Company: FSBC
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001275168-25-000038
Chunk: 95

Company: FIVE STAR BANCORP
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 95
---
, and have an ongoing impact on the security and stability of our operations. In addition, although we maintain insurance coverage that may, subject to terms and conditions, cover certain aspects of cyber and information security risks, such insurance coverage may be insufficient to cover all losses, such as litigation costs or financial losses that exceed our policy limits or are not covered under any of our current insurance policies.

Information security risks for financial institutions like us have increased recently in part because of new technologies, the use of the internet, cloud, and telecommunications technologies (including mobile devices) to conduct financial and other business transactions, and the increased sophistication and activities of organized crime, perpetrators of fraud, hackers, terrorists, and others. Additionally, like many large enterprises, we have introduced more remote work arrangements for our employees. The increase in remote work arrangements over the past few years has introduced potential new vulnerabilities to cyber threats. We also face increased cybersecurity risk as we deploy additional technologies and digital solutions, including our website and digital banking platform with complementary treasury management solutions. Moreover, any cyber-attack or other security breach may persist for an extended period of time without detection. We endeavor to design and implement policies and procedures to identify such cyber-attacks or breaches as quickly as possible; however, we expect that any investigation of a cyber-attack or breach would take substantial amounts of time, and that there may be extensive delays before we obtain full and reliable information. During such time we would not necessarily know the extent of the harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, all of which would further increase the costs and consequences of such an attack or breach.

In addition to cyber-attacks or other security breaches involving the theft of sensitive and confidential information, hackers recently have engaged in attacks against large financial institutions that are designed to disrupt key business services, such as consumer-facing web sites. We are not able to anticipate or implement effective preventive measures against all security breaches of these types, especially because the techniques used change frequently and because attacks can originate from a wide variety of sources. Our early detection and response mechanisms may be thwarted by sophisticated attacks and malware designed to avoid detection.

38

Banking organizations are required to notify their primary federal regulator of significant computer security incidents within 36 hours of determining that such an incident has occurred. Failure to comply with this requirement in the event of such an incident could result in sanctions by regulatory agencies, civil money penalties, and/or damage to our reputation, all of which could have