Company: FSBC
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001275168-25-000038
Chunk: 94

Company: FIVE STAR BANCORP
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 94
---
 or other disruptions. While we seek to continuously monitor for and react to any and all such malicious cyber activity and develop our systems to protect our technology infrastructure and data, such monitoring and systems development may not be effective in preventing misuse, misappropriation, or corruption. In the ordinary course of business, our board of directors receives quarterly cybersecurity risk management updates and members of the Audit Committee of our board of directors also attend the meetings of our information technology steering committee on a quarterly basis. Cybersecurity risk management is incorporated into our overall enterprise risk management model, which is updated on a quarterly basis and subject to oversight by our board of directors.

In the normal course of business, we collect, process, and retain sensitive and confidential information regarding our customers. Although we devote significant resources, oversight by our board of directors, and management focus to ensuring the integrity of our systems through information security and business continuity programs, our facilities and systems, and those of our third-party service providers, are vulnerable to external or internal security breaches, acts of vandalism, computer viruses, malware, misplaced or lost data, programming or human errors, or other similar events. We and our third-party service providers have experienced these types of events in the past and expect to continue to experience them in the future. These events could interrupt our business or operations or result in significant legal and financial exposure (including costs associated with remediating any security breaches), supervisory liability, regulatory enforcement action, damage to our reputation, loss of customers and business, or a loss of confidence in the security of our systems, products, and services. Although the impact to date from these events has not had an adverse effect on us, we cannot be sure this will be the case in the future. Any of these occurrences could have an adverse effect on our business, financial condition, and results of operations. We are not able to anticipate or implement effective preventive measures against all security breaches of these types, especially because attacks are increasingly sophisticated, change frequently, often are not recognized until launched, and can originate from a wide variety of sources. Our early detection and response mechanisms could fail to detect, mitigate, or remediate these risks in a timely manner. Despite our implementation of protective measures and endeavoring to modify them as circumstances warrant, our computer systems, software, and networks may be vulnerable to human error, equipment failure, natural disasters, power loss, unauthorized access, supply chain attacks, distributed denial of service attacks, computer viruses and other malicious code, and other events that could result in significant liability and damage to our reputation