USCB FINANCIAL HOLDINGS, INC.

Risk Management and Strategy Overview

Customers depend

on the

safeguard

nonpublic personal

gathered and

stored in

services we

provide. The

Company understands

that cyber

incidents can

have financial,

reputational, legal,

and

operational impacts

that can

capital, and

earnings. Therefore,

we integrate

processes throughout the

Company as part of

our enterprise-wide governance

process. Regulatory agencies

are charged

with

ensuring

the

and

are

compliant

with

the

intent

of

the

expectations set forth

by the Federal

Financial Institutions

Examination Council

(“FFIEC”). The

FFIEC framework

offers a

set

of

and

best

to

help

manage

and

risks

effectively.

It

focuses on ensuring the confidentiality,

integrity, and availability

of sensitive information and systems.

The Information

Security Officer

(“ISO”) is

an integral

member of

the Risk

Management and

Compliance Department

(“RMCD”) of

and provides

expert counsel

on matters

of cybersecurity

and presents

periodic reports

to the

Risk

Committee of our Board of Directors.

As part

of the

program, periodic

risk assessments

are performed

inherent and

residual

cybersecurity risk, the

maturity level of the program,

the risk of cyber

threats, and the effectiveness

of controls currently

in

practice. The Company utilizes the National Institute of Standards and

Technology

(“NIST”) Framework and the Cyber Risk

Institute Framework (“CRI

Framework”) to help

management identify its

risks and determine

posture.

Through

the

implementation

of rigorous

and controls,

augmented

by ongoing

for

both management and

staff, the institution

cultivates a safe

cybersecurity environment. This

approach encompasses diverse

methodologies

defense-in-depth

and

proactive

awareness

aimed

at

fortifying

the

institutions’

cybersecurity controls and fostering a resilient operational

Assessment and Response to Cybersecurity Threats

It is the policy of

the Company and its

technology service providers

(“TSPs”) to ensure that

they can identify,

mitigate,

and respond to cyber-attacks involving destructive

malware and invasive attacks such

as phishing, ransomware, malware,

DDoS

attacks,

etc.

This

commitment

aligns

with

the

risk

appetite,

Incident

Response

Policy,

and

Continuity Plan,

which incorporates

business continuity

planning and

testing activities

to enhance response

and recovery

capabilities.

The Company recognizes that it faces a variety of risks from cyber-attacks involving destructive malware, including

liquidity, capital, operational, and

reputation risks, due

to events such

as fraud, data

loss, and disruption

of customer

service.

As such,

it is

the policy

of the

its risk

management processes,

continuity planning

address these risks by:

●

Establishing

a

program

encompassing

and

to

administer

and

oversee

the

information/cybersecurity

to

ensure

adherence

to

guidance

and

best

practices.

●

Securely configuring systems and services to mitigate the impact of cyber-threats. This includes measures such as

logical network segmentation, backups, maintaining an inventory

of authorized devices and software, and physical

segmentation

of

systems.

Consistency

in

system

configuration

fosters

a

secure

network

environment

by

removing or disabling unused applications, functions, or components.

●

Implementing and testing

controls around critical

systems on a regular

basis to ensure appropriate

access control

and segregation of duties. Limits on sign-on attempts

for critical systems are enforced, with accounts

being locked

when

the

threshold

are

met.

Alert

systems

notify

of

control

changes

on

with

the

effectiveness and

adequacy of

controls periodically

tested and

the results

reported to

senior management

and, if

the

Risk

Committee,

along

with

recommended

risk

mitigation

strategies

and

the

progress

of

actions

taken to remediate findings.

●

Performing security

monitoring, prevention,

and risk

mitigation activities

to ensure

the effectiveness

of protection

and detection systems.

This includes maintaining

up-to-date intrusion detection

systems, antivirus protection,

and

properly configured

firewall

rules. Systems

are monitored

to

identify,

prevent,

and contain

cyber-attack

attempts

from all sources.

●

Maintaining robust business

continuity planning processes

to swiftly

recover, resume, and maintain

operations post-

cyber-attack incidents

involving destructive

malware. These

processes encompass

data and business

recovery,

network

capability

rebuilding,

and

data

for

offline

backups

in

the

event

of

cyber-attacks

impacting the Company and/or its critical service providers.

●

Conducting ongoing

information security

risk assessments

to address

new and

evolving threats

to online

deposit

and loan accounts. This involves identifying, prioritizing, and assessing risks to

critical systems, including threats to

applications controlling

various system parameters and implementing

necessary security prevention measures.

●

Reviewing, updating, and testing incident response and business

continuity plans annually to ensure effectiveness.

Testing

encompasses

both

in-house

and

processor

scenarios

to

validate

understanding

of

responsibilities and adherence to Company protocols.

Executive Oversight and Roles

The

responsibility

for

adopting

and

an

program

is

assigned

to

the

RMCD,

who

collaborates

with

functional

area

departmental

level

managers,

and

other

relevant

staff.

committees and

the Audit

and Risk

Committee of

(“ARC”) review

reports submitted

by the

RMCD detailing

the

inherent

and

residual

risk,

program

sophistication

level,

and

high-risk

threats

in

the

cybersecurity risk assessment.

The

ARC

oversees

the

and

maintenance

of

the

program,

holding

accountable.

committees

ensure

program

integration

and

effectiveness,

with

the

RMCD

responsible

for

cybersecurity controls

and procedures.

The ARC

receives regular

reports

on cybersecurity

risk assessment

and program

updates,

and

to

and

holding

them

accountable

for

oversight

and

coordination, assignment of responsibility,

and the effectiveness of the information and cybersecurity

security program.

Annually,

or

as

required,

the

RMCD

a

report

to

the

Board

the

status

of

the

program

.

This

report

encompasses

assessments,

of

the

Assessment,

discussion of

significant program

matters such

as the

annual risk

assessment, risk

management decisions,

monitoring of

service provider compliance, results of key controls testing, security breaches

or violations, management's responses, and

recommendations for program enhancements.

Engagement with Third Party Vendors

The engagement of critical third-party providers introduces a range of

potential risks that can affect the Bank’s strategic

direction, reputation, daily

operations, transaction integrity,

credit exposures, financial

stability,

technological environment,

and compliance posture. Providers whose services include the transmission, storage, or processing

of non-public personal

present heightened

compliance risks,

particularly

with respect

to the

of the

GLB

Act and

other

applicable Privacy Laws and Regulations.

The

Bank

has

general

to

support

the

identification,

risk

assessment,

monitoring,

and

management of risks related

to the engagement of

third-party providers or vendors.

This framework ensures that risks

are

addressed proactively and in accordance with regulatory

expectations.

Risk assessment for

critical providers may

require the involvement

of specialized personnel,

including the compliance

officer, technology officers, finance officers,

internal auditors, and

legal counsel. Their

participation is essential

for identifying

potential risks arising

from third-party relationships,

defining performance criteria,

establishing internal controls,

specifying

reporting requirements, and ensuring

contractual obligations are in

place for ongoing risk assessment

and mitigation. This

collaborative approach helps maintain the integrity and security of the

Bank’s operations while meeting regulatory and legal

standards.

Compliance with Regulatory Standards

As noted above, annual testing, or more frequently

if deemed necessary,

of cybersecurity controls and procedures

will

be conducted

to ensure

compliance. In

instances of

identified deficiencies

or vulnerabilities,

remedial action

plans will

be

implemented to rectify issues or establish mitigating controls. Any exceptions

deemed significant will be promptly reported,

with remediation efforts prioritized.

Annually,

or

as

required,

the

RMCD

will

provide

a

report

to

the

ARC

or

a

committee

the

status

of

the

This

report

will

encompass

assessments,

of

the

Cybersecurity Assessment, and discussion of other significant

program matters.

As of the end of

the reporting period set

forth in this Annual

Report on Form 10-K,

there is no knowledge

or indication

that

was

compromised

as

a

result

of

third-parties’

system

vulnerabilities.

continues to monitor developments and vendor communications.

The Company’s corporate

offices

are headquartered at

2301 N.W.

87th Avenue, Doral,

Florida 33172. The

through the Bank,

operates 10 banking

centers in South

Florida within Miami-Dade and

Broward counties. Of

the 10 banking

centers, nine of these locations are leased

and one is owned. The banking

center that is owned is located at

3999 Sheridan

St, Hollywood,

FL 33021.

Management believes

that each

of these locations

are in good

condition and

adequate to

meet

our present and foreseeable needs, subject to possible future

expansion.