Company: MMI
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001578732-25-000015
Chunk: 74

Company: Marcus & Millichap, Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1C
Chunk 74
---
 as well as the steps management has taken to respond to such risks. In such sessions, the audit committee generally receives materials indicating current and emerging material cybersecurity threat risks, and describing the company’s ability to mitigate those risks, and discusses such matters with our Chief Information Officer. Members of the audit committee regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer (“CIO”). The CIO has been responsible for cybersecurity for over ten years across multiple organizations, leading enterprise security programs, business continuity planning, cybersecurity response planning, and the implementation of the National Institute of Standards and Technology (NIST) cybersecurity framework. In the CIO's most recent role, the CIO established and led a dedicated Cybersecurity Department, developing comprehensive security strategies, implementing cutting-edge cybersecurity tools, and designing response plans to support the entire company. At our Company, the CIO continues to drive proactive risk management, regulatory compliance, and a culture of cybersecurity awareness.The firm’s senior executive team, inclusive of the CEO, CFO, COOs, CAO and CLO, are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.As discussed above, these members of management report to the audit committee about cybersecurity threat risks, among other cybersecurity related matters.