Company: AVNI
Filing Date: 2025-08-15
Form Type: 10-Q
Source: 0001713282-25-000654
Chunk: 23

Company: ARVANA INC
Filing Date: 2025-08-15
Form: 10-Q
Item: Item 5
Chunk 23
---

ITEM 5.      OTHER   
          INFORMATION
---------------------
Disclosure Regarding Rule 10b5-1 and non-Rule 10b5-1 Trading Arrangements
 
During the three months ended June 30, 2025, no director or officer, as defined in Rule 16a-1(f) under the Securities Exchange Act of 1934 (as amended), of the Company has adopted or terminated a “Rule 10b5-1 trading arrangement” or “non-Rule 10b5-1 trading arrangement” as each term is defined in Item 408(a) of Regulation S-K.
 
27

CYBERSECURITY
 
Risk Management and Strategy for Handling Sensitive Data
 
The Company is committed to maintaining the integrity and security of sensitive data collected, maintained, or transmitted across its systems. In the ordinary course of business, the Company and its third-party service providers—such as charter booking platforms—handle sensitive information, including confidential business data and personal information. Protecting this data is critical to its operations and reputation.
 
The Company employs administrative, technical, and physical safeguards to mitigate cybersecurity risks. However, its risk management strategy has certain limitations due to factors such as the evolving nature of cyber threats, resource constraints, and the inherent vulnerabilities associated with the technologies used by both the Company and its third-party service providers. The Company relies on cloud service providers, consultants, and other vendors for core business functions. These providers may have access to sensitive data or information systems, and management oversees them through vendor diligence processes. Vendors are generally assessed for cybersecurity risk based on the type of service provided, level of access, and related supply chain exposure.
 
While the Company has adopted a cybersecurity governance framework designed to identify, assess, and manage material risks from cybersecurity threats, the Company acknowledges that its current risk management strategy may not fully mitigate all potential risks posed by emerging technologies or sophisticated threat actors. A cybersecurity incident could result in reputational damage, regulatory liability, financial loss, and disruption of business operations.
 
The Company has not, to date, experienced any cybersecurity incidents. However, there is no guarantee that its systems—or those of its third-party vendors—will remain unaffected by future attacks or breaches.
 

Governance of Cybersecurity Issues
 
The Company has implemented a cybersecurity governance framework under which management is responsible for identifying, assessing, and managing material cybersecurity risks. The Company has not engaged any third-party cybersecurity consultants, nor does it currently have personnel with specialized cybersecurity expertise.
 
Under the governance framework, any