USCB FINANCIAL HOLDINGS INC

Risk Management and Strategy Overview

Customers

depend

on

the

Company

to

properly

protect

nonpublic

gathered

and

stored

in

connection with the services we provide. The Company realizes that cyber incidents can have financial, reputational,

legal,

and operational impacts that can

significantly adversely affect our customers, capital, and

earnings. Therefore, we integrate

cybersecurity processes throughout the Company as part of our enterprise-wide governance process. Regulatory agencies

are

charged

with

ensuring

the

and

are

compliant

with

the

intent

of

the

set

forth

by

the

Federal

Institutions

Examination

Council

(“FFIEC”).

The

FFIEC

framework offers a set of guidelines

and best practices to help

financial institutions manage and mitigate cybersecurity risks

effectively.

It focuses on ensuring the confidentiality,

integrity, and availability

of sensitive information and systems.

The Information

Security Officer

(“ISO”) is

an integral

member of

the Risk

Management and

Compliance Department

(“RMCD”) of

and who

provides expert

counsel on

matters of

cybersecurity and

presents periodic

reports to

the

Risk Committee of our Board of Directors.

As part

of the

program, periodic

risk assessments

are performed

to determine

inherent and

residual

cybersecurity risk, the

maturity level of the program,

the risk of cyber

threats, and the effectiveness

of controls currently

in

practice. The

Company utilizes

the National

Institute of

Standards and

Technology

(“NIST”) Framework

and the

FFIEC’s

Cybersecurity Assessment Tool

to help management identify its risks and determine the Company’s cybersecurity posture.

Through

the

implementation

of

rigorous

and

augmented

by

ongoing

for

both

and

staff,

the

cultivates

a

safe

environment.

This

diverse

methodologies

defense-in-depth

and

proactive

awareness

aimed

at

fortifying

the

cybersecurity controls and fostering a resilient operational

Assessment and Response to Cybersecurity Threats

It is the policy of

the Company and its

technology service providers

(“TSPs”) to ensure

they can identify,

mitigate, and

respond to

cyber-attacks involving destructive

malware and invasive

attacks such

as phishing,

ransomware, malware, DDoS

attacks, etc. This commitment aligns

with the Company’s risk

appetite, Incident Response Policy,

and Business Continuity

Plan, which incorporates business continuity planning and testing activities to enhance response and recovery capabilities.

realizes that it

faces a

variety of

risks from cyber-attacks

involving destructive malware,

including liquidity,

capital, operational,

and reputation

risks, due

to events

such as

fraud, data

loss, and

disruption of

service. As

such, it

is the

policy of

to ensure

that its

risk management

processes, and

business continuity

planning address

these risks by:

●

Establishing

a

program

encompassing

and

to

administer

and

oversee

the

information/cybersecurity

to

ensure

adherence

to

guidance

and

best

practices.

●

Securely configuring systems and services to mitigate the impact of cyberattacks.

This includes measures such as

logical

network

segmentation,

hard

backups,

an

inventory

of

authorized

devices

and

software,

and

physical

segmentation

of

systems.

Consistency

in

system

configuration

fosters

a

secure

network

environment by removing or disabling unused applications, functions,

or components.

●

Implementing and testing

controls around critical

systems on a regular

basis to ensure appropriate

access control

and segregation of duties. Limits on sign-on attempts

for critical systems are enforced, with accounts

being locked

upon

exceedance.

Alert

systems

notify

of

baseline

control

changes

on

with

the

effectiveness and

adequacy of controls

periodically tested

and the results

reported to

Senior Management

and, if

applicable,

the

Risk

along

with

recommended

risk

mitigation

strategies

and

progress

to

remediate

findings.

●

Performing security

monitoring, prevention,

and risk

mitigation activities

to ensure

the effectiveness

of protection

and detection systems.

This includes maintaining

up-to-date intrusion detection

systems, antivirus protection,

and

properly configured firewall

rules. Systems are

monitored to identify,

prevent, and contain

attack attempts from

all

sources.

●

Maintaining robust business

continuity planning processes

to swiftly

recover, resume, and maintain

operations post-

cyber-attack incidents

involving destructive

malware. These

processes encompass

data and business

recovery,

network

capability

rebuilding,

and

data

for

offline

backups

in

the

event

of

cyber-attacks

impacting the Company or its critical service providers.

●

Conducting ongoing

information security

risk assessments

to address

new and

evolving threats

to online

deposit

and loan accounts. This involves identifying, prioritizing, and assessing risks to

critical systems, including threats to

applications controlling

various system parameters and implementing

necessary security prevention measures.

●

Reviewing, updating, and testing incident response and business

continuity plans annually to ensure effectiveness.

Testing

both

in-house

and

processor

scenarios

to

validate

understanding

of

responsibilities and adherence to Company protocols.

Executive Oversight and Roles

The

responsibility

for

adopting

and

an

program

is

to

the

RMCD,

who

collaborates

with

functional

area

departmental

level

managers,

and

other

relevant

staff.

Committees

and

the

Board

of

Directors

review

reports

submitted

by

the

RMCD

detailing

the

inherent

and

residual cybersecurity

risk, program

sophistication level,

and high-risk

threats identified

in the

cybersecurity risk assessment.

The

Board

oversees

the

and

maintenance

of

the

program,

holding

accountable.

committees

ensure

program

integration

and

effectiveness,

with

the

RMCD

responsible

for

cybersecurity controls and procedures.

The Board receives regular reports

on cybersecurity risk assessment

and program

updates,

and

to

and

holding

them

accountable

for

oversight

and

coordination, assignment of responsibility,

and the effectiveness of the information and cybersecurity

security program.

Annually, or as required, the RMCD

provides a comprehensive report

to the Board or

a designated committee regarding

the

status

of

the

This

report

assessments,

utilization

of

the

FFIEC

Assessment

Tool,

of

program

matters

such

as

the

annual

risk

assessment,

risk

decisions,

of

service

provider

compliance,

results

of

key

testing,

breaches

or

violations, management's responses, and recommendat

ions for program enhancements.

Engagement with Third Party Vendors

"Private

information,"

which

is

part

of

the

"Internet

Security

and

Privacy

Act"

and

"Highly

Sensitive

Information" under

the Company’s definition,

must not

be released

as storable

data to

third-party consultants without

procedures that

demonstrate compliance

Company's third-party

diligence in

protecting the

data and

ensuring its

proper

when

no

longer

needed.

"Private

or

highly

sensitive

information"

refers

to

(e.g.,

information concerning

an individual

which, because

of name,

number,

symbol,

mark, or

other identifier,

can be

used to

identify an

individual) in

combination with

any one

or more

of the

following data

elements: (1)

social security

number; (2)

driver’s

license

number

or

non-driver

card

number;

(3)

account

number,

credit

or

debit

card

number,

in

combination

with

any

code,

access

code,

or

password

which

would

permit

access

to

an

individual’s

financial account(s) at

the Company including

but not limited

to an individual’s deposit

and loan accounts.

It does not

include

publicly available

information that

is lawfully

made available

to the public

from federal, state,

or local

government records

unless attached in any way to the previously mentioned

documentation.

Compliance with Regulatory Standards

Annual testing or

more frequently if

deemed necessary

of cybersecurity controls

and procedures will

be conducted

to

ensure compliance.

In instances

of identified

deficiencies or

vulnerabilities,

remedial action

plans will

be implemented

to

rectify issues or establish mitigating

controls. Any exceptions deemed significant will

be promptly reported, with remediation

efforts prioritized.

Annually,

or

as

required,

the

RMCD

will

provide

a

report

to

the

Board

or

a

committee

regarding the status of

the cybersecurity Program. This report

will encompass internal assessments, utilization

of the FFIEC

cybersecurity Assessment Tool,

and discussion of other significant program matters.

As of the reporting period, there is

no knowledge or indication that customer sensitive information was compromised as

a

result

of

third-parties’

system

vulnerabilities.

continues

to

monitor

and

vendor

communications.

The Company’s corporate offices

are headquartered at 2301 N.W.

87th Avenue, Miami, Florida 33172. The

Bank,

operates

10 banking

centers

in South

Florida

within

Miami-Dade

and

Broward counties.

From

the

banking centers, nine of these locations are leased and one is owned. The

banking center that is owned is located at 3999

Sheridan St, Hollywood, FL 33021. Management

believes that each of these locations are

in good condition and adequate

to meet our present and foreseeable needs, subject to

possible future expansion.