Contract analysis

1. Summary of Negotiation Sessions A. First Session — November 9, 2023 The first in-person negotiation session was held at the U.S. Department of the Treasury, Office of Investment Security, in Washington, D.C. The session lasted approximately four hours and was constructive in tone and substance. Participants. On the CFIUS side, the session was attended by representatives from the Department of the Treasury (acting

2. Areas of Significant Progress We are pleased to report that meaningful progress has been achieved across several of the most structurally important components of the NSA. The following areas reflect either substantial agreement or strong conceptual alignment between the parties. A. Board Governance and Government Security Committee (GSC) Substantial agreement has been reached on the core architecture of VPI's post

3. Outstanding Issues Requiring Further Negotiation Notwithstanding the progress described above, several important issues remain unresolved and will require further negotiation. We address each in turn, together with our assessment of the parties' respective positions and our recommended approach. A. Third-Party Compliance Monitor — Scope and Selection The role, authority, and selection of the third-party compliance

4. Coordination with Wethersfield & Gale (VPI/Sellers' Counsel) Harrison Whitfield of Wethersfield & Gale LLP participated in both negotiation sessions in his capacity as VPI's counsel. Given the joint notice posture — in which both HSAG and VPI are parties to the CFIUS filing — W&G's participation in the NSA negotiations is appropriate and, in our experience, has been beneficial to the process. W&G has been cooperat

5. Impact on Transaction Timeline The NSA negotiations have direct implications for the Transaction timeline, given that CFIUS clearance is a condition to closing under the SPA. SPA Closing Condition. Section 7.1(c) of the SPA requires CFIUS clearance as a condition to closing. Under the SPA, "CFIUS clearance" is defined to include either unconditional clearance (i.e., CFIUS determines that there are no unresolved na

6. Next Steps and Recommended Actions A. Immediate Actions We propose the following immediate actions:

1. Second Buyer's Redline. Calderwood & Harkness will prepare the second buyer's redline of the NSA, incorporating the positions discussed at the November 9 and November 13 sessions, as well as the recommendations set forth in this letter. We intend to circulate a draft of the second redline to you and Prof. Dr. Schilling's team for review before submitting it to CFIUS, and we anticipate submission to CFIUS prior to

2. Monitor Due Diligence. Peggy Ashworth and David Caruso will conduct due diligence on Whitmore Compliance Group LLC as the proposed third-party monitor, including a review of WCG's qualifications, personnel, prior CFIUS monitor engagements, and any potential conflicts of interest. We will report our findings to you as soon as they are available.

3. HSAG Internal Assessment — Cybersecurity and Data Segregation. We request that HSAG prepare an internal assessment of the operational and budgetary impact of the proposed cybersecurity and data segregation requirements, including an evaluation of the feasibility of full IT system separation versus the tiered approach proposed by HSAG. We recommend that this assessment be coordinated with HSAG's CIO and CISO, as th

1. Monitor Cost Range. Please confirm HSAG's position on the acceptable annual cost range for the third-party compliance monitor. The current benchmark suggested by CFIUS staff is approximately $1.2 million per year. We would appreciate guidance on HSAG's maximum acceptable annual fee and any conditions or limitations HSAG wishes to impose (e.g., CPI-only escalation, annual cap, scope-based fee adjustments).

2. Cybersecurity Incident Reporting Timeline. Please confirm HSAG's degree of flexibility on the cybersecurity incident reporting timeline. CFIUS's draft requires 24-hour reporting; HSAG's counterproposal requested 72 hours. If HSAG is willing to accept a compromise position (e.g., 48 hours, or 24 hours for confirmed incidents involving classified or CUI data with 72 hours for all other incidents), we would like to k

3. Data Segregation Feasibility Assessment. Please provide HSAG's IT team assessment of data segregation feasibility, including identification of any shared business platforms that HSAG considers essential for the management of VPI, and any proposed carve-outs for non-sensitive systems that we should incorporate into the second buyer's redline.

4. Monitor Due Diligence Authorization. Please confirm HSAG's authorization for our team to proceed with due diligence on Whitmore Compliance Group LLC as the proposed third-party compliance monitor.

5. Third Security Board Member Candidate. Please identify and provide credentials for HSAG's proposed candidate for the third Security Board Member position (independent Security Director). This individual must be a U.S. citizen who holds or is eligible for a TS/SCI security clearance and who is independent of both VPI and HSAG. The candidate's résumé, clearance history, and any relevant biographical information shou

7. Fee and Budget Status We provide the following brief update on fees incurred to date against the agreed CFIUS engagement fee cap. The total fee cap for Calderwood & Harkness's CFIUS engagement is $3.8 million, exclusive of disbursements. Fees have been structured and budgeted across the following phases: Fees incurred in the NSA Negotiation phase remain within the budgeted allocation. We estimate that the total re

8. Closing Observations We are encouraged by the trajectory of the NSA negotiations to date. While several important and complex issues remain open — particularly the scope and authority of the third-party compliance monitor, the penalty and enforcement provisions, and the cybersecurity and data segregation requirements — the areas of substantial agreement achieved on board governance, the TCP framework, personnel co