1032-00004 · Client 1032 · NSA Annexes & Implementation

nsa-annex-c-governance-gsc-charter.docx DOCUMENT M&A / Corporate

50 / 79 ← → ✕

Contract analysis Extract to table

ANNEX C

TO NATIONAL SECURITY AGREEMENT (NSA-2024-0019)

GOVERNANCE PROVISIONS AND SECURITY BOARD CHARTER

FOR Marlowe Asset Management PHOTONICS INC.

CFIUS Case No.: CFIUS-023-07-3841

NSA Docket Reference: NSA-2024-0019

This Annex C (this "Annex") is entered into as of the Closing Date (as defined below) by and among:

Halcyon Semiconductor Aktiengesellschaft, a stock corporation (Aktiengesellschaft) organized and existing under the laws of the Federal Republic of Germany ("HSAG");

Halcyon US Holdings Inc., a Delaware corporation and a wholly owned subsidiary of HSAG ("Buyer");

Marlowe Asset Management Photonics Inc., a Delaware corporation ("VPI" or the "Company"); and

The United States of America, acting through the U.S. Department of the Treasury, the U.S. Department of Defense, and the U.S. Department of Energy (collectively, the "Government Parties"),

each a "Party" and collectively the "Parties."

This Annex constitutes Annex C to the National Security Agreement dated January 19, 2024 (the "Agreement" or "NSA") among the Parties, entered into in connection with the review by the Committee on Foreign Investment in the United States ("CFIUS") of the acquisition of one hundred percent (100%) of the outstanding equity interests of VPI by Buyer (the "Transaction"), under CFIUS Case No. CFIUS-023-07-3841.

Effective Date. This Annex shall become effective as of the date of consummation of the Transaction (the "Closing Date"), which occurred on February 9, 2024.

Right-click to update Table of Contents

ARTICLE I — PURPOSE AND SCOPE

Section 1.1 — Purpose

This Annex establishes the comprehensive governance framework for VPI following the Closing Date, including, without limitation: (a) the reconstitution of VPI's Board of Directors (the "Board"); (b) the establishment of the Government Security Committee (the "GSC") as a standing committee of the Board vested with exclusive authority over matters affecting the national security of the United States; and (c) the allocation of decision-making authority between the full Board and the GSC to ensure the clear demarcation of responsibilities relating to classified programs, controlled technologies, and personnel and facility security from those relating to general commercial and corporate operations.

The purpose of the governance framework set forth herein is to ensure the effective and continuing protection of U.S. national security interests arising from VPI's participation in classified programs of the U.S. Department of Defense, the Missile Defense Agency, the U.S. Air Force Research Laboratory, and other agencies, and from VPI's development and manufacture of defense articles and dual-use technologies subject to the International Traffic in Arms Regulations ("ITAR") and the Export Administration Regulations ("EAR"), while simultaneously permitting HSAG, through Buyer, to exercise legitimate ownership rights consistent with the terms and conditions of the NSA. Nothing in this Annex is intended to prevent HSAG from realizing the commercial and economic benefits of its investment in VPI, so long as the exercise of such rights does not compromise the national security protections mandated by the NSA and applicable law.

Section 1.2 — Scope

This Annex governs all matters relating to VPI's board composition, committee structure, governance authority, information-barrier requirements, and the related allocation of decision-making rights and responsibilities as required by the NSA. The provisions of this Annex are binding on VPI, HSAG, Buyer, and each of their respective officers, directors, employees, agents, and representatives to the extent of their involvement in VPI's governance.

This Annex applies to VPI and all of its subsidiaries, divisions, business units, and facilities, including, without limitation:

(a) VPI's corporate headquarters, located at 7400 Ridgeline Parkway, Colorado Springs, Colorado 80919; and

(b) VPI's fabrication facility, located at 9200 Innovation Boulevard, Albuquerque, New Mexico 87113 (the "Albuquerque Fab"), which houses VPI's gallium nitride on silicon carbide (GaN-on-SiC) semiconductor fabrication operations and classified manufacturing areas.

This Annex supplements but does not replace VPI's Amended and Restated Certificate of Incorporation, as filed with the Secretary of State of the State of Delaware, or VPI's Amended and Restated Bylaws (collectively, the "Organizational Documents"). The Organizational Documents shall be amended as promptly as practicable following the Closing Date, and in any event no later than thirty (30) calendar days following the Closing Date, to conform with the requirements of this Annex. In the event of any inconsistency between the Organizational Documents and this Annex, the provisions of this Annex shall govern.

Section 1.3 — Relationship to NSA

This Annex is an integral part of the NSA and is incorporated therein by reference. In the event of any conflict or inconsistency between any provision of this Annex and any provision of the body of the NSA, the provisions of the NSA shall control. Capitalized terms used but not defined in this Annex shall have the meanings ascribed to them in Annex A (Definitions) to the NSA. References in this Annex to other Annexes to the NSA (including Annex B (Technology Control Plan), Annex D (Cybersecurity Requirements), Annex E (Compliance Audit Template), and Annex F (Facility Access Procedures)) are references to such Annexes as in effect from time to time, including as amended in accordance with the amendment provisions of the NSA.

ARTICLE II — RECONSTITUTION OF THE BOARD OF DIRECTORS

Section 2.1 — Board Size and Composition

Effective as of the Closing Date, the Board of Directors of VPI shall be reconstituted to consist of five (5) members, as follows:

(a) Three (3) Security Board Members, as defined in and subject to the qualifications set forth in Section 2.2 of this Annex; and

(b) Two (2) HSAG Designees, as defined in and subject to the conditions set forth in Section 2.3 of this Annex.

The Board shall at all times consist of exactly five (5) members constituted as set forth above, unless otherwise agreed in writing by all Parties, including the Government Parties. No person may serve on the Board unless appointed in accordance with the procedures set forth in this Article II.

Section 2.2 — Security Board Members

(a) Qualifications. Each Security Board Member must satisfy all of the following qualification requirements at the time of appointment and at all times during such person's service on the Board:

(i) Such person must be a citizen of the United States of America;

(ii) Such person must be the holder of, or must be eligible for and willing to undergo the investigation required for, a personnel security clearance at the TOP SECRET/Sensitive Compartmented Information (TS/SCI) level, granted by an agency of the United States Government;

(iii) Such person must not be an officer, director, employee, consultant, or agent of HSAG or any non-U.S. affiliate of HSAG (other than VPI itself and its wholly owned U.S. subsidiaries, if any);

(iv) Such person must be free from any foreign ownership, control, or influence ("FOCI") that would impair such person's eligibility for a U.S. government security clearance under the National Industrial Security Program Operating Manual ("NISPOM"), 32 C.F.R. Part 117, or any successor regulation; and

(v) Such person must not have been convicted of any felony or any offense involving moral turpitude, espionage, sabotage, or unauthorized disclosure of classified information.

(b) Security Director. One (1) of the three (3) Security Board Members shall be designated as the "Security Director." The Security Director shall serve as an independent director who is not affiliated with either VPI's management team or HSAG (or any affiliate of HSAG), and shall serve as the chair of the GSC. The Security Director must have demonstrated experience in national security, defense, intelligence, or counterintelligence matters, and must hold an active TS/SCI clearance at the time of appointment.

(c) Initial Security Board Members. Subject to the approval of the Government Parties and the Defense Counterintelligence and Security Agency ("DCSA"), the initial Security Board Members, effective as of the Closing Date, shall be:

(i) Col. (Ret.) Bryce Hendrickson, USAF — Currently serving as Vice President, Government Programs, and Facility Security Officer of VPI. Col. Hendrickson holds an active personnel security clearance at the TS/SCI level. Col. Hendrickson shall serve as a Security Board Member and shall continue in his capacity as FSO, reporting functionally to the GSC on all security matters.

(ii) Adrienne Delacroix — Currently serving as an independent director on VPI's pre-closing Board of Directors. Ms. Delacroix holds an active personnel security clearance at the SECRET level. HSAG and VPI shall submit and diligently pursue an application for the upgrade of Ms. Delacroix's clearance to the TS/SCI level, which upgrade shall be completed within one hundred eighty (180) days of the Closing Date or as soon thereafter as reasonably practicable. Pending the completion of such upgrade, Ms. Delacroix shall be entitled to participate in GSC proceedings to the extent that her existing SECRET clearance permits access to the subject matter under discussion, and shall be recused from any proceedings involving information classified at the TOP SECRET or SCI level.

(iii) Independent Security Director — To Be Nominated. HSAG shall nominate an independent individual to serve as the Security Director. Such nomination shall be submitted to the Government Parties and DCSA for review and approval no later than thirty (30) days following the Closing Date. Until the Security Director is appointed, Col. (Ret.) Bryce Hendrickson shall serve as interim chair of the GSC, subject to Government Party consent.

Section 2.3 — HSAG Designees

(a) Designation Rights. HSAG (acting through Buyer, as VPI's sole stockholder) shall have the right to designate two (2) members of the Board (the "HSAG Designees"). The HSAG Designees may be officers, employees, or other representatives of HSAG or any of its affiliates, and need not be independent of HSAG.

(b) Citizenship and Clearance. HSAG Designees are not required to be citizens of the United States and are not required to hold any U.S. government security clearance. HSAG Designees may be nationals of any country, subject to the Government Parties' objection right set forth in Section 2.4.

(c) Exclusions from Access. Notwithstanding any provision of VPI's Organizational Documents, applicable corporate law, or any other agreement, HSAG Designees shall be excluded from access to:

(i) All Classified Information, as defined in the NSA and Executive Order 13526 (or any successor executive order), including information classified at the CONFIDENTIAL, SECRET, TOP SECRET, and SCI levels;

(ii) All Controlled Technical Data subject to the International Traffic in Arms Regulations ("ITAR," 22 C.F.R. Parts 120–130) or the Export Administration Regulations ("EAR," 15 C.F.R. Parts 730–774), as further governed by the Technology Control Plan set forth in Annex B to the NSA;

(iii) All Controlled Unclassified Information ("CUI") designated for protection under 32 C.F.R. Part 2002 and identified in the Technology Control Plan;

(iv) All discussions, deliberations, materials, presentations, memoranda, reports, and minutes relating to matters within the exclusive authority of the GSC as set forth in Article IV of this Annex; and

(v) All areas of VPI's facilities designated as classified or restricted-access areas, including Sections C-7 through C-12 of the Albuquerque Fab clean room, as described in Annex F (Facility Access Procedures).

(d) Full Board Participation. Subject to the exclusions set forth in clause (c) above, HSAG Designees shall be entitled to participate in and vote on all matters within the authority of the full Board as set forth in Article V of this Annex, and shall receive all information and materials reasonably necessary for the discharge of their duties as directors of VPI in respect of such matters.

Section 2.4 — Qualifications and Vetting

(a) Advance Identification. All proposed Board members, whether Security Board Members or HSAG Designees, shall be identified to the Government Parties (through the CFIUS Staff Chair at the Department of the Treasury and the designated monitoring contacts at the Department of Defense and the Department of Energy) no fewer than thirty (30) calendar days prior to the effective date of their appointment to the Board.

(b) Security Board Member Approval. The appointment of any Security Board Member (including any replacement thereof) is subject to the prior written approval of both the Government Parties and DCSA. HSAG and VPI shall provide all information reasonably requested by the Government Parties and DCSA in connection with the vetting and approval of proposed Security Board Members, including, without limitation, biographical information, financial disclosure statements, and authorization for background investigations.

(c) HSAG Designee Review. The appointment of any HSAG Designee is subject to review by the Government Parties. The Government Parties may object to the appointment of any HSAG Designee whose appointment would, in the reasonable judgment of the Government Parties, pose a risk to the national security of the United States, including by reason of such person's connections to foreign governments, foreign intelligence services, sanctioned entities, or other circumstances that would compromise the integrity of the governance framework established by this Annex. HSAG shall not appoint any HSAG Designee to whom the Government Parties have objected in writing.

(d) Ongoing Compliance. Each Board member shall promptly notify the GSC and the Government Parties of any change in circumstances that could affect such person's continued qualification under this Section 2.4, including any change in citizenship, clearance status, employment, or affiliation with foreign persons or entities.

Section 2.5 — Term and Removal

(a) Security Board Members. Each Security Board Member shall serve on the Board until the earliest of: (i) such person's voluntary resignation; (ii) such person's removal for cause, with the prior written approval of the Government Parties; (iii) such person's death or permanent incapacity; or (iv) such person's replacement with a successor who satisfies all qualification requirements set forth in Section 2.2. For purposes of this Section 2.5(a), "cause" means: (A) willful misconduct or gross negligence in the discharge of duties; (B) conviction of a felony; (C) loss or suspension of security clearance; (D) a material breach of the NSA or this Annex; or (E) a finding of FOCI that impairs the person's eligibility for a security clearance. No Security Board Member may be removed without cause except with the prior written consent of the Government Parties.

(b) Security Director. The Security Director may be removed only with the prior written consent of the Government Parties. Any request for removal of the Security Director shall set forth in reasonable detail the grounds for such request and shall be submitted to the Government Parties for consideration no fewer than thirty (30) days before the proposed effective date of removal.

(c) HSAG Designees. HSAG Designees serve at the pleasure of HSAG (acting through Buyer), subject to: (i) advance written notification to the Government Parties of any proposed change in HSAG Designees, provided no fewer than thirty (30) calendar days before the effective date of such change; and (ii) the objection right of the Government Parties set forth in Section 2.4(c). HSAG may replace an HSAG Designee at any time in compliance with the foregoing requirements.

(d) Vacancies. Any vacancy in a Security Board Member position shall be filled within sixty (60) calendar days of the date on which such vacancy occurs. During any period in which a Security Board Member position is vacant, the remaining Security Board Members shall constitute the GSC and shall exercise all GSC authority without interruption. In no event shall the number of Security Board Members serving on the Board fall below two (2) for a period exceeding sixty (60) days without the prior written consent of the Government Parties.

Section 2.6 — Transition from Pre-Closing Board

(a) Pre-Closing Board. Immediately prior to the Closing Date, the Board of Directors of VPI consisted of the following five (5) members:

(i) Dr. Nathan Trevorrow — Chairman of the Board and Chief Executive Officer;

(ii) Marissa Sung-Avila — Director, President, and Chief Operating Officer;

(iii) Franklin Yee — Director, designee of Ridgecrest Ventures Fund III, L.P.;

(iv) Olivia Hartmann — Director, designee of Cascadian Capital Partners Growth Fund II, L.P.; and

(v) Adrienne Delacroix — Independent Director.

(b) Resignations. The resignations of Franklin Yee and Olivia Hartmann from the Board of VPI were obtained at or prior to the Closing, effective as of the Closing Date. Such resignations were a condition precedent to the consummation of the Transaction and were coordinated with the secondary sales of the equity interests held by Ridgecrest Ventures Fund III, L.P. and Cascadian Capital Partners Growth Fund II, L.P. to Buyer.

(c) Management Transition. Dr. Nathan Trevorrow and Marissa Sung-Avila shall continue as officers of VPI following the Closing Date and are designated as Key Personnel under Article VI. However, Dr. Trevorrow and Ms. Sung-Avila shall not serve on the reconstituted Board as of the Closing Date. Either individual may be designated as a Security Board Member in the future, subject to (i) nomination by the GSC or HSAG, (ii) approval by the Government Parties and DCSA, and (iii) satisfaction of all qualification requirements set forth in Section 2.2.

(d) Reconstitution Timing. The reconstitution of the Board contemplated by this Article II shall be effective as of the Closing Date. To the extent that any Security Board Member position (including the Security Director position) has not been filled as of the Closing Date, the transitional provisions of Section 2.2(c)(iii) and Section 2.5(d) shall apply.

ARTICLE III — GOVERNMENT SECURITY COMMITTEE

Section 3.1 — Establishment

Effective as of the Closing Date, the Board shall establish a standing committee designated the "Government Security Committee" (the "GSC"), which shall operate as a committee of the Board with the exclusive authority set forth in Article IV and the duties, responsibilities, and operating procedures set forth in this Article III. The establishment of the GSC is a material term of the NSA and is a condition to the Government Parties' approval of the Transaction.

Section 3.2 — Composition

The GSC shall consist exclusively of the three (3) Security Board Members. The Security Director shall serve as the chair of the GSC and shall preside over all meetings and proceedings thereof. No HSAG Designee may serve on the GSC, attend meetings of the GSC (whether in person, by telephone, by videoconference, or by any other means), or receive, review, or have access to the minutes, materials, agendas, reports, or any other records of the GSC, except as expressly authorized under Section 3.7 of this Annex. Any inadvertent disclosure of GSC materials to an HSAG Designee or to any HSAG personnel shall be promptly reported to the Government Parties and the Third-Party Monitor as a potential security incident.

Section 3.3 — Quorum and Voting

(a) Quorum. A quorum of the GSC shall consist of two (2) of the three (3) Security Board Members, at least one (1) of whom must be the Security Director, except during any period of temporary vacancy in the Security Director position, during which any two (2) Security Board Members shall constitute a quorum.

(b) Voting. All decisions of the GSC shall be by majority vote of the members present at a duly constituted meeting at which a quorum is present. Each Security Board Member shall have one (1) vote. The Security Director shall not have a casting vote except in proceedings of the full Board as provided in Section 5.2(c).

(c) Written Consent. The GSC may act by unanimous written consent in lieu of a meeting, provided that such written consent is documented and maintained in accordance with Section 3.4(c). Written consent actions shall have the same force and effect as actions taken at a duly convened meeting.

Section 3.4 — Meetings

(a) Frequency. The GSC shall meet no fewer than four (4) times per calendar year (i.e., at least quarterly), and additionally as needed to address matters within its exclusive authority. Special meetings may be called by the Security Director, by any Security Board Member, or at the request of the Government Parties or the Third-Party Monitor.

(b) Location and Manner. Meetings of the GSC may be held in person at VPI's Colorado Springs headquarters (7400 Ridgeline Parkway, Colorado Springs, CO 80919) or VPI's Albuquerque fabrication facility (9200 Innovation Boulevard, Albuquerque, NM 87113), or by secure communication means approved by DCSA in accordance with NISPOM requirements and any applicable intelligence Community Directives ("ICDs"). Meetings involving the discussion of information classified at the TOP SECRET or SCI level shall be conducted only in approved Sensitive Compartmented Information Facilities ("SCIFs") or other facilities meeting the applicable security requirements.

(c) Minutes and Records. The GSC shall maintain detailed written minutes of all meetings, including a record of all matters discussed, decisions made, and actions taken. Minutes shall be classified at the appropriate level (CONFIDENTIAL, SECRET, TOP SECRET, or SCI, as applicable) based on the content discussed, and shall be stored, transmitted, and safeguarded in accordance with DCSA requirements, NISPOM provisions, and applicable intelligence Community directives. Minutes and supporting materials shall be maintained in the GSC Repository described in Section 7.3(a).

(d) Restrictions on Dissemination. Minutes and materials of the GSC shall not be shared with HSAG Designees, HSAG personnel, or any person who does not hold an appropriate security clearance and a need-to-know, unless such materials have been declassified and specifically cleared for release by the GSC in accordance with Section 3.7.

Section 3.5 — Reporting to Government Parties

(a) Quarterly Reports. The GSC shall provide quarterly reports to the Government Parties (through DCSA and the monitoring agencies designated in the NSA) summarizing the following matters:

(i) The status of VPI's classified and ITAR-controlled programs, including contract performance, milestone achievements, and any material changes to program scope, schedule, or budget;

(ii) Personnel security matters, including the number and status of security clearances granted, denied, suspended, or revoked during the reporting period, and any adverse information received concerning cleared personnel;

(iii) Facility security matters, including the status of VPI's Facility Security Clearance, any physical security modifications, and the results of any DCSA security vulnerability assessments or inspections;

(iv) Any actual or suspected violations of the NSA, this Annex, or any other Annex thereto, including violations of the Technology Control Plan (Annex B) or the Cybersecurity Requirements (Annex D);

(v) Any attempted unauthorized access to Classified Information, Controlled Technical Data, Controlled Unclassified Information, or restricted areas of VPI's facilities by HSAG personnel, HSAG Designees, or third parties; and

(vi) Any other matter that the GSC reasonably determines to be material to the national security interests protected by the NSA.

(b) Prompt Notification. In addition to the quarterly reports described in clause (a) above, the GSC shall promptly notify the Government Parties and the Third-Party Monitor (Whitmore Compliance Group LLC; principal: Gerald Whitmore) of any material security incident, including any incident that requires reporting to DCSA under the NISPOM, any cybersecurity breach affecting classified or CUI systems, and any suspected espionage, sabotage, or other counterintelligence concern. Such prompt notification shall be made within the timelines set forth in Section 9.3 of this Annex and Annex D.

Section 3.6 — GSC Support and Resources

(a) Staff Support. VPI shall provide the GSC with dedicated staff support sufficient to enable the GSC to discharge its duties effectively, including direct access to VPI's Facility Security Officer (initially Col. (Ret.) Bryce Hendrickson), VPI's information security personnel, and such other VPI employees as the GSC may reasonably request.

(b) Funding. VPI shall bear all reasonable costs and expenses associated with the operations of the GSC, including costs of meetings, travel, communications, record-keeping, and administrative support. HSAG shall ensure that VPI is adequately funded to meet these obligations and shall not take any action, whether through dividend policies, intercompany transfers, or otherwise, that would impair VPI's ability to provide adequate support and resources to the GSC.

(c) Independent Advisors. The GSC may retain independent legal counsel, outside consultants, security experts, or other advisors at VPI's expense, as the GSC deems necessary or advisable in the discharge of its duties. Any such advisor who requires access to classified information or restricted areas of VPI's facilities must receive prior approval from the Government Parties and must hold an appropriate security clearance. The engagement of outside advisors by the GSC shall not require the approval of the full Board or of HSAG.

Section 3.7 — Limited Information Sharing with HSAG Designees

The GSC may, in its sole and absolute discretion, share certain limited, unclassified, and non-controlled summary information with HSAG Designees regarding matters within the GSC's exclusive authority, provided that all of the following conditions are satisfied:

(a) Such information has been reviewed and expressly approved for release by a majority vote of the GSC (or, if sharing occurs outside of a formal meeting, by the unanimous written consent of the Security Board Members);

(b) No Classified Information (at any level), Controlled Technical Data, ITAR-controlled defense articles or technical data, EAR-controlled items or technology, Controlled Unclassified Information, or any other information the disclosure of which could compromise U.S. national security, is included in or inferable from the information shared;

(c) The sharing of such information does not compromise the security, integrity, or operational details of any classified or controlled program, contract, or activity;

(d) The GSC documents the scope, content, and recipients of any information shared pursuant to this Section 3.7, and maintains such documentation in the GSC Repository; and

(e) The information shared is limited to the minimum necessary to enable the HSAG Designees to perform their duties as directors of VPI with respect to matters within the authority of the full Board.

The determination of whether any particular information satisfies the conditions of this Section 3.7 shall be made solely by the GSC, and such determination shall not be subject to challenge or appeal by HSAG, Buyer, or the HSAG Designees.

ARTICLE IV — EXCLUSIVE AUTHORITY OF THE GSC

Section 4.1 — Matters Requiring GSC-Only Approval

The following matters are within the exclusive authority of the GSC, and no action may be taken by VPI, the Board, HSAG, Buyer, or any officer, employee, or agent of VPI with respect to any such matter without the prior approval of the GSC (and, where indicated below or in Section 4.2, the Government Parties). The full Board, the HSAG Designees, and HSAG shall have no authority to approve, direct, influence, or override any decision of the GSC with respect to the matters set forth in this Section 4.1.

(a) Classified Programs and Contracts.

All decisions relating to the performance, modification, extension, renewal, termination, or novation of classified U.S. government contracts (whether held as prime contracts or subcontracts), and all decisions relating to the bidding on, pursuit of, or proposal for new classified contracts or classified modifications to existing contracts. As of the Closing Date, VPI holds fourteen (14) active classified U.S. Department of Defense contracts (prime and subcontract), with an aggregate backlog of approximately one hundred ninety-three million dollars ($193,000,000), including the following principal programs:

(i) U.S. Army Program Executive Office for intelligence, Electronic Warfare and Sensors (PEO IEW&S): Backlog of approximately $52.3 million for the design and manufacture of AN/TPS-80 radar gallium nitride high electron mobility transistor (GaN HEMT) modules;

(ii) Air Force Research Laboratory (AFRL): Backlog of approximately $41.7 million for the development and production of next-generation millimeter-wave (mmWave) power amplifiers for advanced radar and electronic warfare systems;

(iii) Missile Defense Agency (MDA): Backlog of approximately $38.9 million for the design and manufacture of GaN-based transmit/receive (T/R) modules for ground-based and sea-based missile defense radar systems;

(iv) Subcontract to Ironclad Defense Systems Inc. under U.S. Navy Naval Sea Systems Command (NAVSEA): Backlog of approximately $34.1 million for GaN power amplifier modules integrated into advanced shipboard electronic warfare suites; and

(v) Department of Homeland Security Science and Technology Directorate (DHS S&T): Backlog of approximately $26.0 million for the development and manufacture of radio frequency (RF) components for advanced border surveillance systems.

The GSC shall also have exclusive authority over any decisions relating to the pursuit, negotiation, or execution of new classified contracts, task orders, delivery orders, or modifications, and over any interactions with classified program customers or contracting officers relating to classified contract matters.

(b) Personnel Security.

All decisions regarding the hiring, termination, reassignment, promotion, demotion, change of duties, or change of access level of any VPI employee who holds, or who is required by the terms of any government contract or program to hold, a U.S. government personnel security clearance. As of the Closing Date, approximately two hundred twelve (212) of VPI's four hundred eighty-six (486) total employees (approximately 43.6%) hold active U.S. government security clearances at the CONFIDENTIAL, SECRET, or TOP SECRET/SCI levels.

The GSC's exclusive authority extends to:

(i) The processing, sponsorship, and adjudication support for new security clearance applications, clearance level upgrades, and periodic reinvestigations;

(ii) The review and disposition of adverse clearance actions, including clearance suspensions and revocations;

(iii) The designation and replacement of the Facility Security Officer ("FSO") and the Information System Security Manager ("ISSM"); and

(iv) The management of insider threat programs and the implementation of continuous evaluation monitoring for cleared personnel as required by Security Executive Agent Directive 6 ("SEAD 6") or any successor directive.

All decisions relating to VPI's Facility Security Clearance ("FCL"), which is currently held at the SECRET level (CAGE Code 7VK92) at the Albuquerque, New Mexico fabrication facility (9200 Innovation Boulevard, Albuquerque, NM 87113), a facility encompassing approximately forty-five thousand (45,000) square feet of GaN-on-SiC semiconductor fabrication capacity. The GSC's exclusive authority in this area includes, without limitation:

(i) All decisions relating to physical security measures for classified areas of the Albuquerque Fab, including Sections C-7, C-8, C-9, C-10, C-11, and C-12 of the clean room complex;

(ii) Access control protocols, intrusion detection systems, closed-circuit video surveillance, visitor management, and guard force requirements for classified areas;

(iii) Coordination with DCSA on all matters relating to VPI's FCL, including industrial security inspections, security vulnerability assessments, and FOCI mitigation compliance reviews;

(iv) Implementation of FOCI mitigation measures as required by the NSA and the NISPOM; and

(v) Approval of any proposed construction, renovation, relocation, or closure of any VPI facility in which classified work is performed or classified information is stored.

(d) ITAR/EAR-Controlled Activities.

All decisions relating to the manufacture, assembly, testing, export, re-export, retransfer, or temporary import of defense articles, defense services, or technical data controlled under the International Traffic in Arms Regulations ("ITAR") and the Export Administration Regulations ("EAR"), including, without limitation:

(i) Items controlled under United States Munitions List ("USML") Category XI(a)(3) (Military Electronics — Microwave Monolithic Integrated Circuits (MMICs) and related components);

(ii) Items controlled under Export Control Classification Numbers ("ECCNs") 3A001 (Electronic Components), 3A991 (Electronic Items Not Controlled by 3A001), and 3E001 (Technology for the Development or Production of Equipment or Materials Controlled by 3A) on the Commerce Control List;

(iii) Maintenance of VPI's registration with the Directorate of Defense Trade Controls ("DDTC") of the U.S. Department of State (Registration No. M-24817);

(iv) The preparation, submission, amendment, and compliance monitoring of DSP-5 export license applications and any other ITAR license or authorization applications. As of the Closing Date, VPI holds three (3) active DSP-5 licenses authorizing deliveries of defense articles to NATO allied customers in the United Kingdom and Australia; and

(v) Implementation, oversight, and compliance monitoring of the Technology Control Plan set forth in Annex B to the NSA, including the designation of Empowered Officials, the management of deemed export controls, and the training of VPI personnel on export control requirements.

(e) Cybersecurity for Classified and Controlled Systems.

Oversight of all cybersecurity requirements applicable to VPI's classified information systems, Controlled Unclassified Information ("CUI") systems, and systems processing ITAR- or EAR-controlled data, as set forth in Annex D (Cybersecurity Requirements) to the NSA. The GSC's exclusive authority in this area includes:

(i) Oversight of VPI's compliance with the cybersecurity requirements of National Institute of Standards and Technology Special Publication 800-171 ("NIST SP 800-171") for the protection of CUI, and any applicable classified system security requirements;

(ii) Approval of incident response actions, containment strategies, remediation plans, and recovery procedures for cybersecurity events affecting classified or controlled systems;

(iii) Oversight of VPI's compliance with the seventy-two (72) hour cybersecurity incident reporting obligations to DCSA and other applicable agencies as set forth in Annex D; and

(iv) Review and approval of annual system security plans, plans of action and milestones ("POA&Ms"), and the results of third-party penetration testing as required by Annex D.

(f) Third-Party Monitor Coordination.

The GSC shall serve as the primary point of contact for the Third-Party Monitor (Whitmore Compliance Group LLC) with respect to all matters relating to classified programs, controlled technologies, personnel and facility security, and compliance with the NSA and this Annex. The GSC shall:

(i) Coordinate with the Third-Party Monitor on all scheduled and unscheduled compliance reviews, audits, site visits, and inspections;

(ii) Review and provide written comments on the Third-Party Monitor's annual compliance audit report (prepared in accordance with the template set forth in Annex E to the NSA) before such report is submitted to the Government Parties; and

(iii) Ensure that all materials and information requested by the Third-Party Monitor in the performance of its monitoring duties are provided promptly and completely, at the appropriate classification level.

(g) Government Party Notifications.

All required notifications to CFIUS, DCSA, and other Government Parties regarding material changes to VPI's business, classified programs, security posture, or governance, including, without limitation:

(i) Thirty (30) day pre-notifications of material changes as required by the NSA, including proposed divestitures, new foreign subcontracts or supplier arrangements, and changes to cleared personnel;

(ii) Notifications required by DCSA in connection with VPI's FCL and FOCI mitigation status;

(iii) Notifications required under ITAR and EAR relating to changes in ownership, corporate structure, or registered activities; and

(iv) Any other notifications required by applicable law, regulation, or the terms of the NSA.

Section 4.2 — Government Party Approval Requirements

Certain matters within the GSC's exclusive authority additionally require the prior written approval of the Government Parties (which approval may be granted through the CFIUS Staff Chair, the Department of Defense monitoring representative, or the Department of Energy monitoring representative, as applicable). Such matters include:

(a) Any change to the identity or role of VPI's Facility Security Officer;

(b) Any material modification to VPI's Facility Security Clearance, including any upgrade, downgrade, or termination thereof;

(c) Any proposed access by HSAG personnel (including HSAG Designees) to classified facilities, including Sections C-7 through C-12 of the Albuquerque Fab clean room, which access is governed by Annex F (Facility Access Procedures);

(d) The appointment or replacement of any Security Board Member, including the Security Director, as set forth in Section 2.4(b); and

(e) Any other matter specifically identified in the NSA as requiring Government Party approval.

The Government Parties shall use reasonable efforts to respond to requests for approval under this Section 4.2 within thirty (30) calendar days of receipt of a complete request, but the Government Parties shall not be bound by any specific response timeline, and the absence of a response shall not be deemed to constitute approval.

ARTICLE V — AUTHORITY OF THE FULL BOARD

Section 5.1 — Matters Requiring Full Board Approval

The following matters require the approval of the full Board of Directors of VPI, acting through the affirmative vote of a majority of directors present at a duly constituted meeting at which a quorum (as defined in Section 5.2) is present. The full Board's authority under this Article V is subject in all respects to the exclusions set forth in Article IV, and the full Board shall have no authority to act on any matter within the exclusive authority of the GSC.

(a) Business Strategy and Operations (Non-Classified).

(i) Adoption and material modification of VPI's general business strategy, annual business plans, and annual operating budgets for VPI's unclassified commercial operations, including VPI's commercial 5G infrastructure product lines (GaN power amplifiers for 5G base stations, small cells, and massive MIMO antenna arrays);

(ii) Approval of individual capital expenditures or commitments in excess of a threshold to be established by Board resolution, which threshold shall initially be set at five million dollars ($5,000,000) per transaction or series of related transactions;

(iii) Entry into new commercial (non-classified) product markets, new geographic markets, or new customer segments; and

(iv) Approval of material commercial partnerships, joint development agreements, or technology licensing agreements that do not involve classified or ITAR/EAR-controlled technologies.

(b) Financial Matters.

(i) Review and approval of VPI's annual audited financial statements, prepared in accordance with U.S. generally accepted accounting principles ("GAAP") and audited by VPI's independent registered public accounting firm (currently Arbor & Greenfield LLP, engagement partner Joan Greenfield);

(ii) Establishment, modification, or termination of dividend or distribution policies;

(iii) Incurrence of indebtedness (including borrowings, lines of credit, term loans, and capital leases), guarantees, or liens, other than in the ordinary course of business consistent with past practice;

(iv) Approval of related-party transactions between VPI and HSAG or any affiliate of HSAG, including intercompany service agreements, technology license agreements, transfer pricing arrangements, and management fee arrangements; and

(v) Approval of the annual budget for the GSC's operations and support costs, which shall be presented to the full Board by the GSC for informational purposes but shall not be subject to reduction by the full Board below the level reasonably necessary for the GSC to discharge its duties.

(i) Amendments to VPI's Certificate of Incorporation or Bylaws, subject to the requirement that all such amendments comply with the NSA and this Annex, and subject to the prior notification requirements of the NSA;

(ii) Mergers, acquisitions, investments, joint ventures, or divestitures involving VPI's unclassified business lines or assets, provided that any such transaction involving VPI's classified business lines, classified contracts, or ITAR/EAR-controlled operations requires GSC approval and may additionally require CFIUS pre-notification or a new CFIUS filing;

(iii) Settlement of material litigation or arbitration proceedings involving VPI, where the settlement amount exceeds one million dollars ($1,000,000) or involves non-monetary terms that could affect VPI's operations or compliance posture; and

(iv) Selection and engagement of VPI's independent auditors, and approval of the scope and terms of the annual audit engagement.

(d) Compensation and Non-Cleared Personnel.

(i) Approval of executive compensation arrangements (including base salary, annual bonus, long-term incentive awards, and severance arrangements) for VPI's non-cleared officers, including the Chief Financial Officer (currently Derek Wainsborough) and other non-cleared senior executives;

(ii) Adoption, amendment, or termination of equity incentive plans, stock option plans, restricted stock unit plans, and similar compensatory programs;

(iii) Granting of individual equity awards, stock options, or other compensatory equity interests to non-cleared employees; and

(iv) Hiring and termination of non-cleared senior executives at the vice president level and above.

(e) Compliance Oversight (Non-Classified).

(i) Oversight of VPI's general corporate compliance programs, including programs addressing anti-corruption (Foreign Corrupt Practices Act and UK Bribery Act), anti-money laundering, economic sanctions compliance (Office of Foreign Assets Control, Bureau of Industry and Security), and general ethics and business conduct;

(ii) Tax compliance matters, including federal, state, and local tax filings and planning;

(iii) Environmental, health, and safety compliance matters; and

(iv) General regulatory compliance matters not within the exclusive authority of the GSC under Article IV.

Section 5.2 — Quorum for Full Board

(a) Quorum. A quorum of the full Board of Directors shall consist of three (3) of the five (5) directors, provided that such quorum must include at least one (1) Security Board Member and at least one (1) HSAG Designee. If a quorum cannot be assembled due to a vacancy, the remaining directors shall use best efforts to fill such vacancy in accordance with Article II before taking action on any matter requiring full Board approval.

(b) Voting. Decisions of the full Board shall be by majority vote of the directors present at a duly constituted meeting at which a quorum is present. Each director shall have one (1) vote.

ANNEX C
TO NATIONAL SECURITY AGREEMENT (NSA-2024-0019)
GOVERNANCE PROVISIONS AND SECURITY BOARD CHARTER
FOR Marlowe Asset Management PHOTONICS INC.
CFIUS Case No.: CFIUS-023-07-3841
NSA Docket Reference: NSA-2024-0019
This Annex C (this "Annex") is entered into as of the Closing Date (as defined below) by and among:
Halcyon Semiconductor Aktiengesellschaft, a stock corporation (Aktiengesellschaft) organized and existing under the laws of the Federal Republic of Germany ("HSAG");
Halcyon US Holdings Inc., a Delaware corporation and a wholly owned subsidiary of HSAG ("Buyer");
Marlowe Asset Management Photonics Inc., a Delaware corporation ("VPI" or the "Company"); and
The United States of America, acting through the U.S. Department of the Treasury, the U.S. Department of Defense, and the U.S. Department of Energy (collectively, the "Government Parties"),
each a "Party" and collectively the "Parties."
This Annex constitutes Annex C to the National Security Agreement dated January 19, 2024 (the "Agreement" or "NSA") among the Parties, entered into in connection with the review by the Committee on Foreign Investment in the United States ("CFIUS") of the acquisition of one hundred percent (100%) of the outstanding equity interests of VPI by Buyer (the "Transaction"), under CFIUS Case No. CFIUS-023-07-3841.
Effective Date. This Annex shall become effective as of the date of consummation of the Transaction (the "Closing Date"), which occurred on February 9, 2024.
Right-click to update Table of Contents
ARTICLE I — PURPOSE AND SCOPE
Section 1.1 — Purpose
This Annex establishes the comprehensive governance framework for VPI following the Closing Date, including, without limitation: (a) the reconstitution of VPI's Board of Directors (the "Board"); (b) the establishment of the Government Security Committee (the "GSC") as a standing committee of the Board vested with exclusive authority over matters affecting the national security of the United States; and (c) the allocation of decision-making authority between the full Board and the GSC to ensure the clear demarcation of responsibilities relating to classified programs, controlled technologies, and personnel and facility security from those relating to general commercial and corporate operations.
The purpose of the governance framework set forth herein is to ensure the effective and continuing protection of U.S. national security interests arising from VPI's participation in classified programs of the U.S. Department of Defense, the Missile Defense Agency, the U.S. Air Force Research Laboratory, and other agencies, and from VPI's development and manufacture of defense articles and dual-use technologies subject to the International Traffic in Arms Regulations ("ITAR") and the Export Administration Regulations ("EAR"), while simultaneously permitting HSAG, through Buyer, to exercise legitimate ownership rights consistent with the terms and conditions of the NSA. Nothing in this Annex is intended to prevent HSAG from realizing the commercial and economic benefits of its investment in VPI, so long as the exercise of such rights does not compromise the national security protections mandated by the NSA and applicable law.
Section 1.2 — Scope
This Annex governs all matters relating to VPI's board composition, committee structure, governance authority, information-barrier requirements, and the related allocation of decision-making rights and responsibilities as required by the NSA. The provisions of this Annex are binding on VPI, HSAG, Buyer, and each of their respective officers, directors, employees, agents, and representatives to the extent of their involvement in VPI's governance.
This Annex applies to VPI and all of its subsidiaries, divisions, business units, and facilities, including, without limitation:
(a) VPI's corporate headquarters, located at 7400 Ridgeline Parkway, Colorado Springs, Colorado 80919; and
(b) VPI's fabrication facility, located at 9200 Innovation Boulevard, Albuquerque, New Mexico 87113 (the "Albuquerque Fab"), which houses VPI's gallium nitride on silicon carbide (GaN-on-SiC) semiconductor fabrication operations and classified manufacturing areas.
This Annex supplements but does not replace VPI's Amended and Restated Certificate of Incorporation, as filed with the Secretary of State of the State of Delaware, or VPI's Amended and Restated Bylaws (collectively, the "Organizational Documents"). The Organizational Documents shall be amended as promptly as practicable following the Closing Date, and in any event no later than thirty (30) calendar days following the Closing Date, to conform with the requirements of this Annex. In the event of any inconsistency between the Organizational Documents and this Annex, the provisions of this Annex shall govern.
Section 1.3 — Relationship to NSA
This Annex is an integral part of the NSA and is incorporated therein by reference. In the event of any conflict or inconsistency between any provision of this Annex and any provision of the body of the NSA, the provisions of the NSA shall control. Capitalized terms used but not defined in this Annex shall have the meanings ascribed to them in Annex A (Definitions) to the NSA. References in this Annex to other Annexes to the NSA (including Annex B (Technology Control Plan), Annex D (Cybersecurity Requirements), Annex E (Compliance Audit Template), and Annex F (Facility Access Procedures)) are references to such Annexes as in effect from time to time, including as amended in accordance with the amendment provisions of the NSA.
ARTICLE II — RECONSTITUTION OF THE BOARD OF DIRECTORS
Section 2.1 — Board Size and Composition
Effective as of the Closing Date, the Board of Directors of VPI shall be reconstituted to consist of five (5) members, as follows:
(a) Three (3) Security Board Members, as defined in and subject to the qualifications set forth in Section 2.2 of this Annex; and
(b) Two (2) HSAG Designees, as defined in and subject to the conditions set forth in Section 2.3 of this Annex.
The Board shall at all times consist of exactly five (5) members constituted as set forth above, unless otherwise agreed in writing by all Parties, including the Government Parties. No person may serve on the Board unless appointed in accordance with the procedures set forth in this Article II.
Section 2.2 — Security Board Members
(a) Qualifications. Each Security Board Member must satisfy all of the following qualification requirements at the time of appointment and at all times during such person's service on the Board:
(i) Such person must be a citizen of the United States of America;
(ii) Such person must be the holder of, or must be eligible for and willing to undergo the investigation required for, a personnel security clearance at the TOP SECRET/Sensitive Compartmented Information (TS/SCI) level, granted by an agency of the United States Government;
(iii) Such person must not be an officer, director, employee, consultant, or agent of HSAG or any non-U.S. affiliate of HSAG (other than VPI itself and its wholly owned U.S. subsidiaries, if any);
(iv) Such person must be free from any foreign ownership, control, or influence ("FOCI") that would impair such person's eligibility for a U.S. government security clearance under the National Industrial Security Program Operating Manual ("NISPOM"), 32 C.F.R. Part 117, or any successor regulation; and
(v) Such person must not have been convicted of any felony or any offense involving moral turpitude, espionage, sabotage, or unauthorized disclosure of classified information.
(b) Security Director. One (1) of the three (3) Security Board Members shall be designated as the "Security Director." The Security Director shall serve as an independent director who is not affiliated with either VPI's management team or HSAG (or any affiliate of HSAG), and shall serve as the chair of the GSC. The Security Director must have demonstrated experience in national security, defense, intelligence, or counterintelligence matters, and must hold an active TS/SCI clearance at the time of appointment.
(c) Initial Security Board Members. Subject to the approval of the Government Parties and the Defense Counterintelligence and Security Agency ("DCSA"), the initial Security Board Members, effective as of the Closing Date, shall be:
(i) Col. (Ret.) Bryce Hendrickson, USAF — Currently serving as Vice President, Government Programs, and Facility Security Officer of VPI. Col. Hendrickson holds an active personnel security clearance at the TS/SCI level. Col. Hendrickson shall serve as a Security Board Member and shall continue in his capacity as FSO, reporting functionally to the GSC on all security matters.
(ii) Adrienne Delacroix — Currently serving as an independent director on VPI's pre-closing Board of Directors. Ms. Delacroix holds an active personnel security clearance at the SECRET level. HSAG and VPI shall submit and diligently pursue an application for the upgrade of Ms. Delacroix's clearance to the TS/SCI level, which upgrade shall be completed within one hundred eighty (180) days of the Closing Date or as soon thereafter as reasonably practicable. Pending the completion of such upgrade, Ms. Delacroix shall be entitled to participate in GSC proceedings to the extent that her existing SECRET clearance permits access to the subject matter under discussion, and shall be recused from any proceedings involving information classified at the TOP SECRET or SCI level.
(iii) Independent Security Director — To Be Nominated. HSAG shall nominate an independent individual to serve as the Security Director. Such nomination shall be submitted to the Government Parties and DCSA for review and approval no later than thirty (30) days following the Closing Date. Until the Security Director is appointed, Col. (Ret.) Bryce Hendrickson shall serve as interim chair of the GSC, subject to Government Party consent.
Section 2.3 — HSAG Designees
(a) Designation Rights. HSAG (acting through Buyer, as VPI's sole stockholder) shall have the right to designate two (2) members of the Board (the "HSAG Designees"). The HSAG Designees may be officers, employees, or other representatives of HSAG or any of its affiliates, and need not be independent of HSAG.
(b) Citizenship and Clearance. HSAG Designees are not required to be citizens of the United States and are not required to hold any U.S. government security clearance. HSAG Designees may be nationals of any country, subject to the Government Parties' objection right set forth in Section 2.4.
(c) Exclusions from Access. Notwithstanding any provision of VPI's Organizational Documents, applicable corporate law, or any other agreement, HSAG Designees shall be excluded from access to:
(i) All Classified Information, as defined in the NSA and Executive Order 13526 (or any successor executive order), including information classified at the CONFIDENTIAL, SECRET, TOP SECRET, and SCI levels;
(ii) All Controlled Technical Data subject to the International Traffic in Arms Regulations ("ITAR," 22 C.F.R. Parts 120–130) or the Export Administration Regulations ("EAR," 15 C.F.R. Parts 730–774), as further governed by the Technology Control Plan set forth in Annex B to the NSA;
(iii) All Controlled Unclassified Information ("CUI") designated for protection under 32 C.F.R. Part 2002 and identified in the Technology Control Plan;
(iv) All discussions, deliberations, materials, presentations, memoranda, reports, and minutes relating to matters within the exclusive authority of the GSC as set forth in Article IV of this Annex; and
(v) All areas of VPI's facilities designated as classified or restricted-access areas, including Sections C-7 through C-12 of the Albuquerque Fab clean room, as described in Annex F (Facility Access Procedures).
(d) Full Board Participation. Subject to the exclusions set forth in clause (c) above, HSAG Designees shall be entitled to participate in and vote on all matters within the authority of the full Board as set forth in Article V of this Annex, and shall receive all information and materials reasonably necessary for the discharge of their duties as directors of VPI in respect of such matters.
Section 2.4 — Qualifications and Vetting
(a) Advance Identification. All proposed Board members, whether Security Board Members or HSAG Designees, shall be identified to the Government Parties (through the CFIUS Staff Chair at the Department of the Treasury and the designated monitoring contacts at the Department of Defense and the Department of Energy) no fewer than thirty (30) calendar days prior to the effective date of their appointment to the Board.
(b) Security Board Member Approval. The appointment of any Security Board Member (including any replacement thereof) is subject to the prior written approval of both the Government Parties and DCSA. HSAG and VPI shall provide all information reasonably requested by the Government Parties and DCSA in connection with the vetting and approval of proposed Security Board Members, including, without limitation, biographical information, financial disclosure statements, and authorization for background investigations.
(c) HSAG Designee Review. The appointment of any HSAG Designee is subject to review by the Government Parties. The Government Parties may object to the appointment of any HSAG Designee whose appointment would, in the reasonable judgment of the Government Parties, pose a risk to the national security of the United States, including by reason of such person's connections to foreign governments, foreign intelligence services, sanctioned entities, or other circumstances that would compromise the integrity of the governance framework established by this Annex. HSAG shall not appoint any HSAG Designee to whom the Government Parties have objected in writing.
(d) Ongoing Compliance. Each Board member shall promptly notify the GSC and the Government Parties of any change in circumstances that could affect such person's continued qualification under this Section 2.4, including any change in citizenship, clearance status, employment, or affiliation with foreign persons or entities.
Section 2.5 — Term and Removal
(a) Security Board Members. Each Security Board Member shall serve on the Board until the earliest of: (i) such person's voluntary resignation; (ii) such person's removal for cause, with the prior written approval of the Government Parties; (iii) such person's death or permanent incapacity; or (iv) such person's replacement with a successor who satisfies all qualification requirements set forth in Section 2.2. For purposes of this Section 2.5(a), "cause" means: (A) willful misconduct or gross negligence in the discharge of duties; (B) conviction of a felony; (C) loss or suspension of security clearance; (D) a material breach of the NSA or this Annex; or (E) a finding of FOCI that impairs the person's eligibility for a security clearance. No Security Board Member may be removed without cause except with the prior written consent of the Government Parties.
(b) Security Director. The Security Director may be removed only with the prior written consent of the Government Parties. Any request for removal of the Security Director shall set forth in reasonable detail the grounds for such request and shall be submitted to the Government Parties for consideration no fewer than thirty (30) days before the proposed effective date of removal.
(c) HSAG Designees. HSAG Designees serve at the pleasure of HSAG (acting through Buyer), subject to: (i) advance written notification to the Government Parties of any proposed change in HSAG Designees, provided no fewer than thirty (30) calendar days before the effective date of such change; and (ii) the objection right of the Government Parties set forth in Section 2.4(c). HSAG may replace an HSAG Designee at any time in compliance with the foregoing requirements.
(d) Vacancies. Any vacancy in a Security Board Member position shall be filled within sixty (60) calendar days of the date on which such vacancy occurs. During any period in which a Security Board Member position is vacant, the remaining Security Board Members shall constitute the GSC and shall exercise all GSC authority without interruption. In no event shall the number of Security Board Members serving on the Board fall below two (2) for a period exceeding sixty (60) days without the prior written consent of the Government Parties.
Section 2.6 — Transition from Pre-Closing Board
(a) Pre-Closing Board. Immediately prior to the Closing Date, the Board of Directors of VPI consisted of the following five (5) members:
(i) Dr. Nathan Trevorrow — Chairman of the Board and Chief Executive Officer;
(ii) Marissa Sung-Avila — Director, President, and Chief Operating Officer;
(iii) Franklin Yee — Director, designee of Ridgecrest Ventures Fund III, L.P.;
(iv) Olivia Hartmann — Director, designee of Cascadian Capital Partners Growth Fund II, L.P.; and
(v) Adrienne Delacroix — Independent Director.
(b) Resignations. The resignations of Franklin Yee and Olivia Hartmann from the Board of VPI were obtained at or prior to the Closing, effective as of the Closing Date. Such resignations were a condition precedent to the consummation of the Transaction and were coordinated with the secondary sales of the equity interests held by Ridgecrest Ventures Fund III, L.P. and Cascadian Capital Partners Growth Fund II, L.P. to Buyer.
(c) Management Transition. Dr. Nathan Trevorrow and Marissa Sung-Avila shall continue as officers of VPI following the Closing Date and are designated as Key Personnel under Article VI. However, Dr. Trevorrow and Ms. Sung-Avila shall not serve on the reconstituted Board as of the Closing Date. Either individual may be designated as a Security Board Member in the future, subject to (i) nomination by the GSC or HSAG, (ii) approval by the Government Parties and DCSA, and (iii) satisfaction of all qualification requirements set forth in Section 2.2.
(d) Reconstitution Timing. The reconstitution of the Board contemplated by this Article II shall be effective as of the Closing Date. To the extent that any Security Board Member position (including the Security Director position) has not been filled as of the Closing Date, the transitional provisions of Section 2.2(c)(iii) and Section 2.5(d) shall apply.
ARTICLE III — GOVERNMENT SECURITY COMMITTEE
Section 3.1 — Establishment
Effective as of the Closing Date, the Board shall establish a standing committee designated the "Government Security Committee" (the "GSC"), which shall operate as a committee of the Board with the exclusive authority set forth in Article IV and the duties, responsibilities, and operating procedures set forth in this Article III. The establishment of the GSC is a material term of the NSA and is a condition to the Government Parties' approval of the Transaction.
Section 3.2 — Composition
The GSC shall consist exclusively of the three (3) Security Board Members. The Security Director shall serve as the chair of the GSC and shall preside over all meetings and proceedings thereof. No HSAG Designee may serve on the GSC, attend meetings of the GSC (whether in person, by telephone, by videoconference, or by any other means), or receive, review, or have access to the minutes, materials, agendas, reports, or any other records of the GSC, except as expressly authorized under Section 3.7 of this Annex. Any inadvertent disclosure of GSC materials to an HSAG Designee or to any HSAG personnel shall be promptly reported to the Government Parties and the Third-Party Monitor as a potential security incident.
Section 3.3 — Quorum and Voting
(a) Quorum. A quorum of the GSC shall consist of two (2) of the three (3) Security Board Members, at least one (1) of whom must be the Security Director, except during any period of temporary vacancy in the Security Director position, during which any two (2) Security Board Members shall constitute a quorum.
(b) Voting. All decisions of the GSC shall be by majority vote of the members present at a duly constituted meeting at which a quorum is present. Each Security Board Member shall have one (1) vote. The Security Director shall not have a casting vote except in proceedings of the full Board as provided in Section 5.2(c).
(c) Written Consent. The GSC may act by unanimous written consent in lieu of a meeting, provided that such written consent is documented and maintained in accordance with Section 3.4(c). Written consent actions shall have the same force and effect as actions taken at a duly convened meeting.
Section 3.4 — Meetings
(a) Frequency. The GSC shall meet no fewer than four (4) times per calendar year (i.e., at least quarterly), and additionally as needed to address matters within its exclusive authority. Special meetings may be called by the Security Director, by any Security Board Member, or at the request of the Government Parties or the Third-Party Monitor.
(b) Location and Manner. Meetings of the GSC may be held in person at VPI's Colorado Springs headquarters (7400 Ridgeline Parkway, Colorado Springs, CO 80919) or VPI's Albuquerque fabrication facility (9200 Innovation Boulevard, Albuquerque, NM 87113), or by secure communication means approved by DCSA in accordance with NISPOM requirements and any applicable intelligence Community Directives ("ICDs"). Meetings involving the discussion of information classified at the TOP SECRET or SCI level shall be conducted only in approved Sensitive Compartmented Information Facilities ("SCIFs") or other facilities meeting the applicable security requirements.
(c) Minutes and Records. The GSC shall maintain detailed written minutes of all meetings, including a record of all matters discussed, decisions made, and actions taken. Minutes shall be classified at the appropriate level (CONFIDENTIAL, SECRET, TOP SECRET, or SCI, as applicable) based on the content discussed, and shall be stored, transmitted, and safeguarded in accordance with DCSA requirements, NISPOM provisions, and applicable intelligence Community directives. Minutes and supporting materials shall be maintained in the GSC Repository described in Section 7.3(a).
(d) Restrictions on Dissemination. Minutes and materials of the GSC shall not be shared with HSAG Designees, HSAG personnel, or any person who does not hold an appropriate security clearance and a need-to-know, unless such materials have been declassified and specifically cleared for release by the GSC in accordance with Section 3.7.
Section 3.5 — Reporting to Government Parties
(a) Quarterly Reports. The GSC shall provide quarterly reports to the Government Parties (through DCSA and the monitoring agencies designated in the NSA) summarizing the following matters:
(i) The status of VPI's classified and ITAR-controlled programs, including contract performance, milestone achievements, and any material changes to program scope, schedule, or budget;
(ii) Personnel security matters, including the number and status of security clearances granted, denied, suspended, or revoked during the reporting period, and any adverse information received concerning cleared personnel;
(iii) Facility security matters, including the status of VPI's Facility Security Clearance, any physical security modifications, and the results of any DCSA security vulnerability assessments or inspections;
(iv) Any actual or suspected violations of the NSA, this Annex, or any other Annex thereto, including violations of the Technology Control Plan (Annex B) or the Cybersecurity Requirements (Annex D);
(v) Any attempted unauthorized access to Classified Information, Controlled Technical Data, Controlled Unclassified Information, or restricted areas of VPI's facilities by HSAG personnel, HSAG Designees, or third parties; and
(vi) Any other matter that the GSC reasonably determines to be material to the national security interests protected by the NSA.
(b) Prompt Notification. In addition to the quarterly reports described in clause (a) above, the GSC shall promptly notify the Government Parties and the Third-Party Monitor (Whitmore Compliance Group LLC; principal: Gerald Whitmore) of any material security incident, including any incident that requires reporting to DCSA under the NISPOM, any cybersecurity breach affecting classified or CUI systems, and any suspected espionage, sabotage, or other counterintelligence concern. Such prompt notification shall be made within the timelines set forth in Section 9.3 of this Annex and Annex D.
Section 3.6 — GSC Support and Resources
(a) Staff Support. VPI shall provide the GSC with dedicated staff support sufficient to enable the GSC to discharge its duties effectively, including direct access to VPI's Facility Security Officer (initially Col. (Ret.) Bryce Hendrickson), VPI's information security personnel, and such other VPI employees as the GSC may reasonably request.
(b) Funding. VPI shall bear all reasonable costs and expenses associated with the operations of the GSC, including costs of meetings, travel, communications, record-keeping, and administrative support. HSAG shall ensure that VPI is adequately funded to meet these obligations and shall not take any action, whether through dividend policies, intercompany transfers, or otherwise, that would impair VPI's ability to provide adequate support and resources to the GSC.
(c) Independent Advisors. The GSC may retain independent legal counsel, outside consultants, security experts, or other advisors at VPI's expense, as the GSC deems necessary or advisable in the discharge of its duties. Any such advisor who requires access to classified information or restricted areas of VPI's facilities must receive prior approval from the Government Parties and must hold an appropriate security clearance. The engagement of outside advisors by the GSC shall not require the approval of the full Board or of HSAG.
Section 3.7 — Limited Information Sharing with HSAG Designees
The GSC may, in its sole and absolute discretion, share certain limited, unclassified, and non-controlled summary information with HSAG Designees regarding matters within the GSC's exclusive authority, provided that all of the following conditions are satisfied:
(a) Such information has been reviewed and expressly approved for release by a majority vote of the GSC (or, if sharing occurs outside of a formal meeting, by the unanimous written consent of the Security Board Members);
(b) No Classified Information (at any level), Controlled Technical Data, ITAR-controlled defense articles or technical data, EAR-controlled items or technology, Controlled Unclassified Information, or any other information the disclosure of which could compromise U.S. national security, is included in or inferable from the information shared;
(c) The sharing of such information does not compromise the security, integrity, or operational details of any classified or controlled program, contract, or activity;
(d) The GSC documents the scope, content, and recipients of any information shared pursuant to this Section 3.7, and maintains such documentation in the GSC Repository; and
(e) The information shared is limited to the minimum necessary to enable the HSAG Designees to perform their duties as directors of VPI with respect to matters within the authority of the full Board.
The determination of whether any particular information satisfies the conditions of this Section 3.7 shall be made solely by the GSC, and such determination shall not be subject to challenge or appeal by HSAG, Buyer, or the HSAG Designees.
ARTICLE IV — EXCLUSIVE AUTHORITY OF THE GSC
Section 4.1 — Matters Requiring GSC-Only Approval
The following matters are within the exclusive authority of the GSC, and no action may be taken by VPI, the Board, HSAG, Buyer, or any officer, employee, or agent of VPI with respect to any such matter without the prior approval of the GSC (and, where indicated below or in Section 4.2, the Government Parties). The full Board, the HSAG Designees, and HSAG shall have no authority to approve, direct, influence, or override any decision of the GSC with respect to the matters set forth in this Section 4.1.
(a) Classified Programs and Contracts.
All decisions relating to the performance, modification, extension, renewal, termination, or novation of classified U.S. government contracts (whether held as prime contracts or subcontracts), and all decisions relating to the bidding on, pursuit of, or proposal for new classified contracts or classified modifications to existing contracts. As of the Closing Date, VPI holds fourteen (14) active classified U.S. Department of Defense contracts (prime and subcontract), with an aggregate backlog of approximately one hundred ninety-three million dollars ($193,000,000), including the following principal programs:
(i) U.S. Army Program Executive Office for intelligence, Electronic Warfare and Sensors (PEO IEW&S): Backlog of approximately $52.3 million for the design and manufacture of AN/TPS-80 radar gallium nitride high electron mobility transistor (GaN HEMT) modules;
(ii) Air Force Research Laboratory (AFRL): Backlog of approximately $41.7 million for the development and production of next-generation millimeter-wave (mmWave) power amplifiers for advanced radar and electronic warfare systems;
(iii) Missile Defense Agency (MDA): Backlog of approximately $38.9 million for the design and manufacture of GaN-based transmit/receive (T/R) modules for ground-based and sea-based missile defense radar systems;
(iv) Subcontract to Ironclad Defense Systems Inc. under U.S. Navy Naval Sea Systems Command (NAVSEA): Backlog of approximately $34.1 million for GaN power amplifier modules integrated into advanced shipboard electronic warfare suites; and
(v) Department of Homeland Security Science and Technology Directorate (DHS S&T): Backlog of approximately $26.0 million for the development and manufacture of radio frequency (RF) components for advanced border surveillance systems.
The GSC shall also have exclusive authority over any decisions relating to the pursuit, negotiation, or execution of new classified contracts, task orders, delivery orders, or modifications, and over any interactions with classified program customers or contracting officers relating to classified contract matters.
(b) Personnel Security.
All decisions regarding the hiring, termination, reassignment, promotion, demotion, change of duties, or change of access level of any VPI employee who holds, or who is required by the terms of any government contract or program to hold, a U.S. government personnel security clearance. As of the Closing Date, approximately two hundred twelve (212) of VPI's four hundred eighty-six (486) total employees (approximately 43.6%) hold active U.S. government security clearances at the CONFIDENTIAL, SECRET, or TOP SECRET/SCI levels.
The GSC's exclusive authority extends to:
(i) The processing, sponsorship, and adjudication support for new security clearance applications, clearance level upgrades, and periodic reinvestigations;
(ii) The review and disposition of adverse clearance actions, including clearance suspensions and revocations;
(iii) The designation and replacement of the Facility Security Officer ("FSO") and the Information System Security Manager ("ISSM"); and
(iv) The management of insider threat programs and the implementation of continuous evaluation monitoring for cleared personnel as required by Security Executive Agent Directive 6 ("SEAD 6") or any successor directive.
(c) Facility Security.
All decisions relating to VPI's Facility Security Clearance ("FCL"), which is currently held at the SECRET level (CAGE Code 7VK92) at the Albuquerque, New Mexico fabrication facility (9200 Innovation Boulevard, Albuquerque, NM 87113), a facility encompassing approximately forty-five thousand (45,000) square feet of GaN-on-SiC semiconductor fabrication capacity. The GSC's exclusive authority in this area includes, without limitation:
(i) All decisions relating to physical security measures for classified areas of the Albuquerque Fab, including Sections C-7, C-8, C-9, C-10, C-11, and C-12 of the clean room complex;
(ii) Access control protocols, intrusion detection systems, closed-circuit video surveillance, visitor management, and guard force requirements for classified areas;
(iii) Coordination with DCSA on all matters relating to VPI's FCL, including industrial security inspections, security vulnerability assessments, and FOCI mitigation compliance reviews;
(iv) Implementation of FOCI mitigation measures as required by the NSA and the NISPOM; and
(v) Approval of any proposed construction, renovation, relocation, or closure of any VPI facility in which classified work is performed or classified information is stored.
(d) ITAR/EAR-Controlled Activities.
All decisions relating to the manufacture, assembly, testing, export, re-export, retransfer, or temporary import of defense articles, defense services, or technical data controlled under the International Traffic in Arms Regulations ("ITAR") and the Export Administration Regulations ("EAR"), including, without limitation:
(i) Items controlled under United States Munitions List ("USML") Category XI(a)(3) (Military Electronics — Microwave Monolithic Integrated Circuits (MMICs) and related components);
(ii) Items controlled under Export Control Classification Numbers ("ECCNs") 3A001 (Electronic Components), 3A991 (Electronic Items Not Controlled by 3A001), and 3E001 (Technology for the Development or Production of Equipment or Materials Controlled by 3A) on the Commerce Control List;
(iii) Maintenance of VPI's registration with the Directorate of Defense Trade Controls ("DDTC") of the U.S. Department of State (Registration No. M-24817);
(iv) The preparation, submission, amendment, and compliance monitoring of DSP-5 export license applications and any other ITAR license or authorization applications. As of the Closing Date, VPI holds three (3) active DSP-5 licenses authorizing deliveries of defense articles to NATO allied customers in the United Kingdom and Australia; and
(v) Implementation, oversight, and compliance monitoring of the Technology Control Plan set forth in Annex B to the NSA, including the designation of Empowered Officials, the management of deemed export controls, and the training of VPI personnel on export control requirements.
(e) Cybersecurity for Classified and Controlled Systems.
Oversight of all cybersecurity requirements applicable to VPI's classified information systems, Controlled Unclassified Information ("CUI") systems, and systems processing ITAR- or EAR-controlled data, as set forth in Annex D (Cybersecurity Requirements) to the NSA. The GSC's exclusive authority in this area includes:
(i) Oversight of VPI's compliance with the cybersecurity requirements of National Institute of Standards and Technology Special Publication 800-171 ("NIST SP 800-171") for the protection of CUI, and any applicable classified system security requirements;
(ii) Approval of incident response actions, containment strategies, remediation plans, and recovery procedures for cybersecurity events affecting classified or controlled systems;
(iii) Oversight of VPI's compliance with the seventy-two (72) hour cybersecurity incident reporting obligations to DCSA and other applicable agencies as set forth in Annex D; and
(iv) Review and approval of annual system security plans, plans of action and milestones ("POA&Ms"), and the results of third-party penetration testing as required by Annex D.
(f) Third-Party Monitor Coordination.
The GSC shall serve as the primary point of contact for the Third-Party Monitor (Whitmore Compliance Group LLC) with respect to all matters relating to classified programs, controlled technologies, personnel and facility security, and compliance with the NSA and this Annex. The GSC shall:
(i) Coordinate with the Third-Party Monitor on all scheduled and unscheduled compliance reviews, audits, site visits, and inspections;
(ii) Review and provide written comments on the Third-Party Monitor's annual compliance audit report (prepared in accordance with the template set forth in Annex E to the NSA) before such report is submitted to the Government Parties; and
(iii) Ensure that all materials and information requested by the Third-Party Monitor in the performance of its monitoring duties are provided promptly and completely, at the appropriate classification level.
(g) Government Party Notifications.
All required notifications to CFIUS, DCSA, and other Government Parties regarding material changes to VPI's business, classified programs, security posture, or governance, including, without limitation:
(i) Thirty (30) day pre-notifications of material changes as required by the NSA, including proposed divestitures, new foreign subcontracts or supplier arrangements, and changes to cleared personnel;
(ii) Notifications required by DCSA in connection with VPI's FCL and FOCI mitigation status;
(iii) Notifications required under ITAR and EAR relating to changes in ownership, corporate structure, or registered activities; and
(iv) Any other notifications required by applicable law, regulation, or the terms of the NSA.
Section 4.2 — Government Party Approval Requirements
Certain matters within the GSC's exclusive authority additionally require the prior written approval of the Government Parties (which approval may be granted through the CFIUS Staff Chair, the Department of Defense monitoring representative, or the Department of Energy monitoring representative, as applicable). Such matters include:
(a) Any change to the identity or role of VPI's Facility Security Officer;
(b) Any material modification to VPI's Facility Security Clearance, including any upgrade, downgrade, or termination thereof;
(c) Any proposed access by HSAG personnel (including HSAG Designees) to classified facilities, including Sections C-7 through C-12 of the Albuquerque Fab clean room, which access is governed by Annex F (Facility Access Procedures);
(d) The appointment or replacement of any Security Board Member, including the Security Director, as set forth in Section 2.4(b); and
(e) Any other matter specifically identified in the NSA as requiring Government Party approval.
The Government Parties shall use reasonable efforts to respond to requests for approval under this Section 4.2 within thirty (30) calendar days of receipt of a complete request, but the Government Parties shall not be bound by any specific response timeline, and the absence of a response shall not be deemed to constitute approval.
ARTICLE V — AUTHORITY OF THE FULL BOARD
Section 5.1 — Matters Requiring Full Board Approval
The following matters require the approval of the full Board of Directors of VPI, acting through the affirmative vote of a majority of directors present at a duly constituted meeting at which a quorum (as defined in Section 5.2) is present. The full Board's authority under this Article V is subject in all respects to the exclusions set forth in Article IV, and the full Board shall have no authority to act on any matter within the exclusive authority of the GSC.
(a) Business Strategy and Operations (Non-Classified).
(i) Adoption and material modification of VPI's general business strategy, annual business plans, and annual operating budgets for VPI's unclassified commercial operations, including VPI's commercial 5G infrastructure product lines (GaN power amplifiers for 5G base stations, small cells, and massive MIMO antenna arrays);
(ii) Approval of individual capital expenditures or commitments in excess of a threshold to be established by Board resolution, which threshold shall initially be set at five million dollars ($5,000,000) per transaction or series of related transactions;
(iii) Entry into new commercial (non-classified) product markets, new geographic markets, or new customer segments; and
(iv) Approval of material commercial partnerships, joint development agreements, or technology licensing agreements that do not involve classified or ITAR/EAR-controlled technologies.
(b) Financial Matters.
(i) Review and approval of VPI's annual audited financial statements, prepared in accordance with U.S. generally accepted accounting principles ("GAAP") and audited by VPI's independent registered public accounting firm (currently Arbor & Greenfield LLP, engagement partner Joan Greenfield);
(ii) Establishment, modification, or termination of dividend or distribution policies;
(iii) Incurrence of indebtedness (including borrowings, lines of credit, term loans, and capital leases), guarantees, or liens, other than in the ordinary course of business consistent with past practice;
(iv) Approval of related-party transactions between VPI and HSAG or any affiliate of HSAG, including intercompany service agreements, technology license agreements, transfer pricing arrangements, and management fee arrangements; and
(v) Approval of the annual budget for the GSC's operations and support costs, which shall be presented to the full Board by the GSC for informational purposes but shall not be subject to reduction by the full Board below the level reasonably necessary for the GSC to discharge its duties.
(c) Corporate Actions.
(i) Amendments to VPI's Certificate of Incorporation or Bylaws, subject to the requirement that all such amendments comply with the NSA and this Annex, and subject to the prior notification requirements of the NSA;
(ii) Mergers, acquisitions, investments, joint ventures, or divestitures involving VPI's unclassified business lines or assets, provided that any such transaction involving VPI's classified business lines, classified contracts, or ITAR/EAR-controlled operations requires GSC approval and may additionally require CFIUS pre-notification or a new CFIUS filing;
(iii) Settlement of material litigation or arbitration proceedings involving VPI, where the settlement amount exceeds one million dollars ($1,000,000) or involves non-monetary terms that could affect VPI's operations or compliance posture; and
(iv) Selection and engagement of VPI's independent auditors, and approval of the scope and terms of the annual audit engagement.
(d) Compensation and Non-Cleared Personnel.
(i) Approval of executive compensation arrangements (including base salary, annual bonus, long-term incentive awards, and severance arrangements) for VPI's non-cleared officers, including the Chief Financial Officer (currently Derek Wainsborough) and other non-cleared senior executives;
(ii) Adoption, amendment, or termination of equity incentive plans, stock option plans, restricted stock unit plans, and similar compensatory programs;
(iii) Granting of individual equity awards, stock options, or other compensatory equity interests to non-cleared employees; and
(iv) Hiring and termination of non-cleared senior executives at the vice president level and above.
(e) Compliance Oversight (Non-Classified).
(i) Oversight of VPI's general corporate compliance programs, including programs addressing anti-corruption (Foreign Corrupt Practices Act and UK Bribery Act), anti-money laundering, economic sanctions compliance (Office of Foreign Assets Control, Bureau of Industry and Security), and general ethics and business conduct;
(ii) Tax compliance matters, including federal, state, and local tax filings and planning;
(iii) Environmental, health, and safety compliance matters; and
(iv) General regulatory compliance matters not within the exclusive authority of the GSC under Article IV.
Section 5.2 — Quorum for Full Board
(a) Quorum. A quorum of the full Board of Directors shall consist of three (3) of the five (5) directors, provided that such quorum must include at least one (1) Security Board Member and at least one (1) HSAG Designee. If a quorum cannot be assembled due to a vacancy, the remaining directors shall use best efforts to fill such vacancy in accordance with Article II before taking action on any matter requiring full Board approval.
(b) Voting. Decisions of the full Board shall be by majority vote of the directors present at a duly constituted meeting at which a quorum is present. Each director shall have one (1) vote.
(c) Tie Vote. In the event of a tie vote on any matter before the full Board, the following procedure shall apply:
(i) If the matter involves any national security, classified program, controlled technology, ITAR/EAR, personnel security, or facility security dimension (as determined by the Security Director in his or her reasonable judgment), the matter shall be referred to the Security Director for a casting vote, which shall be final and binding; and
(ii) If the matter does not involve any national security or controlled-technology dimension, the matter shall be tabled for further deliberation. If the tie persists after one (1) additional meeting at which the matter is considered, the status quo shall be maintained until the Board resolves the matter by majority vote.
Section 5.3 — Information Access for Full Board Meetings
(a) Pre-Meeting Review. All materials proposed for distribution in connection with meetings of the full Board shall be reviewed in advance by the GSC (or the FSO acting at the direction of the GSC) to ensure that no Classified Information, Controlled Technical Data, Controlled Unclassified Information, or ITAR/EAR-controlled information is included. The GSC shall have the right to redact, withhold, or modify any materials before distribution to HSAG Designees.
(b) Classified/Controlled Intersections. If any agenda item for a full Board meeting intersects with classified or controlled matters within the GSC's exclusive authority, the GSC shall prepare an unclassified summary of the relevant issues for distribution to the HSAG Designees, and shall address the classified or controlled aspects of such matter separately in a GSC-only session. The unclassified summary shall contain sufficient information to enable the HSAG Designees to understand the general business implications of the matter without compromising classified or controlled information.
(c) Record-Keeping. Minutes and materials of full Board meetings shall be maintained in the Full Board Repository described in Section 7.3(b) and shall be accessible to all Board members.
ARTICLE VI — PERSONNEL CONTINUITY REQUIREMENTS
Section 6.1 — Key Personnel
The following individuals are designated as "Key Personnel" under the NSA and shall remain employed by VPI in their current capacities (or in substantially equivalent capacities approved by the GSC and the Government Parties) for a minimum period of twenty-four (24) months following the Closing Date, that is, through at least February 9, 2026:
(a) Dr. Nathan Trevorrow — Founder and Chief Executive Officer of VPI. Dr. Trevorrow holds an active personnel security clearance at the TOP SECRET/SCI level. Dr. Trevorrow shall continue to serve as the chief executive officer of VPI and shall have day-to-day responsibility for VPI's operations, subject to the oversight of the Board and the GSC.
(b) Marissa Sung-Avila — President and Chief Operating Officer of VPI. Ms. Sung-Avila holds an active personnel security clearance at the SECRET level. Ms. Sung-Avila shall continue to serve as the president and chief operating officer of VPI, with responsibility for VPI's operational, manufacturing, and commercial activities.
(c) Col. (Ret.) Bryce Hendrickson, USAF — Vice President, Government Programs, and Facility Security Officer of VPI. Col. Hendrickson holds an active personnel security clearance at the TOP SECRET/SCI level. Col. Hendrickson shall continue to serve in both capacities and shall report functionally to the GSC on all security matters.
The Key Personnel designation and continuity requirement may not be waived or shortened without the prior written consent of the Government Parties.
Section 6.2 — Replacement of Key Personnel
If any Key Personnel departs from VPI (whether by voluntary resignation, termination, death, disability, or any other reason) during the twenty-four (24) month continuity period, the following requirements shall apply:
(a) Approval. Any proposed replacement for a departing Key Personnel must be approved by the GSC and by DCSA prior to appointment;
(b) Qualifications. The proposed replacement must be a citizen of the United States and must hold, or be eligible for and willing to undergo the investigation required for, a personnel security clearance at the same or higher level as the security clearance held by the departing individual;
(c) Notification. The GSC shall notify the Government Parties in writing within five (5) business days of the departure of any Key Personnel, setting forth the circumstances of the departure and the anticipated timeline for identifying a replacement;
(d) Replacement Plan. The GSC shall submit a written replacement plan to the Government Parties within thirty (30) calendar days of the Key Personnel departure, identifying the proposed replacement candidate (if known), the qualifications of such candidate, and the expected timeline for the replacement's assumption of duties; and
(e) Interim Arrangements. Pending the appointment of a replacement, the GSC shall designate an interim officer to assume the departing Key Personnel's duties, subject to Government Party approval. Such interim officer must hold an appropriate security clearance and must be a U.S. citizen.
Section 6.3 — Facility Security Officer
Col. (Ret.) Bryce Hendrickson shall continue to serve as VPI's Facility Security Officer ("FSO") under the oversight of DCSA. The FSO is responsible for the implementation and administration of VPI's industrial security program in accordance with the NISPOM (32 C.F.R. Part 117), including the processing of personnel security clearances, the maintenance of VPI's Facility Security Clearance, the management of classified material, and the reporting of security incidents.
Any change in the identity or role of the FSO requires the prior written approval of both the GSC and the Government Parties. The FSO reports functionally to the GSC on all security matters, including matters relating to VPI's FCL, FOCI mitigation, personnel security, classified material control, and coordination with DCSA. The FSO shall attend all meetings of the GSC (unless excused by the Security Director) and shall provide regular briefings to the GSC on the status of VPI's security programs.
ARTICLE VII — INFORMATION BARRIERS AND DATA SEGREGATION
Section 7.1 — Information Barriers
VPI shall establish and maintain robust information barriers, consistent with the Technology Control Plan (Annex B) and the Cybersecurity Requirements (Annex D), between:
(a) The GSC and its classified and controlled activities (including all classified programs, ITAR/EAR-controlled operations, personnel security functions, and facility security operations), on the one hand, and HSAG Designees, HSAG personnel, and all non-U.S. affiliates of HSAG, on the other hand; and
(b) VPI's classified and ITAR/EAR-controlled information technology systems and networks, on the one hand, and HSAG's global information technology network and infrastructure, on the other hand.
The information barriers shall be designed, implemented, and maintained to prevent any unauthorized access to, or disclosure of, Classified Information, Controlled Technical Data, Controlled Unclassified Information, or ITAR/EAR-controlled information by HSAG, HSAG Designees, or any person who does not hold an appropriate security clearance and a need-to-know. The adequacy of the information barriers shall be assessed annually as part of the Third-Party Monitor's compliance audit and periodically by DCSA in connection with its industrial security oversight responsibilities.
Section 7.2 — Physical and Logical IT Segregation
(a) Network Separation. VPI's information technology systems and networks, including all systems that process, store, or transmit Classified Information, CUI, or ITAR/EAR-controlled data, must be physically and logically separated from HSAG's global IT network. No interconnection, whether direct or through intermediate systems, shall exist between VPI's classified or controlled systems and HSAG's network.
(b) Cloud Infrastructure. VPI and HSAG shall not share any cloud computing infrastructure, platform, or service (including Infrastructure-as-a-Service, Platform-as-a-Service, and Software-as-a-Service environments). VPI's classified and CUI systems shall be hosted on FedRAMP-authorized or DISA-authorized cloud environments, or on VPI's on-premises systems, as required by applicable security requirements.
(c) NIST SP 800-171 Compliance. VPI shall maintain compliance with NIST SP 800-171 (Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations) for all systems processing CUI, and shall implement any additional security controls required by DFARS 252.204-7012 and Annex D.
(d) Penetration Testing. VPI shall engage a qualified independent third-party cybersecurity firm to conduct annual penetration testing of VPI's classified and controlled information systems, as required by Annex D. The results of such testing shall be provided to the GSC, the Third-Party Monitor, and DCSA.
Section 7.3 — Document and Records Management
Classified documents, controlled technical data, and other sensitive materials shall be stored, transmitted, and destroyed in accordance with DCSA requirements, NISPOM provisions, and the Technology Control Plan (Annex B). Board-level records shall be maintained in two separate, distinct repositories as follows:
(a) GSC Repository. All minutes, materials, reports, agendas, correspondence, and records of the GSC shall be maintained in a classified repository (electronic and/or physical, as appropriate) accessible only to Security Board Members, the FSO, and such cleared VPI staff as the GSC may authorize on a need-to-know basis. The GSC Repository shall be secured in accordance with DCSA requirements for the protection of classified information at the highest classification level of the information contained therein.
(b) Full Board Repository. All minutes, materials, reports, agendas, correspondence, and records of the full Board of Directors (including materials distributed for full Board meetings) shall be maintained in a separate unclassified repository accessible to all Board members, including HSAG Designees. The Full Board Repository shall not contain any Classified Information, Controlled Technical Data, CUI, or ITAR/EAR-controlled information.
(c) Review and Segregation. The FSO, under the direction of the GSC, shall be responsible for reviewing all materials before they are placed in either repository to ensure proper classification, marking, and segregation. Any inadvertent commingling of classified or controlled materials in the Full Board Repository shall be treated as a security incident and reported in accordance with Section 9.3.
ARTICLE VIII — COORDINATION WITH THIRD-PARTY MONITOR
Section 8.1 — Monitor Engagement
The Third-Party Monitor for purposes of the NSA and this Annex is Whitmore Compliance Group LLC, a limited liability company organized under the laws of the Commonwealth of Virginia, with offices at 1300 Crystal Drive, Suite 710, Arlington, Virginia 22202. The principal of the Third-Party Monitor is Gerald Whitmore, a former Special Agent and Section Chief of the Counterintelligence Division of the Federal Bureau of Investigation. Mr. Whitmore holds an active personnel security clearance at the TOP SECRET/SCI level.
The Third-Party Monitor was engaged pursuant to the Third-Party Compliance Monitor Agreement executed concurrently with the NSA on January 19, 2024. The annual fee for the Third-Party Monitor's services is one million two hundred thousand dollars ($1,200,000), payable quarterly in equal installments of three hundred thousand dollars ($300,000) per quarter by HSAG. The annual fee is subject to adjustment based on the Consumer Price Index for All Urban Consumers (CPI-U) as published by the Bureau of Labor Statistics, with adjustments effective on each anniversary of the Closing Date.
Section 8.2 — GSC Cooperation with Monitor
The GSC shall cooperate fully and in good faith with the Third-Party Monitor in the performance of the Monitor's duties under the Third-Party Compliance Monitor Agreement, including, without limitation:
(a) Providing the Third-Party Monitor with timely access to all GSC minutes, materials, reports, and records, at the appropriate classification level, given Mr. Whitmore's active TS/SCI clearance;
(b) Facilitating the Third-Party Monitor's interviews with Security Board Members, Key Personnel, cleared employees, and other VPI personnel as the Monitor may reasonably request;
(c) Making available to the Third-Party Monitor all compliance records, security incident reports, FOCI mitigation documentation, Technology Control Plan implementation records, cybersecurity audit results, personnel security files (to the extent authorized by applicable law), and any other documentation reasonably relevant to the Monitor's assessment of VPI's compliance with the NSA and this Annex;
(d) Providing the Third-Party Monitor with access to VPI's facilities, including classified areas (subject to appropriate clearance and need-to-know requirements), for the purpose of conducting site inspections and reviews; and
(e) Responding promptly and completely to any written or oral inquiries from the Third-Party Monitor regarding VPI's compliance with the NSA and this Annex.
The GSC shall designate the FSO (or such other Security Board Member as the GSC may determine) as the primary point of contact for day-to-day communications with the Third-Party Monitor.
Section 8.3 — Annual Compliance Audit
(a) Audit Requirement. The Third-Party Monitor shall conduct an annual compliance audit of VPI's compliance with the NSA, this Annex, and all other Annexes to the NSA, in accordance with the template and methodology set forth in Annex E (Compliance Audit Template) to the NSA. The annual audit shall encompass all matters within the GSC's exclusive authority as well as full Board governance compliance, information barrier effectiveness, IT segregation, and the integrity of the governance framework established by this Annex.
(b) GSC Review. The Third-Party Monitor shall provide a draft of the annual compliance audit report to the GSC for review and comment before submission to the Government Parties. The GSC shall have a period of fifteen (15) business days from receipt of the draft report to provide written comments, factual corrections, and supplemental information to the Third-Party Monitor. The Third-Party Monitor shall consider the GSC's comments in good faith but shall retain sole authority over the content and conclusions of the final report.
(c) Submission to Government Parties. The final annual compliance audit report shall be submitted by the Third-Party Monitor to the Government Parties within the time frame specified in the Third-Party Compliance Monitor Agreement. The first annual compliance audit report is due no later than January 19, 2025 (i.e., twelve (12) months following the date of the NSA).
(d) Access to Audit Reports. The final annual compliance audit report shall be provided to the GSC concurrently with submission to the Government Parties. An unclassified summary of the audit findings (excluding any classified or controlled information) may be shared with the full Board, including HSAG Designees, at the discretion of the GSC, in accordance with Section 3.7.
ARTICLE IX — REPORTING AND NOTIFICATIONS
Section 9.1 — Quarterly GSC Reports
The GSC shall submit quarterly reports to the Government Parties covering the matters described in Section 3.5(a) of this Annex. Quarterly reports shall be submitted within thirty (30) calendar days following the end of each calendar quarter (i.e., by April 30, July 31, October 31,

ANNEX C

TO NATIONAL SECURITY AGREEMENT (NSA-2024-0019)

GOVERNANCE PROVISIONS AND SECURITY BOARD CHARTER

Record

Parties

Dates

Amounts