Company: MMI
Filing Date: 2025-03-19
Form Type: DEF 14A
Source: 0001193125-25-057887
Chunk: 25

Company: Marcus & Millichap, Inc.
Filing Date: 2025-03-19
Form: DEF 14A
Chunk 25
---
 posture, results from third-party assessments, progress towards pre-determinedrisk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives materials indicating current and emerging material cybersecurity threat risks, and describing the company’s ability to mitigate those risks, and discusses such matters with our Chief Information Officer. Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters. The Role of Management Our cybersecurity risk management and strategy processes are led by our Chief Information Officer, who is ultimately responsible for our information security program. This includes identifying threats, detecting potential attacks, and protecting all of our information assets. Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering

all company risks. As part of this process, appropriate disclosure personnel collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations. Additionally, we maintain a cybersecurity-specific risk assessment process which helps identify our cybersecurity threat risks. This process also aims to provide for the availability of critical data and systems, maintain regulatory compliance, identify and manage our risks from cybersecurity threats, and protect against, detect, and respond to cybersecurity incidents. This includes periodic comparison of our processes to standards set by the National Institute of Standards and Technology. As part of our information security program, we maintain an incident response plan which coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The firm’s senior executive team, inclusive of the CEO, CFO, COO, CAO and Legal, are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. Our Cybersecurity Oversight Structure

| The Board                 |
| Audit Committee           |
| Chief