Contract analysis

I. Executive Summary This memorandum provides a systematic, precedent-based analysis of the National Security Agreement ("NSA") terms that HSAG should anticipate in connection with its proposed acquisition of VPI, a Delaware-incorporated gallium nitride ("GaN") semiconductor company. The acquisition, valued at approximately $1.42 billion on an enterprise basis, is currently under review by the Committee on Foreign In

II. Scope and Methodology A. Scope of Analysis This memorandum surveys twelve semiconductor-sector transactions that received CFIUS clearance subject to mitigation through a National Security Agreement between January 2019 and October 2023. The twelve transactions were selected based on their structural and substantive relevance to the HSAG/VPI transaction, as discussed further in Section II.C below. All twelve prece

1. Board Governance — including board composition, Security Board Member requirements, Government Security Committee structure, and independent Security Director provisions.

2. Technology Control Plans — including scope of controlled technology, information-sharing protocols, clean-team procedures, and carve-outs for commercial information.

3. Third-Party Compliance Monitors — including monitor selection, scope of monitoring, reporting frequency, cost allocation, and ad hoc audit provisions.

4. Cybersecurity Requirements — including baseline standards (NIST SP 800-171, CMMC), penetration testing, incident reporting, IT segregation, and cloud infrastructure restrictions.

5. Personnel and Continuity — including key personnel retention periods, Facility Security Officer requirements, and replacement approval procedures.

6. Facility Access Restrictions — including classified area access controls, visitor protocols, and unclassified area access procedures.

7. Penalty Provisions and Enforcement — including per-violation daily penalties, cure periods, injunctive relief, and mandated divestiture authority. In addition to these seven principal categories, we address several supplementary NSA terms observed in the precedent set, including pre-notification of material changes, data segregation requirements, NSA term and sunset provisions, annual compliance reporting, and coo

III. Overview of the 12 Precedent Transactions A. Summary Table of Precedent Transactions The following table provides a summary overview of the twelve precedent transactions analyzed in this memorandum. All company names have been fictionalized and anonymized in accordance with confidentiality constraints; transactions are referenced by precedent number only throughout this memorandum. Note: Enterprise values are ap

I. Precedent 8 — 2022 (Singaporean Acquiror / U.S. III-V Semiconductor Company) Precedent 8 involved the acquisition of a U.S.-based III-V compound semiconductor company by a Singaporean technology investment group. The transaction had an approximate enterprise value of $500 million. The target held a SECRET-level FCL, employed approximately 60 cleared personnel, manufactured ITAR-controlled defense articles, and hel

IV. Comparative Analysis by Mitigation Category A. Board Governance

1. Board Composition Trends Board governance is the foundational structural element of every semiconductor-sector NSA in the surveyed set. CFIUS's overriding concern is to ensure that decisions affecting classified programs, ITAR-controlled activities, and national security-sensitive operations remain under the control of U.S. persons with appropriate security clearances, while permitting the foreign acquiror to exer

2. Government Security Committee (GSC) The Government Security Committee is a sub-committee of the board composed exclusively of Security Board Members, with exclusive authority over the target's classified programs and national security-sensitive operations. The GSC functions as a firewall within the board governance structure, ensuring that the acquiror's designees have no decision-making authority (and typically n

3. Independent Security Director The independent Security Director is a relatively recent addition to the NSA toolkit, first appearing in the surveyed set in 2021 (Precedent 6) and appearing with increasing frequency in subsequent transactions. • Four of twelve precedents required an independent Security Director: Precedents 6 (2021), 10 (2022), 11 (2023), and 12 (2023). • The independent Security Director requiremen

4. Implications for HSAG/VPI VPI holds a SECRET-level FCL (CAGE Code 7VK92) and employs 212 cleared personnel, including two key personnel with TS/SCI clearances (Dr. Nathan Trevorrow, CEO, and Col. (Ret.) Bryce Hendrickson, VP Government Programs/FSO). The target's classified portfolio, ITAR-controlled defense articles, and significant cleared workforce place it squarely within the category of transactions that have

1. Scope and Structure The Technology Control Plan is the central instrument for preventing unauthorized transfers of controlled technology from the U.S. target to the foreign acquiror or other non-U.S. persons. TCPs establish detailed protocols governing the handling, storage, transmission, and access controls for controlled technical data and defense articles. Across all twelve precedent transactions: • A TCP was r

2. Information Sharing Protocols All TCPs establish procedures for permissible information sharing between the target and the acquiror for legitimate business purposes. The challenge in every NSA is to maintain the acquiror's ability to exercise commercially reasonable business oversight — including financial reporting, strategic planning, and operational management — while preventing unauthorized access to controlle

3. Implications for HSAG/VPI VPI's technology portfolio is extensive and varied, encompassing: • ITAR Category XI(a)(3) defense articles (GaN-based defense components). • EAR ECCN 3A001, 3A991, and 3E001 dual-use semiconductor components and related technology. • DDTC Registration No. M-24817 and three active DSP-5 export licenses. • Thirty-one registered trade secrets covering proprietary GaN-on-SiC epitaxial growth

1. Monitor Requirement The third-party compliance monitor serves as CFIUS's primary enforcement mechanism, conducting independent audits of the target's and acquiror's compliance with all NSA provisions. The monitor functions as the eyes and ears of the CFIUS monitoring agencies between formal government reviews. Across the twelve precedent transactions: • A third-party compliance monitor was required in all twelve t

2. Scope of Monitoring The scope of the monitor's activities varies across the surveyed set, generally correlating with the sensitivity of the target's national security profile: • Annual compliance audits were required in all twelve precedent transactions. The annual audit is the baseline monitoring activity and typically involves a multi-week on-site review of all NSA compliance areas. • Semi-annual or quarterly in

3. Cost Allocation Monitor fees represent a significant ongoing cost of NSA compliance and should be factored into HSAG's financial modeling for the transaction: • Monitor fees are borne by the acquiror in all twelve precedent transactions. There is no precedent in the surveyed set for cost-sharing with the target. • Annual fees ranged from approximately $800,000 (Precedent 1, 2019, the lowest in the set) to approxim

4. Implications for HSAG/VPI Based on VPI's profile — SECRET-level FCL, 212 cleared employees, fourteen active DoD contracts, extensive ITAR and EAR controls, and 31 registered trade secrets — we expect the CFIUS draft NSA to require a third-party compliance monitor with annual audit scope. Given that VPI's profile does not include TS/SCI programs at the institutional level (notwithstanding the TS/SCI clearances of i

1. Reporting Cadence: Negotiate for annual reporting (not semi-annual or quarterly). Annual reporting is the norm in nine of twelve precedents and is appropriate given VPI's profile.

2. Ad Hoc Audits: Resist unannounced ad hoc audits. Propose that any ad hoc audit be conducted with at least 48 hours' advance notice, allowing VPI to prepare appropriate access and support. This is consistent with the approach observed in several precedents and is a reasonable ask.

3. CPI Adjustment: Confirm CPI adjustment mechanism with a base year of 2024 (the expected year of closing). This protects HSAG against negotiation of a higher base fee in subsequent years.

4. Monitor Candidate: Propose Whitmore Compliance Group LLC as a candidate monitor. Gerald Whitmore, the firm's principal, is a former FBI Counterintelligence Division special agent with a TS/SCI clearance and over twenty years of experience in CFIUS compliance monitoring. Mr. Whitmore's firm has served as the third-party monitor in at least two prior semiconductor-sector NSAs known to counsel and has a strong reputa

1. Evolution of Standards (2019–2023) Cybersecurity has been one of the most rapidly evolving areas of CFIUS mitigation practice over the survey period. The trajectory is toward increasingly specific, prescriptive, and technically demanding requirements: • Pre-2021 (Precedents 1–4): The earliest transactions in the surveyed set included general cybersecurity requirements — obligations to maintain "reasonable" cyberse

2. Penetration Testing Third-party penetration testing has become a standard component of NSA cybersecurity requirement