MARINEMAX INC

Management of material risks from cybersecurity threats isintegrated into the Company’s overall risk management processes and is monitored as an enterprise risk. The Company’s Board of Directors (the “Board”), with the input of management, oversees the Company’s internal controls and processes, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats.

Our comprehensive cybersecurity program includes, but is not limited to, standards and procedures for vulnerability management, user training, security assessments and testing, business continuity planning, encryption of sensitive data, physical security, user access controls, vendor risk management, teleworking, user device management and proactive systems, data and activity monitoring, and incident response. A limited scope of third-party service providers are involved in supporting our business and, where appropriate, we have established standards and procedures to ensure commercial best practices, audit, risk management, and strict contractual controls are in place and followed by such providers. Comprehensive contingency, recovery, and continuity plans are in place to ensure the ongoing provision of services to customers in the event of a cybersecurity incident.

Our Executive Vice President and Chief Digital Officer, (the “CDO”), Shawn C. Berg, is responsible for managing the Company’s cybersecurity risk and cybersecurity program. Shawn Berg has served as CDO since April 2019 overseeing the Company’s Technology, Marketing, and Digital Business operations. Mr. Berg was appointed as an executive officer of MarineMax by our Board in October 2022. He previously served as Vice President of Technology upon joining MarineMax in 2017. Mr. Berg has over 30 years of experience, including experience in multiple officer-level positions, in information technology and security.

Our Technology Group, in collaboration with the leading cybersecurity providers, monitors material cybersecurity and overall technology platform risks over time and updates the Company’s mitigation measures as appropriate. The Technology Group also regularly reports to the CDO and other key executives, as identified in the incident response plan, on the status of material risks, mitigation measures, and incidents related to such risks.

The CDO provides the Board with ongoing security updates, which include notable changes to program plans, changes to the risk environment, information regarding material incidents that may have occurred, reports on recent assessments of our security controls, and details regarding forward-looking plans and strategies to mitigate cyber risk. The Company has been subject to cybersecurity threats in the past. As of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

Notwithstanding our vigilant cybersecurity measures, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factor in Item 1A. Risk Factor in this report, titled “Increased cybersecurity requirements, threats and more sophisticated and targeted computer crime could pose a risk to our systems, networks, data and our third-party service providers. Our business operations could be negatively impacted by an outage or breach of our informational technology systems or a cybersecurity event”.