Company: MMI
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001578732-25-000015
Chunk: 72

Company: Marcus & Millichap, Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1C
Chunk 72
---
Table of Contents

Item 1C. Cybersecurity

Cybersecurity Risk Management and Strategy

We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process, appropriate disclosure personnel collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. As part of this process, and our processes to provide for the availability of critical data and systems, maintain regulatory compliance, identify and manage our risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities, among others:•periodic comparison of our processes to standards set by the National Institute of Standards and Technology;•closely monitor emerging data protection laws and implement changes to our processes designed to comply;•undertake an annual review of our consumer-facing policies and statements related to cybersecurity;•conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats;•conduct annual cybersecurity training for all employees and contractors, along with targeted training on a quarterly basis for specific subsets of employees identified through our phishing simulations;•through policy, practice and contract (as applicable) require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care;•conduct regular network and endpoint monitoring and vulnerability assessments to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K;•carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident;•conduct vulnerability scans and leverage the scan results to continuously patch and manage our network as new threats emerge; and•constant active monitoring by our contracted Security Operations Center.Our incident response plan