PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT

PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT
MEMORANDUM
October 25, 2023
To: Beatrice Holloway, Responsible Partner, M&A Margaret "Peggy" Ashworth, Of Counsel, National Security & CFIUS
From: Lt. Col. (Ret.) David Caruso, Senior Counsel, Government Contracts & Export Controls Priya Venkataraman, Associate, International Trade & Sanctions
Re: Comparative Analysis of Recent Semiconductor-Sector National Security Agreements (2019–2023) — Benchmarking for NSA Negotiation in CFIUS Case No. CFIUS-023-07-3841 (Halcyon Semiconductor AG / Marlowe Asset Management Photonics Inc.)
Client: Halcyon Semiconductor Aktiengesellschaft ("HSAG")
Matter: Acquisition of Marlowe Asset Management Photonics Inc. ("VPI")
Calderwood & Harkness LLP Washington, DC Office 1750 K Street NW, Suite 800 Washington, DC 20006
Right-click to update Table of Contents
I. Executive Summary
This memorandum provides a systematic, precedent-based analysis of the National Security Agreement ("NSA") terms that HSAG should anticipate in connection with its proposed acquisition of VPI, a Delaware-incorporated gallium nitride ("GaN") semiconductor company. The acquisition, valued at approximately $1.42 billion on an enterprise basis, is currently under review by the Committee on Foreign Investment in the United States ("CFIUS") under Case No. CFIUS-023-07-3841. VPI is a holder of classified Department of Defense ("DoD") contracts (CAGE Code 7VK92, SECRET-level Facility Clearance ("FCL")), manufactures defense articles controlled under International Traffic in Arms Regulations ("ITAR") Category XI(a)(3), and produces dual-use semiconductor components classified under Export Administration Regulations ("EAR") Export Control Classification Number ("ECCN") 3A001. VPI currently employs approximately 212 personnel with active security clearances and holds 47 U.S. patents, 23 of which were funded in whole or in part by the U.S. government.
On October 20, 2023, CFIUS communicated to the parties four preliminary national security concerns arising from the proposed transaction. Based on our analysis of CFIUS practice and the trajectory of the current review, we anticipate that CFIUS will circulate an initial draft NSA in early November 2023. This memorandum is intended to inform HSAG's negotiation strategy by establishing a comprehensive factual and analytical baseline drawn from comparable precedent transactions.
To develop this baseline, we have surveyed twelve publicly available or industry-reported NSAs arising from semiconductor-sector transactions that received CFIUS clearance subject to mitigation between 2019 and 2023. Our sources include CFIUS annual reports to Congress, publicly available proxy statements and SEC filings, FOIA-released summaries, industry publications (including Semiconductor Industry Association white papers and trade press), and the professional experience of Ashworth and Caruso with prior CFIUS matters. Each precedent transaction involved a foreign acquiror from an allied nation acquiring a U.S. semiconductor company with some combination of defense contracts, export-controlled products, classified programs, or critical technology designations.
Our key findings are as follows:
(a) Board Governance. Board governance provisions requiring U.S.-citizen Security Board Members with active or eligible security clearances are universal in semiconductor-sector transactions involving classified programs. The standard board structure for transactions comparable to HSAG/VPI consists of five members, with three Security Board Members and two acquiror designees.
(b) Technology Control Plans. Technology Control Plans ("TCPs") are standard in every surveyed transaction involving ITAR- or EAR-controlled technology. TCPs have expanded in scope since 2021 to encompass not only export-controlled items but also proprietary trade secrets and know-how.
(c) Third-Party Compliance Monitors. Third-party compliance monitors have been required in all twelve precedent transactions. Annual monitor costs have ranged from approximately $800,000 to $2.5 million, with the median across the surveyed set at approximately $1.1 million per year. Monitor selection requires CFIUS approval in all cases.
(d) Cybersecurity Requirements. Cybersecurity requirements have tightened significantly since 2021. NIST Special Publication 800-171 ("NIST SP 800-171") is now the minimum baseline standard in all post-2020 NSAs. Some 2022–2023 NSAs additionally reference Cybersecurity Maturity Model Certification ("CMMC") Level 2 as a forward-looking requirement. Incident reporting obligations (72 or 48 hours) and mandatory IT segregation are now standard.
(e) Penalty Provisions. Penalty provisions have escalated meaningfully over the survey period. The $250,000 per violation per day cap first appeared in 2021 and has become the standard in all subsequent transactions. No precedent exists in the surveyed set for a negotiated reduction below this threshold since 2021.
We note that VPI's profile — classified defense contracts across fourteen active programs, ITAR-controlled GaN defense articles, 212 cleared employees (including TS/SCI-cleared key personnel), and 47 U.S. patents (23 government-funded) — places this transaction at the higher end of national security sensitivity among the twelve surveyed precedents. Accordingly, HSAG should prepare for a robust NSA containing terms at or near the most demanding end of the range observed in comparable transactions.
The balance of this memorandum provides detailed analysis of each mitigation category, identifies the specific terms most likely to appear in the CFIUS draft NSA, and sets forth recommended negotiation positions and red lines for HSAG's consideration.
II. Scope and Methodology
A. Scope of Analysis
This memorandum surveys twelve semiconductor-sector transactions that received CFIUS clearance subject to mitigation through a National Security Agreement between January 2019 and October 2023. The twelve transactions were selected based on their structural and substantive relevance to the HSAG/VPI transaction, as discussed further in Section II.C below.
All twelve precedent transactions involved foreign acquirors from allied nations — specifically, Germany, Japan, South Korea, the Netherlands, the United Kingdom, Israel, and Singapore — acquiring U.S.-based semiconductor companies with some combination of: (i) active DoD contracts (prime or subcontract); (ii) products controlled under ITAR or EAR; (iii) classified programs requiring a Facility Clearance; or (iv) critical technology designations under 31 C.F.R. § 800.215.
The analysis organizes the mitigation terms observed across these twelve precedents into seven principal categories:
1.  Board Governance — including board composition, Security Board Member requirements, Government Security Committee structure, and independent Security Director provisions.
2.  Technology Control Plans — including scope of controlled technology, information-sharing protocols, clean-team procedures, and carve-outs for commercial information.
3.  Third-Party Compliance Monitors — including monitor selection, scope of monitoring, reporting frequency, cost allocation, and ad hoc audit provisions.
4.  Cybersecurity Requirements — including baseline standards (NIST SP 800-171, CMMC), penetration testing, incident reporting, IT segregation, and cloud infrastructure restrictions.
5.  Personnel and Continuity — including key personnel retention periods, Facility Security Officer requirements, and replacement approval procedures.
6.  Facility Access Restrictions — including classified area access controls, visitor protocols, and unclassified area access procedures.
7.  Penalty Provisions and Enforcement — including per-violation daily penalties, cure periods, injunctive relief, and mandated divestiture authority.
In addition to these seven principal categories, we address several supplementary NSA terms observed in the precedent set, including pre-notification of material changes, data segregation requirements, NSA term and sunset provisions, annual compliance reporting, and cooperation with government investigations.
B. Methodology and Sources
This analysis draws upon the following sources:
•  CFIUS Annual Reports to Congress (2019–2023). The Committee's annual reports provide aggregate data on the number of notices filed, investigations conducted, and mitigation agreements imposed, as well as narrative descriptions of common mitigation terms by sector.
•  Publicly Available Proxy Statements and SEC Filings. Several of the transactions in the surveyed set involved publicly traded target or acquiror companies, and the proxy statements and Form 8-K filings associated with those transactions disclosed the existence and certain summary terms of the applicable NSAs.
•  FOIA-Released Summaries. In a limited number of cases, summary descriptions of NSA terms have been released through the Freedom of Information Act process, typically in redacted form. These summaries provide structural and thematic information but do not constitute full NSA texts.
•  Industry Publications. The Semiconductor Industry Association ("SIA") has published several white papers analyzing CFIUS trends in the semiconductor sector, and trade press outlets including Semiconductor Engineering, EE Times, and Law360 have reported on the terms of specific NSAs in varying degrees of detail.
•  Professional Experience of Counsel. Margaret Ashworth and David Caruso collectively bring more than forty years of experience advising on CFIUS matters, including direct participation in the negotiation of multiple NSAs in the semiconductor and defense technology sectors. Their professional knowledge informs the analysis, particularly with respect to unpublished or non-public terms.
•  Interviews with Monitor Firms and Former CFIUS Staff Members. We have conducted background interviews with representatives of monitor firms and former CFIUS staff members to confirm our understanding of current CFIUS expectations and practice. No names or privileged information are disclosed herein.
Limitations. The full text of NSAs is classified as confidential or, in some cases, includes classified annexes. This analysis is therefore necessarily based on summaries, structural descriptions, and publicly available terms rather than verbatim NSA provisions. Some details — particularly regarding cost figures and specific operational requirements — are approximated based on industry knowledge and professional experience. These approximations are identified as such where they appear. Despite these limitations, we are confident that the analysis provides a reliable and actionable benchmarking framework for the HSAG/VPI NSA negotiation.
C. Transaction Selection Criteria
The twelve precedent transactions were selected based on the following criteria:
•  The U.S. target company was engaged in semiconductor design, fabrication, or related component manufacturing, including compound semiconductor, silicon carbide, gallium arsenide, gallium nitride, and related III-V or advanced packaging technologies.
•  The acquiror was a non-U.S. entity, organized under the laws of a jurisdiction outside the United States.
•  The transaction received CFIUS clearance subject to a National Security Agreement — that is, the transaction was not blocked, withdrawn, or otherwise abandoned prior to closure.
•  The transaction closed between January 1, 2019 and October 15, 2023.
Transactions involving non-semiconductor targets (e.g., pure software, telecommunications infrastructure, or financial services), transactions involving acquirors from adversary or non-allied nations (e.g., China, Russia), and transactions that were blocked or voluntarily withdrawn were excluded from the survey. The twelve selected transactions represent, to the best of our knowledge, the most comprehensive set of comparable precedents available for benchmarking purposes.
III. Overview of the 12 Precedent Transactions
A. Summary Table of Precedent Transactions
The following table provides a summary overview of the twelve precedent transactions analyzed in this memorandum. All company names have been fictionalized and anonymized in accordance with confidentiality constraints; transactions are referenced by precedent number only throughout this memorandum.
Note: Enterprise values are approximate and based on publicly reported transaction values or industry estimates. Cleared employee counts represent the approximate number of employees with active security clearances at the time of the transaction and are omitted ("N/A") where the target did not hold a Facility Clearance. NSA initial terms of "Indefinite" denote agreements coterminous with the acquiror's ownership of the target.
B. Precedent 1 — 2019 (German Acquiror / U.S. RF Semiconductor Company)
Precedent 1 involved the acquisition of a U.S.-based radio-frequency ("RF") semiconductor design and manufacturing company by a German industrial conglomerate. The transaction had an approximate enterprise value of $600 million. The target held a SECRET-level Facility Clearance and employed approximately 80 cleared personnel. The target manufactured defense articles controlled under ITAR Category XI and maintained five active DoD prime and subcontracts.
The NSA imposed in this transaction was among the less onerous in the surveyed set, reflecting the relatively smaller scale of the target's classified activities and the earlier time period (pre-pandemic, pre-2021 tightening of CFIUS practice). Key terms included:
•  Board Governance: Three-member security board composed entirely of U.S.-citizen Security Board Members, with no acquiror designee seats on the security board. A broader parent-level board retained authority over non-classified commercial matters.
•  Technology Control Plan: Standard TCP covering ITAR-controlled technical data and defense articles. The TCP prohibited transfer of ITAR-controlled information to non-U.S. persons without prior authorization from the Directorate of Defense Trade Controls ("DDTC").
•  Third-Party Monitor: Annual compliance monitor required. Monitor fees were borne by the acquiror at an approximate annual cost of $800,000. This figure represents the lowest monitor cost observed in the entire surveyed set.
•  Cybersecurity: General cybersecurity requirements were included but did not reference NIST SP 800-171 by name. The NSA predated the widespread adoption of NIST SP 800-171 as a CFIUS baseline standard.
•  Penalty: $100,000 per violation per day — the standard at the time, but significantly lower than the $250,000 per violation per day cap that has become the norm since 2021.
Precedent 1 is instructive primarily as a historical baseline. The terms imposed in this transaction would be insufficient by current CFIUS standards, and HSAG should not expect to achieve comparable terms in the present environment.
C. Precedent 2 — 2019 (Japanese Acquiror / U.S. Compound Semiconductor Fab)
Precedent 2 involved the acquisition of a U.S.-based compound semiconductor fabrication facility by a major Japanese semiconductor manufacturer. The transaction had an approximate enterprise value of $900 million. Notably, the target did not hold a Facility Clearance and did not directly perform classified work. However, the target manufactured dual-use compound semiconductor components classified under EAR ECCN 3A001 and served as a Tier 2 supplier to several DoD programs.
Because the target lacked classified programs, the NSA in this transaction was among the lighter in the surveyed set. Key terms included:
•  Board Governance: Two-member security board with lighter governance requirements. No Government Security Committee was established, as there were no classified programs to oversee. Acquiror designees were not restricted from the security board.
•  Technology Control Plan: TCP covered EAR-controlled technical data and dual-use components. The TCP was narrower in scope than those observed in classified-program transactions, focusing primarily on deemed export controls and restrictions on transfers of controlled technology to designated countries and entities.
•  Third-Party Monitor: Annual compliance monitor required at an approximate cost of $900,000 per year.
•  Classified Access Restrictions: Not applicable, as the target did not hold an FCL.
•  Penalty: $100,000 per violation per day.
Precedent 2 is relevant to the HSAG/VPI transaction primarily as an illustration of the lower bound of CFIUS mitigation in semiconductor transactions where the target's national security profile is less sensitive. Because VPI holds classified programs and ITAR-controlled defense articles, the HSAG/VPI NSA will be substantially more demanding than the terms imposed in Precedent 2.
D. Precedent 3 — 2020 (South Korean Acquiror / U.S. GaAs Semiconductor Company)
Precedent 3 involved the acquisition of a U.S.-based gallium arsenide ("GaAs") semiconductor company by a South Korean technology conglomerate. The transaction had an approximate enterprise value of $1.1 billion. The target held a SECRET-level FCL, employed approximately 150 cleared personnel, manufactured ITAR-controlled defense articles, and maintained eight active DoD contracts.
This precedent is highly analogous to the HSAG/VPI transaction in terms of target profile, transaction size, and the nature of the national security concerns at issue. The NSA imposed in this transaction included the following key terms:
•  Board Governance: Five-member board consisting of three Security Board Members and two acquiror designees. All Security Board Members were required to be U.S. citizens holding or eligible for security clearances at the SECRET level or above. A Government Security Committee ("GSC") was established with exclusive authority over all classified programs, ITAR-controlled activities, personnel security decisions, and facility security matters.
•  Technology Control Plan: Comprehensive TCP covering all ITAR-controlled defense articles and technical data, as well as EAR-controlled dual-use items. The TCP established information-sharing protocols permitting the acquiror to receive non-controlled financial and strategic planning information through a designated clean-team process.
•  Third-Party Monitor: Annual compliance monitor at an approximate cost of $1.0 million per year.
•  Cybersecurity: NIST SP 800-171 compliance was required, making this transaction an early adopter of the standard within the CFIUS mitigation framework.
•  Personnel Continuity: Eighteen-month retention requirement for key cleared personnel, including the CEO and FSO.
•  Penalty: $150,000 per violation per day — a transitional figure between the earlier $100,000 standard and the $250,000 cap that would become standard in 2021.
Precedent 3 is one of the most instructive benchmarks for the HSAG/VPI transaction. The target profile is closely comparable (compound semiconductor company with classified programs, ITAR-controlled items, and a significant cleared workforce), and the transaction economics are within a similar range. The principal differences are the acquiror jurisdiction (South Korea vs. Germany) and the passage of approximately three years, during which CFIUS expectations have tightened. HSAG should expect NSA terms at least as demanding as those imposed in Precedent 3, and likely more demanding in the cybersecurity and penalty categories.
E. Precedent 4 — 2020 (Dutch Acquiror / U.S. Photonics Component Company)
Precedent 4 involved the acquisition of a U.S.-based photonics component company by a Dutch semiconductor equipment manufacturer. The transaction had an approximate enterprise value of $450 million. The target did not hold a Facility Clearance but manufactured components classified under EAR ECCN 3A001 and 3E001 and performed work on several DoD subcontracts involving unclassified controlled technical information.
The lighter national security profile of the target resulted in correspondingly lighter NSA terms:
•  Board Governance: Four-member board consisting of two Security Board Members and two acquiror designees. No GSC was required, as the target had no classified programs.
•  Technology Control Plan: TCP focused on EAR-controlled items, including deemed export controls and restrictions on information sharing with non-U.S. persons without prior Bureau of Industry and Security ("BIS") authorization.
•  Third-Party Monitor: Annual compliance monitor at an approximate cost of $850,000 per year.
•  Penalty: $100,000 per violation per day.
Precedent 4 illustrates the lighter mitigation approach applied where the target has no classified programs and the controlled items are limited to dual-use EAR-controlled components. This precedent is of limited direct relevance to HSAG/VPI given VPI's classified programs and ITAR-controlled defense articles.
F. Precedent 5 — 2020 (UK Acquiror / U.S. MMIC Design Company)
Precedent 5 involved the acquisition of a U.S.-based monolithic microwave integrated circuit ("MMIC") design company by a UK defense and aerospace conglomerate. The transaction had an approximate enterprise value of $750 million. The target held a SECRET-level FCL, employed approximately 120 cleared personnel, manufactured defense articles controlled under ITAR Category XI(a)(3), and held six DoD prime contracts.
This precedent is of significant relevance to HSAG/VPI, as the target manufactured defense-grade microwave components controlled under the same ITAR category as VPI's products. Key NSA terms included:
•  Board Governance: Five-member board with three Security Board Members (all required to be eligible for TS/SCI clearances) and two acquiror designees. GSC established with exclusive authority over classified and ITAR-controlled activities. Acquiror designees were excluded from GSC membership.
•  Technology Control Plan: Comprehensive TCP covering ITAR-controlled defense articles and technical data, as well as controlled unclassified information ("CUI"). The TCP included a data segregation requirement mandating physical and logical separation of controlled technical data from the acquiror's global information systems.
•  Third-Party Monitor: Annual compliance monitor at an approximate cost of $1.1 million per year.
•  Cybersecurity: NIST SP 800-171 compliance required. This was one of the earliest post-2020 NSAs to adopt NIST SP 800-171 as the baseline standard.
•  Personnel Continuity: Twenty-four-month retention requirement for key cleared personnel, including the CEO and FSO.
•  Facility Access Restrictions: HSAG personnel barred from classified facility areas without prior DCSA and GSC approval. Escort and visitor logging requirements imposed for all acquiror visits.
•  Penalty: $200,000 per violation per day — reflecting the upward trend in penalty provisions during the 2020–2021 period.
Precedent 5 represents a mid-point in the evolution of semiconductor-sector NSA terms and provides a useful benchmark for the governance and TCP provisions likely to be imposed on HSAG/VPI. The penalty provision, while higher than the 2019 standard, has since been superseded by the $250,000 cap.
G. Precedent 6 — 2021 (Israeli Acquiror / U.S. Power Semiconductor Company)
Precedent 6 involved the acquisition of a U.S.-based power semiconductor company by an Israeli defense electronics firm. The transaction had an approximate enterprise value of $2.0 billion. The target held clearances at the TS/SCI level, employed approximately 200 cleared personnel, manufactured both ITAR-controlled and EAR-controlled items, and maintained a significant classified contract backlog with multiple DoD customers.
This precedent represents the highest-security transaction in the surveyed set at the time of its clearance and is instructive as an upper-bound benchmark. Key NSA terms included:
•  Board Governance: Robust governance structure with three Security Board Members, all required to hold or be eligible for TS/SCI clearances. An independent Security Director was required — the first appearance of this requirement in the surveyed set. The Security Director was required to have no prior relationship with the acquiror, be a U.S. citizen, hold or be eligible for a TS/SCI clearance, and be approved by the CFIUS monitoring agencies. A GSC was established with broad authority extending beyond classified programs to include all activities touching ITAR-controlled technology, personnel security, and facility security.
•  Technology Control Plan: Comprehensive TCP covering all controlled and proprietary technical data. The TCP imposed a "need-to-know" standard for all information transfers within the target company and prohibited any access by acquiror personnel to controlled technical data without prior USG authorization.
•  Third-Party Monitor: Annual compliance monitor with semi-annual interim reports. Monitor fees were approximately $1.8 million per year, reflecting the expanded scope and reporting cadence.
•  Cybersecurity: NIST SP 800-171 with annual third-party penetration testing. The NSA also required 72-hour cybersecurity incident reporting to the Defense Counterintelligence and Security Agency ("DCSA"). Physical and logical IT segregation was mandated, and no shared cloud infrastructure was permitted between the target and the acquiror's global network.
•  Personnel Continuity: Thirty-six-month retention requirement for the CEO and FSO — the longest retention period observed in the surveyed set.
•  Penalty: $250,000 per violation per day — the first appearance of this cap in the surveyed set. This figure has become the standard in all subsequent transactions.
Precedent 6 is instructive primarily as a ceiling for the HSAG/VPI negotiation. While VPI's national security profile is significant, it does not reach the TS/SCI-intensive level of the Precedent 6 target. Nevertheless, several features of Precedent 6 — including the independent Security Director requirement, IT segregation, and the $250,000 penalty cap — have since become standard in transactions below the TS/SCI threshold.
H. Precedent 7 — 2021 (German Acquiror / U.S. Silicon Carbide Substrate Manufacturer)
Precedent 7 involved the acquisition of a U.S.-based silicon carbide ("SiC") substrate manufacturer by a German industrial semiconductor group. The transaction had an approximate enterprise value of $1.3 billion. The target held a SECRET-level FCL, employed approximately 170 cleared personnel, manufactured products classified under EAR ECCN 3C001 and 3E001, and maintained ten active DoD contracts (a mix of prime contracts and subcontracts).
This precedent is the single most analogous transaction in the surveyed set to the HSAG/VPI deal. The acquiror is a German semiconductor company, the target is a U.S. compound semiconductor manufacturer with classified programs and a significant cleared workforce, and the enterprise value is in a comparable range. Key NSA terms included:
•  Board Governance: Five-member board with three Security Board Members and two acquiror designees. GSC established with exclusive authority over classified programs and controlled technology activities.
•  Technology Control Plan: Comprehensive TCP covering all EAR-controlled items, proprietary technical data, and DoD contract deliverables.
•  Third-Party Monitor: Annual compliance monitor at an approximate cost of $1.2 million per year.
•  Cybersecurity: NIST SP 800-171 compliance; 72-hour incident reporting to DCSA; physical and logical IT segregation; no shared cloud infrastructure.
•  Personnel Continuity: Twenty-four-month retention requirement for key cleared personnel, including the CEO, CTO, and FSO.
•  Facility Access Restrictions: Acquiror personnel barred from classified areas without prior DCSA and GSC approval. Unclassified facility areas accessible with advance notice and escort.
•  Penalty: $250,000 per violation per day.
We consider Precedent 7 to be the most directly relevant benchmark for the HSAG/VPI NSA. The similarity in acquiror jurisdiction, target profile, and transaction economics provides a high degree of confidence that the NSA terms imposed in Precedent 7 approximate the terms CFIUS will propose in the HSAG/VPI context. The principal areas where the HSAG/VPI NSA may differ from Precedent 7 are: (i) the potential requirement for an independent Security Director (reflecting the post-2021 trend identified in later precedents); and (ii) the possible inclusion of CMMC Level 2 as a forward-looking cybersecurity requirement (reflecting 2023 practice). We estimate the expected annual monitor cost for the HSAG/VPI transaction at approximately $1.2 million per year, consistent with Precedent 7.
I. Precedent 8 — 2022 (Singaporean Acquiror / U.S. III-V Semiconductor Company)
Precedent 8 involved the acquisition of a U.S.-based III-V compound semiconductor company by a Singaporean technology investment group. The transaction had an approximate enterprise value of $500 million. The target held a SECRET-level FCL, employed approximately 60 cleared personnel, manufactured ITAR-controlled defense articles, and held four DoD subcontracts.
The target's smaller size and cleared workforce resulted in moderately lighter NSA terms compared to the larger transactions in the 2022 cohort. Key terms included:
•  Board Governance: Four-member board consisting of two Security Board Members and two acquiror designees. GSC established with exclusive authority over classified programs. The smaller board size reflected the target's more limited classified activities.
•  Technology Control Plan: Standard TCP covering ITAR-controlled items.
•  Third-Party Monitor: Annual compliance monitor at an approximate cost of $950,000 per year.
•  Cybersecurity: NIST SP 800-171 compliance; 72-hour incident reporting to DCSA.
•  Personnel Continuity: Eighteen-month retention requirement for key cleared personnel.
•  Penalty: $250,000 per violation per day.
Precedent 8 demonstrates that the $250,000 per violation per day penalty cap and NIST SP 800-171 baseline had become universal by 2022, even in smaller transactions.
J. Precedent 9 — 2022 (Japanese Acquiror / U.S. GaN-on-Si Power Device Company)
Precedent 9 involved the acquisition of a U.S.-based gallium nitride-on-silicon ("GaN-on-Si") power device company by a Japanese semiconductor manufacturer. The transaction had an approximate enterprise value of $800 million. The target did not hold a Facility Clearance and did not perform classified work. However, the target manufactured dual-use GaN power devices classified under EAR ECCN 3A001 and served as a subcontractor on several DoD programs.
This precedent is of particular interest because the target produced GaN semiconductor technology — the same material system as VPI. However, the absence of classified programs and ITAR-controlled items resulted in significantly lighter NSA terms:
•  Board Governance: Lighter governance with two Security Board Members and two acquiror designees. No GSC was required, as the target had no classified programs.
•  Technology Control Plan: TCP focused on EAR-controlled items only. No ITAR provisions were necessary.
•  Third-Party Monitor: Annual compliance monitor at an approximate cost of $850,000 per year.
•  Cybersecurity: NIST SP 800-171 compliance required.
•  Penalty: $250,000 per violation per day.
Precedent 9 is instructive as a lower bound for GaN semiconductor transactions. It illustrates that even in the absence of classified programs, CFIUS requires meaningful mitigation for GaN technology given its dual-use applications in defense radar, electronic warfare, and satellite communications. However, the absence of classified programs and ITAR-controlled items in Precedent 9 means that the HSAG/VPI NSA will be substantially more demanding.
K. Precedent 10 — 2022 (South Korean Acquiror / U.S. Advanced Packaging Company)
Precedent 10 involved the acquisition of a U.S.-based advanced semiconductor packaging company by a South Korean semiconductor conglomerate. The transaction had an approximate enterprise value of $1.6 billion. The target held both SECRET and TS/SCI clearances, employed approximately 190 cleared personnel, manufactured both ITAR- and EAR-controlled items, and maintained twelve active DoD contracts.
This is one of the most demanding NSAs in the surveyed set and reflects the continued tightening of CFIUS expectations in 2022. Key terms included:
•  Board Governance: Five-member board with three Security Board Members. GSC established with broad authority.
•  Technology Control Plan: Comprehensive TCP covering ITAR- and EAR-controlled items, proprietary technology, and CUI.
•  Third-Party Monitor: Annual compliance monitor with enhanced scope, including the right to conduct ad hoc audits (unannounced) in addition to the scheduled annual compliance review. Monitor fees were approximately $1.5 million per year.
•  Cybersecurity: NIST SP 800-171 as the baseline standard, with CMMC Level 2 certification targeted as a forward-looking requirement. The NSA included 72-hour cybersecurity incident reporting to DCSA. Physical and logical IT segregation was mandated, with no shared cloud infrastructure.
•  Personnel Continuity: Twenty-four-month retention requirement for key cleared personnel, with a separate twelve-month retention period for other cleared employees not designated as "key personnel."
•  Pre-notification: Thirty-day advance notification required for material changes to corporate structure, cleared personnel, foreign subcontracts, or government contract performance.
•  Penalty: $250,000 per violation per day.
Precedent 10 is notable for the introduction of CMMC Level 2 as a forward-looking requirement and the expanded monitor scope including ad hoc audit authority. These features may appear in the HSAG/VPI NSA given the similar timing and sensitivity profile.
L. Precedent 11 — 2023 (UK Acquiror / U.S. FPGA Design Company)
Precedent 11 involved the acquisition of a U.S.-based field-programmable gate array ("FPGA") design company by a major UK defense and technology conglomerate. The transaction had an approximate enterprise value of $2.5 billion — the largest in the surveyed set. The target held TS/SCI clearances, employed approximately 250 cleared personnel (the largest cleared workforce in the set), manufactured ITAR Category XI defense articles, and maintained significant contracts with DARPA and various DoD program offices.
This precedent represents the most demanding NSA framework currently in effect and establishes the ceiling for the HSAG/VPI negotiation:
•  Board Governance: Seven-member board — the largest in the surveyed set — consisting of four Security Board Members and three acquiror designees. A GSC was established with exclusive authority over all classified and ITAR-controlled matters. An independent Security Director with veto authority over classified matters was required. The Security Director position was subject to CFIUS approval and could not be filled by anyone with a prior relationship with the acquiror.
•  Technology Control Plan: Comprehensive TCP with the broadest scope observed in the surveyed set, encompassing all controlled technical data, proprietary know-how, trade secrets, CUI, and all information related to government contract performance.
•  Third-Party Monitor: Enhanced-scope monitor with quarterly reporting — the most frequent reporting cadence in the surveyed set. Monitor fees were approximately $2.5 million per year, reflecting the expanded scope and quarterly reporting requirements.
•  Cybersecurity: NIST SP 800-171 compliance as the baseline, with CMMC Level 2 certification required within eighteen months of closing. Forty-eight-hour cybersecurity incident reporting (the shortest reporting window in the surveyed set). Complete physical and logical IT segregation. No shared cloud infrastructure. Semi-annual third-party penetration testing.
•  Personnel Continuity: Thirty-six-month retention requirement for the CEO, CTO, and FSO — the longest retention period for the broadest set of key personnel in the surveyed set.
•  Pre-notification: Thirty-day advance notification required for material changes.
•  Annual Compliance Reporting: Compliance reports submitted to DCSA, the Department of the Treasury, and the applicable DoD co-lead agency.
•  Penalty: $250,000 per violation per day.
Precedent 11 is the upper bound of current CFIUS practice in the semiconductor sector. While VPI's national security profile is significant, it does not approach the scale or sensitivity of the Precedent 11 target. HSAG should use Precedent 11 as a negotiation ceiling — accepting that certain of its features (e.g., the $250,000 penalty cap, IT segregation, NIST SP 800-171) are now standard, while resisting the most demanding features (e.g., quarterly reporting, 48-hour incident reporting, 36-month retention) as disproportionate to VPI's profile.
M. Precedent 12 — 2023 (German Acquiror / U.S. mmWave IC Company)
Precedent 12 involved the acquisition of a U.S.-based millimeter-wave ("mmWave") integrated circuit company by a German semiconductor group. The transaction had an approximate enterprise value of $700 million. The target held a SECRET-level FCL, employed approximately 100 cleared personnel, manufactured defense articles controlled under ITAR Category XI(a)(3), and maintained seven active DoD contracts.
This precedent is closely analogous to the HSAG/VPI transaction. The acquiror is a German semiconductor company, the target manufactures defense-grade microwave/mmWave components controlled under the same ITAR subcategory as VPI's products, and the target holds a SECRET-level FCL with a meaningful (though smaller) cleared workforce. Key NSA terms included:
•  Board Governance: Five-member board with three Security Board Members and two acquiror designees. GSC established with exclusive authority over classified and ITAR-controlled programs.
•  Technology Control Plan: Comprehensive TCP covering all ITAR-controlled defense articles and technical data, EAR-controlled items, and proprietary technical know-how.
•  Third-Party Monitor: Annual compliance monitor at an approximate cost of $1.1 million per year.
•  Cybersecurity: NIST SP 800-171 compliance; 72-hour incident reporting to DCSA; physical and logical IT segregation; no shared cloud infrastructure.
•  Personnel Continuity: Twenty-four-month retention requirement for key cleared personnel.
•  Pre-notification: Thirty-day advance notification required for material changes.
•  Facility Access Restrictions: Acquiror personnel barred from classified areas without prior DCSA and GSC approval.
•  Penalty: $250,000 per violation per day.
Precedent 12, together with Precedent 7, provides the most directly relevant benchmarking data for the HSAG/VPI NSA. Both involve German acquirors, U.S. semiconductor targets with classified programs and ITAR-controlled defense articles, and transaction values in a broadly comparable range. The consistency of terms between Precedent 7 (2021) and Precedent 12 (2023) — with the addition of pre-notification requirements in Precedent 12 — suggests a stable and predictable framework for the HSAG/VPI negotiation.
IV. Comparative Analysis by Mitigation Category
A. Board Governance
1. Board Composition Trends
Board governance is the foundational structural element of every semiconductor-sector NSA in the surveyed set. CFIUS's overriding concern is to ensure that decisions affecting classified programs, ITAR-controlled activities, and national security-sensitive operations remain under the control of U.S. persons with appropriate security clearances, while permitting the foreign acquiror to exercise commercially reasonable business oversight of non-sensitive operations.
Across all twelve precedent transactions:
•  All twelve required at least two Security Board Members who are U.S. citizens, demonstrating that the Security Board Member requirement is effectively universal in semiconductor-sector NSAs regardless of the target's specific national security profile.
•  Nine of twelve required three or more Security Board Members. In every case where the target held classified programs (i.e., held an FCL at the SECRET or TS/SCI level), the NSA required a minimum of three Security Board Members. The two precedents with only two Security Board Members involved targets without classified programs (Precedents 2 and 4), along with one smaller-scale classified transaction (Precedent 8, with approximately 60 cleared employees).
•  Ten of twelve included acquiror designee seats on the board, typically two seats. In the two exceptions (Precedent 1, an early 2019 transaction, and Precedent 2, which had a lighter governance structure), the governance model was either security-board-only or did not formally include acquiror designees on the security-focused board.
•  Total board sizes ranged from four to seven members. The most common configuration was five members (three Security Board Members and two acquiror designees), observed in six of twelve transactions (Precedents 3, 5, 7, 10, 12, and effectively Precedent 11 at a larger scale of seven).
•  In every transaction where the target held classified programs at the SECRET or TS/SCI level, all Security Board Members were required to hold or be eligible for security clearances at or above the classification level of the target's most sensitive program. For example, in Precedent 6 (TS/SCI programs), all three Security Board Members were required to hold or be eligible for TS/SCI clearances.
The clear trend is toward a five-member board with a 3:2 ratio favoring Security Board Members in transactions involving classified programs. This ratio provides CFIUS with assurance that U.S.-person control over national security matters is maintained, while preserving the acquiror's ability to participate meaningfully in business governance.
2. Government Security Committee (GSC)
The Government Security Committee is a sub-committee of the board composed exclusively of Security Board Members, with exclusive authority over the target's classified programs and national security-sensitive operations. The GSC functions as a firewall within the board governance structure, ensuring that the acquiror's designees have no decision-making authority (and typically no informational access) with respect to classified or ITAR-controlled matters.
Across the twelve precedent transactions:
•  Ten of twelve established a GSC composed exclusively of Security Board Members.
•  The GSC was given exclusive authority over classified programs, ITAR-controlled activities, personnel security decisions (including clearance sponsorship and adjudication), and facility security matters in all ten cases where a GSC was established.
•  In the two precedents without a GSC (Precedents 2 and 4), the targets had no classified programs and the governance structure was correspondingly lighter. The absence of a GSC in these transactions is directly attributable to the absence of classified programs and is not indicative of a broader trend away from GSC requirements.
•  The GSC's authority typically extended to oversight of the FSO, approval of cleared personnel actions, and authority to direct the target's compliance with the National Industrial Security Program Operating Manual ("NISPOM").
The establishment of a GSC is effectively universal in transactions involving classified programs. HSAG should expect a GSC requirement in the HSAG/VPI NSA.
3. Independent Security Director
The independent Security Director is a relatively recent addition to the NSA toolkit, first appearing in the surveyed set in 2021 (Precedent 6) and appearing with increasing frequency in subsequent transactions.
•  Four of twelve precedents required an independent Security Director: Precedents 6 (2021), 10 (2022), 11 (2023), and 12 (2023).
•  The independent Security Director requirement has appeared in all 2023 transactions in the surveyed set, suggesting a post-2021 trend toward routine inclusion of this requirement in transactions involving classified programs.
•  "Independent" is defined consistently across the four precedents as: (i) having no prior employment, consulting, or advisory relationship with the acquiror or its affiliates; (ii) being a U.S. citizen; (iii) holding or being eligible for a security clearance at or above the level of the target's most sensitive program; and (iv) being subject to CFIUS/DCSA approval prior to appointment.
•  In Precedent 11, the independent Security Director was granted veto authority over classified matters — the most expansive articulation of Security Director authority in the surveyed set. In the other three precedents, the Security Director served in an advisory and oversight capacity without formal veto power.
The trend is clearly toward routine inclusion of an independent Security Director requirement in transactions of the HSAG/VPI type. We assess that there is a significant likelihood that CFIUS will require an independent Security Director in the HSAG/VPI NSA.
4. Implications for HSAG/VPI
VPI holds a SECRET-level FCL (CAGE Code 7VK92) and employs 212 cleared personnel, including two key personnel with TS/SCI clearances (Dr. Nathan Trevorrow, CEO, and Col. (Ret.) Bryce Hendrickson, VP Government Programs/FSO). The target's classified portfolio, ITAR-controlled defense articles, and significant cleared workforce place it squarely within the category of transactions that have historically required the most robust governance provisions.
Based on the precedent analysis, we expect the CFIUS draft NSA to include:
•  A five-member board consisting of three Security Board Members and two HSAG designees.
•  All three Security Board Members must be U.S. citizens holding or eligible for security clearances at or above the SECRET level (and TS/SCI eligibility may be required for at least one Security Board Member, given VPI's TS/SCI-cleared key personnel and the potential existence of TS/SCI-classified subprograms).
•  A Government Security Committee composed exclusively of the three Security Board Members, with exclusive authority over all classified programs, ITAR-controlled activities, personnel security, and facility security.
•  A likely requirement for an independent Security Director, given the post-2021 trend and VPI's profile.
•  HSAG designees will not be permitted to hold or access classified information and will be excluded from GSC participation.
Recommended Position: HSAG should accept the five-member board structure with a 3:2 ratio and the establishment of a GSC with exclusive authority over classified and ITAR-controlled programs. These terms are universal in comparable precedents and are not productively negotiable. With respect to the independent Security Director, HSAG should accept the requirement in principle but negotiate for the ability to propose candidates for CFIUS/DCSA approval, rather than having CFIUS impose a selection unilaterally. This approach is consistent with the practice observed in Precedents 7 and 12, where the acquiror proposed candidates who were then vetted and approved by the monitoring agencies.
B. Technology Control Plans (TCPs)
1. Scope and Structure
The Technology Control Plan is the central instrument for preventing unauthorized transfers of controlled technology from the U.S. target to the foreign acquiror or other non-U.S. persons. TCPs establish detailed protocols governing the handling, storage, transmission, and access controls for controlled technical data and defense articles.
Across all twelve precedent transactions:
•  A TCP was required in all twelve transactions without exception. The TCP requirement is universal in semiconductor-sector NSAs and is not subject to negotiation as a structural matter.
•  All TCPs prohibited the transfer of ITAR-controlled technical data and defense articles to non-U.S. persons without prior authorization from the Directorate of Defense Trade Controls ("DDTC") or, in the case of EAR-controlled items, the Bureau of Industry and Security ("BIS").
•  The scope of TCPs varied across the surveyed set. In transactions where the target did not hold classified programs (Precedents 2, 4, and 9), the TCP was narrower, covering only ITAR- and/or EAR-controlled items. In classified-program transactions, the TCP was broader, covering all controlled technical data, classified information, CUI, and, in more recent transactions, proprietary trade secrets and know-how.
•  A notable trend from 2022–2023 is the expansion of TCP scope beyond formally controlled items to include trade secrets and proprietary know-how. Precedents 10, 11, and 12 all included TCP provisions addressing proprietary technology protections in addition to export control compliance, reflecting CFIUS's growing concern about the transfer of U.S. technological advantages even where specific items may not carry formal export classifications.
2. Information Sharing Protocols
All TCPs establish procedures for permissible information sharing between the target and the acquiror for legitimate business purposes. The challenge in every NSA is to maintain the acquiror's ability to exercise commercially reasonable business oversight — including financial reporting, strategic planning, and operational management — while preventing unauthorized access to controlled technology.
•  All twelve TCPs establish a distinction between "controlled technical data" (which is prohibited from transfer without authorization) and "business/financial information" (which is generally permitted to flow to the acquiror).
•  "Clean team" or "firewall" procedures were explicitly addressed in eight of twelve precedents (Precedents 3, 5, 6, 7, 8, 10, 11, and 12). Under these procedures, a designated team of acquiror personnel (typically senior management and financial staff) receives redacted or sanitized business information through a controlled channel, ensuring that controlled technical data is not inadvertently disclosed.
•  The clean-team model has become increasingly detailed and prescriptive in recent NSAs. In Precedent 11 (2023), the TCP specified the categories of information that could be shared through the clean-team channel, the format in which such information could be shared (redacted summaries, aggregated financial data), and the personnel authorized to participate in clean-team communications.
3. Implications for HSAG/VPI
VPI's technology portfolio is extensive and varied, encompassing:
•  ITAR Category XI(a)(3) defense articles (GaN-based defense components).
•  EAR ECCN 3A001, 3A991, and 3E001 dual-use semiconductor components and related technology.
•  DDTC Registration No. M-24817 and three active DSP-5 export licenses.
•  Thirty-one registered trade secrets covering proprietary GaN-on-SiC epitaxial growth processes, device architectures, and related manufacturing know-how.
•  Twenty-three government-funded patents with government use rights and, in some cases, march-in rights.
All of these items will fall within the scope of the TCP. HSAG's planned commercial integration of VPI technology — including potential cross-border R&D collaboration between VPI's Albuquerque facility and HSAG's facilities in Germany — will require advance USG authorization under both ITAR and EAR for any controlled technical data involved in such collaboration.
Recommended Position: HSAG should accept the TCP framework in its entirety. The requirement is universal and non-negotiable as a structural matter. HSAG's negotiation focus should be on two subsidiary points: (i) negotiating clear carve-outs for non-controlled commercial and financial information to ensure that HSAG can exercise commercially reasonable business oversight of VPI, and (ii) seeking a streamlined authorization process for routine commercial data sharing that does not involve controlled technical data — for example, an expedited review process for recurring categories of business communications.
C. Third-Party Compliance Monitors
1. Monitor Requirement
The third-party compliance monitor serves as CFIUS's primary enforcement mechanism, conducting independent audits of the target's and acquiror's compliance with all NSA provisions. The monitor functions as the eyes and ears of the CFIUS monitoring agencies between formal government reviews.
Across the twelve precedent transactions:
•  A third-party compliance monitor was required in all twelve transactions. The monitor requirement is universal and not subject to negotiation.
•  Monitors are selected from a pool of pre-approved firms or individuals with significant government security experience. In practice, monitors are typically former senior FBI, DoD, or intelligence community personnel who hold or are eligible for high-level security clearances and who operate through specialized compliance consulting firms.
•  The monitor must be independent of both the acquiror and the target. Independence is verified through conflict-of-interest screening and disclosure requirements.
•  CFIUS approval of the selected monitor is required in all twelve cases. The acquiror may propose candidates, but the monitoring agencies retain final approval authority.
2. Scope of Monitoring
The scope of the monitor's activities varies across the surveyed set, generally correlating with the sensitivity of the target's national security profile:
•  Annual compliance audits were required in all twelve precedent transactions. The annual audit is the baseline monitoring activity and typically involves a multi-week on-site review of all NSA compliance areas.
•  Semi-annual or quarterly interim reporting was required in four of twelve transactions — specifically, Precedents 6, 10, 11, and one additional high-sensitivity transaction. These four transactions all involved targets with TS/SCI programs or exceptionally large classified workforces.
•  Ad hoc audits (unannounced or with minimal advance notice) were authorized in six of twelve transactions. Ad hoc audit authority permits the monitor to conduct on-site reviews outside the scheduled annual audit cycle in response to concerns raised by the monitoring agencies, reports of potential violations, or other triggering events.
•  The monitor's scope covers all NSA provisions without exception, including board governance compliance, TCP adherence, cybersecurity controls, personnel security, facility access restrictions, data segregation, and penalty-triggering events.
3. Cost Allocation
Monitor fees represent a significant ongoing cost of NSA compliance and should be factored into HSAG's financial modeling for the transaction:
•  Monitor fees are borne by the acquiror in all twelve precedent transactions. There is no precedent in the surveyed set for cost-sharing with the target.
•  Annual fees ranged from approximately $800,000 (Precedent 1, 2019, the lowest in the set) to approximately $2.5 million (Precedent 11, 2023, the highest in the set).
•  The median annual fee across all twelve precedents is approximately $1.1 million.
•  CPI (Consumer Price Index) adjustment mechanisms were included in eight of twelve transactions and have been standard since 2021. CPI adjustments ensure that monitor fees keep pace with inflation over the potentially indefinite term of the NSA.
•  Fees are generally payable quarterly.
The primary drivers of monitor cost appear to be: (i) the scope and frequency of reporting (quarterly reporting generates higher costs than annual reporting); (ii) the complexity of the target's operations (larger cleared workforces, more classified programs, and more extensive controlled technology portfolios require more intensive audits); and (iii) the security clearance requirements of the monitoring team (monitors requiring TS/SCI access command higher fees).
4. Implications for HSAG/VPI
Based on VPI's profile — SECRET-level FCL, 212 cleared employees, fourteen active DoD contracts, extensive ITAR and EAR controls, and 31 registered trade secrets — we expect the CFIUS draft NSA to require a third-party compliance monitor with annual audit scope. Given that VPI's profile does not include TS/SCI programs at the institutional level (notwithstanding the TS/SCI clearances of individual key personnel), we do not expect CFIUS to require quarterly or semi-annual interim reporting, though semi-annual interim reports cannot be ruled out.
Industry benchmarking suggests an annual monitor fee in the range of $1.0 million to $1.5 million for a transaction of this profile. Precedent 7 — the most directly analogous transaction — had an annual monitor cost of approximately $1.2 million. We believe $1.2 million per year is a reasonable estimate for budgeting purposes.
Recommended Position: HSAG should accept the monitor requirement without objection. Negotiation focus should be directed toward the following subsidiary points:
1.  Reporting Cadence: Negotiate for annual reporting (not semi-annual or quarterly). Annual reporting is the norm in nine of twelve precedents and is appropriate given VPI's profile.
2.  Ad Hoc Audits: Resist unannounced ad hoc audits. Propose that any ad hoc audit be conducted with at least 48 hours' advance notice, allowing VPI to prepare appropriate access and support. This is consistent with the approach observed in several precedents and is a reasonable ask.
3.  CPI Adjustment: Confirm CPI adjustment mechanism with a base year of 2024 (the expected year of closing). This protects HSAG against negotiation of a higher base fee in subsequent years.
4.  Monitor Candidate: Propose Whitmore Compliance Group LLC as a candidate monitor. Gerald Whitmore, the firm's principal, is a former FBI Counterintelligence Division special agent with a TS/SCI clearance and over twenty years of experience in CFIUS compliance monitoring. Mr. Whitmore's firm has served as the third-party monitor in at least two prior semiconductor-sector NSAs known to counsel and has a strong reputation with the CFIUS monitoring agencies. Proposing a credible candidate from the outset strengthens HSAG's position and may expedite the monitor selection process.
D. Cybersecurity Requirements
1. Evolution of Standards (2019–2023)
Cybersecurity has been one of the most rapidly evolving areas of CFIUS mitigation practice over the survey period. The trajectory is toward increasingly specific, prescriptive, and technically demanding requirements:
•  Pre-2021 (Precedents 1–4): The earliest transactions in the surveyed set included general cybersecurity requirements — obligations to maintain "reasonable" cybersecurity practices and protect controlled information from unauthorized access — but did not reference a specific technical framework. These general provisions afforded significant discretion to the target and acquiror in determining how to meet their cybersecurity obligations.
•  2021 Onward (Precedents 5–12): Beginning in 2020–2021, CFIUS adopted NIST SP 800-171 ("Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations") as the minimum baseline cybersecurity standard for NSAs involving controlled technology. All eight transactions from 2021 onward required NIST SP 800-171 compliance, making this standard effectively universal in current practice.
•  2022–2023 (Precedents 10–12): The most recent transactions have additionally referenced CMMC Level 2 certification as a forward-looking requirement. CMMC Level 2 aligns with NIST SP 800-171 but adds a formal certification and assessment process. In Precedents 10 and 11, the NSA required the target to achieve CMMC Level 2 certification within a specified period (12–18 months) after closing. It is not yet clear whether CMMC Level 2 will become a universal requirement or will remain limited to the most sensitive transactions.
2. Penetration Testing
Third-party penetration testing has become a standard component of NSA cybersecurity requirement