Company: FSBC
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001275168-25-000038
Chunk: 101

Company: FIVE STAR BANCORP
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 101
---
,” or “Green” identifies next steps for escalation and communication following initial investigation of the potential incident. Upon escalation of an incident, a member of management who is identified as an Incident Response Contact per our Information Security Program reviews and validates the initial determination of the priority of the incident prior to entering into the subsequent stage, during which a response to the incident is determined and notifications or communications are made to either additional personnel or any external entities. Depending on the specific details of any such incident, we may notify additional members of our management team, our board of directors, the Audit Committee, state and federal regulators, technology service providers, and/or the SEC. The timing of such communications varies based on the details of a particular incident and applicable regulations governing such disclosure. Following this classification and communication stage, we enter the recovery stage to determine containment and a response to the incident, assign technical staff to address such incident, implement containment, eradicate the incident source, and recover from such incident. Following any such incident, we engage in follow-up to communicate with law enforcement and notify impacted third parties and customers, as appropriate, in addition to further investigating the cause of the incident, documenting takeaways, and engaging in remediation.

Our Director of Information Security (“DIS”) coordinates with other members of our executive management team identified in our Information Security Program to document, validate, respond to, and manage actual or potential security incidents according to their threat classifications as described above, and report to our board of directors and/or the Audit Committee on an ad hoc basis. The DIS also provides quarterly reports on the status of our Information Security Program and its compliance with regulatory requirements to our board of directors in connection with our board’s general risk management oversight role, as described in further detail below. The DIS and the Chief Information Officer (“CIO”) have shared responsibility for overseeing day-to-day operations of the Information Security Program; coordinating or contributing to reviews, audits, risk assessments, and other risk management material; development of departmental policies and procedures for board approval; and periodic updates to our information technology steering committee and/or the full board of directors. The CIO reports to the President and Chief Executive Officer, while the DIS reports to the Chief Regulatory Officer and reports regularly to the Audit Committee.The CIO has 20 years of industry experience including management of technology, security, data analytics, and vendor relationships. The DIS has over 10 years of industry experience and 25 years of information security experience focusing on management of security and vendor relationships. The DIS also possesses several industry certifications, including certification as