cyber Risk
Institute Framework (“CRI
Framework”) to help
management identify its
risks and determine
the Company’s
cybersecurity
posture.
Through
the
implementation
of rigorous
procedures
and controls,
augmented
by ongoing
training
initiatives
for
both management and
staff, the institution
cultivates a safe
cybersecurity environment. This
approach encompasses diverse
methodologies
including
defense-in-depth
and
proactive
security
awareness
training
aimed
at
fortifying
the
institutions’
cybersecurity controls and fostering a resilient operational
framework.
Assessment and Response to Cybersecurity Threats
It is the policy of
the Company and its
technology service providers
(“TSPs”) to ensure that
they can identify,
mitigate,
and respond to cyber-attacks involving destructive
malware and invasive attacks such
as phishing, ransomware, malware,
DDoS
attacks,
etc.
This
commitment
aligns
with
the
Company’s
risk
appetite,
Incident
Response
Policy,
and
Business
Continuity Plan,
which incorporates
business continuity
planning and
testing activities
to enhance response
and recovery
capabilities.
The Company recognizes that it faces a variety of risks from cyber-attacks involving destructive malware, including
liquidity, capital, operational, and
reputation risks, due
to events such
as fraud, data
loss, and disruption
of customer
service.
As such,
it is
the policy
of the
Company to
ensure that
its risk
management processes,
and business
continuity planning
address these risks by:
●
Establishing
a
comprehensive
governance
program
encompassing
policies
and
procedures
to
administer
and
oversee
the
information/cybersecurity
programs
to
ensure
adherence
to
regulatory
guidance
and
industry
best
practices.
●
Securely configuring systems and services to mitigate the impact of cyber-threats. This includes measures such as
logical network segmentation, backups, maintaining an inventory
of authorized devices and software, and physical
segmentation
of
critical
systems.
Consistency
in
system
configuration
fosters
a
secure
network
environment
by
removing or disabling unused applications, functions, or components.
●
Implementing and testing
controls around critical
systems on a regular
basis to ensure appropriate
access control
and segregation of duties. Limits on sign-on attempts
for critical systems are enforced, with accounts
being locked
when
the
threshold
are
met.
Alert
systems
notify
of
baseline
control
changes
on
critical
systems,
with
the
effectiveness and
adequacy of
controls periodically
tested and
the results
reported to
senior management
and, if
applicable,
the
Risk
Committee,
along
with
recommended
risk
mitigation
strategies
and
the
progress
of
actions
taken to remediate findings.
●
Performing security
monitoring, prevention,
and risk
mitigation activities
to ensure
the effectiveness
of protection
and detection systems.
This includes maintaining
up-to-date intrusion detection
systems, antivirus protection,
and
properly configured
firewall
rules. Systems
are monitored
to
identify,
prevent,
and contain
cyber-attack
attempts
from all sources.
Table of Contents
48
USCB Financial Holdings, Inc.
2025 10-K
●
Maintaining robust business
continuity planning processes
to swiftly
recover, resume, and maintain
operations post-
cyber-attack incidents
involving destructive
malware. These
processes encompass
data and business
operations
recovery,
network
capability
rebuilding,
and
data
protection
for
offline
backups
in
the
event
of
cyber-attacks
impacting the Company and/or its critical service providers.
●
Conducting ongoing
information security
risk assessments
to address
new and
evolving threats
to online
deposit
and loan accounts. This involves identifying, prioritizing, and assessing risks to
critical systems, including threats to
applications controlling
various system parameters and implementing
necessary security prevention measures.
●
Reviewing, updating, and testing incident response and business
continuity plans annually to ensure effectiveness.
Testing
encompasses
both
in-house
and
third-party
processor
scenarios
to
validate
employee
understanding
of
responsibilities and adherence to Company protocols.
Executive Oversight and Roles
The
responsibility
for
adopting
and
maintaining
an
effective
cybersecurity
program
is
assigned
to
the
RMCD,
who
collaborates
with
functional
area
management,
departmental
level
managers,
and
other
relevant
staff.
Management
committees and
the Audit
and Risk
Committee of
the Board
(“ARC”) review
reports submitted
by the
RMCD detailing
the
Company’s
inherent
and
residual
cybersecurity
risk,
program
sophistication
level,
and
high-risk
threats
identified
in
the
cybersecurity risk assessment.
The
ARC
oversees
the
development
and
maintenance
of
the
information
security
program,
holding
management
accountable.
Management
committees
ensure
program
integration
and
effectiveness,
with
the
RMCD
responsible
for
cybersecurity controls
and procedures.
The ARC
receives regular
reports
on cybersecurity
risk assessment
and program
updates,
providing
expectations
and
requirements
to
management
and
holding
them
accountable
for
oversight
and
coordination, assignment of responsibility,
and the effectiveness of the information and cybersecurity
security program.
Annually,
or
as
required,
the
RMCD
provides
a
comprehensive
report
to
the
Board
regarding
the
status
of
the
cybersecurity
program
.
This
report
encompasses
internal
assessments,
utilization
of
the
Cybersecurity
Assessment,
discussion of
significant program
matters such
as the
annual risk
assessment, risk
management decisions,
monitoring of
service provider compliance, results of key controls testing, security breaches
or violations, management's responses, and
recommendations for program enhancements.
Engagement with Third Party Vendors
The engagement of critical third-party providers introduces a range of
potential risks that can affect the Bank’s strategic
direction, reputation, daily
operations, transaction integrity,
credit exposures, financial
stability,
technological environment,
and compliance posture. Providers whose services include the transmission, storage, or processing
of non-public personal
information
present heightened
compliance risks,
particularly
with respect
to the
requirements
of the
GLB
Act and
other
applicable Privacy Laws and Regulations.
The
Bank
has
established
general
guidelines
to
support
the
identification,
risk
assessment,
monitoring,
and
management of risks related
to the engagement of
third-party providers or vendors.
This framework ensures that risks
are
addressed proactively and in accordance with regulatory
expectations.
Risk assessment for
critical providers may
require the involvement
of specialized personnel,
including the compliance
officer, technology officers, finance officers,
internal auditors, and
legal counsel. Their
participation is essential
for identifying
potential risks arising
from third-party relationships,
defining performance criteria,
establishing internal controls,
specifying
reporting requirements, and ensuring
contractual obligations are in
place for ongoing risk assessment
and mitigation. This
collaborative approach helps maintain the integrity and security of the
Bank’s operations while meeting regulatory and legal
standards.
Compliance with Regulatory Standards
As noted above, annual testing, or more frequently
if deemed necessary,
of cybersecurity controls and procedures
will
be conducted
to ensure
compliance. In
instances of
identified deficiencies
or vulnerabilities,
remedial action
plans will
be
implemented to rectify issues or establish mitigating controls. Any exceptions
deemed significant will be promptly reported,
with remediation efforts prioritized.
Annually,
or
as
required,
the
RMCD
will
provide
a
comprehensive
report
to
the
ARC
or
a
designated
committee
regarding
the
status
of
the
cybersecurity
program.
This
report
will
encompass
internal
assessments,
utilization
of
the
Cybersecurity Assessment, and discussion of other significant
program matters.
Table of Contents
49
USCB Financial Holdings, Inc.
2025 10-K
As of the end of
the reporting period set
forth in this Annual
Report on Form 10-K,
there is no knowledge
or indication
that
customer
sensitive
information
was
compromised
as
a
result
of
third-parties’
system
vulnerabilities.
Management
continues to monitor developments and vendor communications.