Company: FSBC
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001275168-25-000038
Chunk: 102

Company: FIVE STAR BANCORP
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 102
---
 a Certified in Risk and Information Systems Control and Certified Information Security Manager from the Information System Audit and Control Association.With the approval of the Audit Committee, we also engage third-party assessors, consultants, and auditors in connection with the Company’s Information Security Program and in accordance with our Audit Program, including to conduct external and internal penetration testing, independent audits, and risk assessments. We may also utilize third-party service providers in the ordinary course of business, including to assist us in performing information security assessments for third-party service providers that store or process our confidential data. These information security assessments, whether performed by a third party or internally, include a review of any systems and organization control reports, and proof of the vendor’s independent testing of their data protection controls, as well as a review of any exceptions noted and assessment of management responses, results of vulnerability and penetration testing, incident response processes, and third-party data protection controls (which can include, but are not limited to: access reviews and controls, backups, monitoring, encryption standards, and disaster recovery). The review of these areas is taken into account in order to provide an overall information security conclusion and risk rating for the vendor.

41

In addition, we use a combination of technology, policies, procedures, training, and monitoring to promote security awareness and prevent security incidents.

Cybersecurity Risk OversightOur executive management team is responsible for the development of our policies and procedures and for managing any exception to the same. In particular, our DIS oversees information security compliance, as described above. The board of directors of the Company has ultimate oversight of cybersecurity-related risk and activities, including the review and approval of our policies and procedures related to cybersecurity. The Information Security Program is approved on an annual basis. Cybersecurity risk management is also incorporated into our overall enterprise risk management model, which is updated on a quarterly basis and subject to oversight by our board of directors.

In the ordinary course of business, our board of directors receives quarterly updates from the DIS regarding the Information Security Program and compliance with relevant regulations, as described above. Members of the Audit Committee of our board of directors receive presentations as well as minutes of the meetings of our information technology steering committee on a quarterly basis. Our information technology steering committee consists of members of our board of directors who have relevant experience from their audit and management experience as well as training provided by our management. If an incident occurs, depending on its priority as identified through the procedures described above, management may inform our board of directors and/or the Audit Committee sooner than its next quarterly update. See the