USCB FINANCIAL HOLDINGS, INC.

Risk Management and Strategy Overview

Customers

depend

on

the

Company

to

properly

protect

nonpublic

gathered

and

stored

in

connection with the services we provide. The Company realizes that cyber incidents can have financial, reputational,

legal,

and operational impacts that can

significantly adversely affect our customers, capital, and

earnings. Therefore, we integrate

cybersecurity processes throughout the Company as part of our enterprise-wide governance process. Regulatory agencies

are

charged

with

ensuring

the

and

are

compliant

with

the

intent

of

the

set

forth

by

the

Federal

Institutions

Examination

Council

(“FFIEC”).

The

FFIEC

framework offers a set of guidelines

and best practices to help

financial institutions manage and mitigate cybersecurity risks

effectively.

It focuses on ensuring the confidentiality,

integrity, and availability

of sensitive information and systems.

The Information

Security Officer

(“ISO”) is

an integral

member of

the Risk

Management and

Compliance Department

(“RMCD”) of

and who

provides expert

counsel on

matters of

cybersecurity and

presents periodic

reports to

the

Risk Committee of our Board of Directors.

As part

of the

program, periodic

risk assessments

are performed

inherent and

residual

cybersecurity risk, the

maturity level of the program,

the risk of cyber

threats, and the effectiveness

of controls currently

in

practice. The

Company utilizes

the National

Institute of

Standards and

Technology

(“NIST”) Framework

and the

FFIEC’s

Assessment

Tool

Assessment”)

to

help

its

risks

and

the

Company’s cybersecurity posture.

Through the

implementation

of rigorous procedures

and controls, augmented

by ongoing

training initiatives for both management and staff, the institution cultivates a safe cybersecurity environment. This approach

diverse

methodologies

defense-in-depth

and

proactive

awareness

training

aimed

at

fortifying the institutions cybersecurity controls and fostering

a resilient operational framework.

Assessment and Response to Cybersecurity Threats

It is the policy of

the Company and its

technology service providers

(“TSPs”) to ensure that

they can identify,

mitigate,

and respond to cyber-attacks involving destructive

malware and invasive attacks such

as phishing, ransomware, malware,

DDoS

attacks,

etc.

This

commitment

aligns

with

the

risk

appetite,

Incident

Response

Policy,

and

Continuity Plan,

which incorporates

business continuity

planning and

testing activities

to enhance response

and recovery

capabilities.

The Company realizes that it faces a variety of risks from cyber-attacks involving destructive malware, including

liquidity,

capital, operational,

and reputation

risks, due

to events

such as

fraud, data

loss, and

disruption of

service. As

such, it

is the

policy of

to ensure

that its

risk management

processes, and

business continuity

planning address

these risks by:

●

Establishing

a

program

encompassing

and

to

administer

and

oversee

the

information/cybersecurity

to

ensure

adherence

to

and

best

practices.

●

Securely configuring systems and services to mitigate the impact of cyberattacks.

This includes measures such as

logical

network

segmentation,

hard

backups,

an

inventory

of

authorized

devices

and

software,

and

physical

segmentation

of

systems.

Consistency

in

system

configuration

fosters

a

secure

network

environment by removing or disabling unused applications, functions,

or components.

●

Implementing and testing

controls around critical

systems on a regular

basis to ensure appropriate

access control

and segregation of duties. Limits on sign-on attempts

for critical systems are enforced, with accounts

being locked

upon

exceedance.

Alert

systems

notify

of

control

changes

on

with

the

effectiveness and

adequacy of

controls periodically

tested and

the results

reported to

senior management

and, if

the

Risk

Committee,

along

with

recommended

risk

mitigation

strategies

and

progress

to

remediate

findings.

●

Performing security

monitoring, prevention,

and risk

mitigation activities

to ensure

the effectiveness

of protection

and detection systems.

This includes maintaining

up-to-date intrusion detection

systems, antivirus protection,

and

properly configured firewall

rules. Systems are

monitored to identify,

prevent, and contain

attack attempts from

all

sources.

●

Maintaining robust business

continuity planning processes

to swiftly

recover, resume, and maintain

operations post-

cyber-attack incidents

involving destructive

malware. These

processes encompass

data and business

recovery,

network

capability

rebuilding,

and

data

for

offline

backups

in

the

event

of

cyber-attacks

impacting the Company or its critical service providers.

●

Conducting ongoing

information security

risk assessments

new and

evolving threats

to online

deposit

and loan accounts. This involves identifying, prioritizing, and assessing risks to

critical systems, including threats to

applications controlling

various system parameters and implementing

necessary security prevention measures.

●

Reviewing, updating, and testing incident response and business

continuity plans annually to ensure effectiveness.

Testing

both

in-house

and

processor

scenarios

to

validate

understanding

of

responsibilities and adherence to Company protocols.

Executive Oversight and Roles

The

responsibility

for

adopting

and

an

program

is

assigned

to

the

RMCD,

who

collaborates

with

functional

area

departmental

level

managers,

and

other

relevant

staff.

committees and

the Board

of Directors

review reports submitted

by the

RMCD detailing the

Company’s inherent and

residual

cybersecurity risk, program sophistication level, and high-risk

threats identified in the cybersecurity risk assessment.

The

Board

oversees

the

and

maintenance

of

the

holding

accountable.

committees

ensure

program

integration

and

effectiveness,

with

the

RMCD

responsible

for

cybersecurity controls and procedures.

The Board receives regular

reports

on cybersecurity risk assessment

and program

updates,

and

to

and

holding

them

accountable

for

oversight

and

coordination, assignment of responsibility,

and the effectiveness of the information and cybersecurity

security program.

Annually, or as required, the RMCD

provides a comprehensive report

to the Board or

a designated committee regarding

the status

of

the

program

. This

report

assessments,

utilization

of

the

Assessment, discussion

of significant

program matters

such as

risk assessment,

risk management

decisions,

monitoring of

service provider

compliance, results

of key

controls testing,

security breaches

or violations,

responses, and recommendations for program enhancements.

Engagement with Third Party Vendors

The engagement

of third-party

involves potential

risks

impact

strategic, reputational,

transaction,

credit,

financial,

and

considerations.

Third-party

whose

involve

transmittal,

storage

and

processing

of

non-public

a

greater

level

of

risks,

specifically as

it relates

to compliance

requirements of the

Gramm Leach Bliley

Act (GLBA)

regulation and applicable

Privacy

Laws and Regulations.

The Bank has

developed general guidelines for

the identification, risk assessment, monitoring

and management of

risks

associated to the engagement of third-party providers

or vendors.

Certain

aspects

of

the

risk

process

may

require

the

involvement

of

the

officers, finance

officers,

internal auditors,

and legal

counsel to

identify potential

risks that

may arise

engagement as

well as

identify performance

criteria, internal

controls, reporting

any contractual

that should be implemented for the ongoing assessment and

control of risks that derive from the third-party

engagement.

Compliance with Regulatory Standards

Annual testing or

more frequently if

deemed necessary

of cybersecurity controls

and procedures will

be conducted

to

ensure compliance.

In instances

of identified

deficiencies or

vulnerabilities,

remedial action

plans will

be implemented

to

rectify issues or establish mitigating

controls. Any exceptions deemed significant will

be promptly reported, with remediation

efforts prioritized.

Annually,

or

as

required,

the

RMCD

will

provide

a

report

to

the

Board

or

a

committee

the

status

of

the

This

report

will

encompass

assessments,

utilization

of

the

Cybersecurity Assessment, and discussion of other significant

program matters.

As of the end of

the reporting period set

forth in this Annual

Report on Form 10-K,

there is no knowledge

or indication

that

sensitive

was

compromised

as

a

result

of

third-parties’

system

vulnerabilities.

continues to monitor developments and vendor communications.

The Company’s corporate

offices

are headquartered at

2301 N.W.

87th Avenue, Doral,

Florida 33172. The

through the Bank,

operates 10 banking

centers in South

Florida within Miami-Dade and

Broward counties. Of

the 10 banking

centers, nine of these locations are leased

and one is owned. The banking

center that is owned is located at

3999 Sheridan

St, Hollywood,

FL 33021.

Management believes

that each

of these locations

are in good

adequate to

meet

our present and foreseeable needs, subject to possible future

expansion.