Company: MMI
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001578732-25-000015
Chunk: 73

Company: Marcus & Millichap, Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1C
Chunk 73
---
 coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response team assesses the severity and priority of incidents on a rolling basis, with escalations of higher severity cybersecurity incidents provided to our management team. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response processes define the steps to disclose such a material cybersecurity incident.As part of the above processes, we regularly engage with assessors, consultants, auditors, and other third parties, including by regularly conducting technical and data reviews with our cybersecurity partners to help identify areas for continued focus, improvement and/or compliance.Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our broader overall risk assessment process, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.

25

Table of Contents

We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading “Item 1.A – Risk Factors – Technology and Cybersecurity Risks,” which disclosure is incorporated by reference herein.

Cybersecurity Governance

Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management.Our audit committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the audit committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments,