Contract analysis

I. INTRODUCTION AND PURPOSE This Supplemental Exhibit is submitted on behalf of Halcyon Semiconductor Aktiengesellschaft ("HSAG") in response to the Committee on Foreign Investment in the United States ("CFIUS" or the "Committee") first Request for Information ("RFI") dated August 4, 2023, received by counsel for HSAG on August 7, 2023, in connection with the Committee's review of CFIUS Case No. CFIUS-023-07-3841. HS

II. HSAG ENTERPRISE CYBERSECURITY GOVERNANCE STRUCTURE A. Board and Executive Oversight HSAG recognizes that effective cybersecurity begins with governance at the highest levels of the organization. Accordingly, HSAG has established a multi-tiered governance framework that ensures cybersecurity risk is treated as a strategic enterprise risk, subject to direct oversight by HSAG's most senior leaders. The HSAG Vorstand

1. Information Security Policy: The overarching policy document that establishes HSAG's commitment to information security, defines the scope and objectives of the ISMS, and assigns roles and responsibilities for information security across the organization.

2. Acceptable Use Policy: Defines the permissible and prohibited uses of HSAG's information technology resources, including computing equipment, networks, email, internet access, and removable media.

3. Data Classification Policy: Establishes the framework for classifying information assets based on their sensitivity and the level of protection required. HSAG's current classification framework comprises four tiers: Public, Internal, Confidential, and Strictly Confidential.

4. Access Control Policy: Defines the requirements for controlling access to HSAG information systems and data, including authentication requirements, authorization principles, role-based access control, and the principles of least privilege and need-to-know.

5. Incident Response Policy: Establishes the framework for detecting, reporting, assessing, responding to, and recovering from cybersecurity incidents, and defines the roles and responsibilities of the Incident Response Team.

6. Business Continuity and Disaster Recovery Policy: Defines the requirements for maintaining business continuity and recovering critical IT systems and data in the event of a disruption, including natural disasters, cyberattacks, and infrastructure failures.

7. Third-Party Risk Management Policy: Establishes the requirements for assessing, managing, and monitoring the cybersecurity risks associated with third-party vendors, suppliers, and service providers that have access to HSAG information systems or data.

8. Cryptographic Standards Policy: Defines the approved cryptographic algorithms, key lengths, and key management practices for the protection of HSAG data at rest and in transit. All policies within the ISMS are subject to a formal annual review and update cycle. The review process is led by the Information Security Division's Governance, Risk, and Compliance (GRC) team, with input from relevant stakeholders across

III. ISO 27001 CERTIFICATION A. Scope and Certification History HSAG's commitment to information security is independently validated through its certification to ISO/IEC 27001:2013, the internationally recognized standard for Information Security Management Systems. HSAG first achieved ISO 27001 certification in 2017, following a comprehensive implementation effort that began in 2015. Since initial certification, HSA

IV. TECHNICAL CYBERSECURITY CONTROLS A. Network Security Architecture HSAG has implemented a multi-layered, defense-in-depth network security architecture across all of its global facilities. This architecture is designed to provide multiple, overlapping layers of protection so that the compromise of any single control does not result in a complete security failure. The defense-in-depth approach reflects industry bes

V. DATA PROTECTION AND PRIVACY COMPLIANCE A. EU General Data Protection Regulation (GDPR) As a company headquartered in the European Union and conducting substantial business operations within the EU and the European Economic Area (EEA), HSAG is subject to, and maintains full compliance with, the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR"). HSAG treats data protection and privacy as f

VI. INCIDENT RESPONSE AND BUSINESS CONTINUITY A. Cybersecurity Incident Response Plan (CSIRP) HSAG maintains a formal Cybersecurity Incident Response Plan ("CSIRP") that defines the processes, procedures, roles, responsibilities, escalation pathways, and communication protocols for responding to cybersecurity incidents across the enterprise. The CSIRP is designed to enable HSAG to detect, contain, eradicate, and reco

VII. PLANNED POST-CLOSING VPI IT SYSTEM SEGREGATION A. Segregation Principles and Objectives HSAG recognizes that the protection of VPI's classified information, Controlled Unclassified Information (CUI), ITAR/EAR-controlled technical data, and other sensitive unclassified information is of paramount importance to the U.S. government and is essential to the successful completion and ongoing implementation of the anti

1. Protect classified and Controlled Unclassified Information (CUI) within VPI systems from unauthorized access, disclosure, or exfiltration, consistent with the requirements of the National Industrial Security Program Operating Manual ("NISPOM," 32 C.F.R. Part 117), NIST SP 800-171, and applicable contract security requirements;

2. Prevent unauthorized access by non-U.S. persons — including HSAG personnel located in Germany, other European countries, Asia, or any non-U.S. location — to ITAR-controlled technical data (22 C.F.R. Parts 120–130) and EAR-controlled technical data (15 C.F.R. Parts 730–774) maintained within VPI systems, consistent with U.S. export control requirements;

3. Comply with all requirements of the anticipated National Security Agreement, including provisions related to IT segregation, a Technology Control Plan ("TCP"), Government Security Committee oversight, and NIST SP 800-171 compliance; and

4. Maintain VPI's Facility Security Clearance at the SECRET level (CAGE Code: 7VK92) under the oversight of the Defense Counterintelligence and Security Agency (DCSA), and ensure that VPI's classified processing capabilities at the Albuquerque facility remain fully operational and compliant with NISPOM requirements. The segregation measures described in this Section VII apply to all VPI locations, including: • VPI co