ANNEX D — CYBERSECURITY REQUIREMENTS
Annex D to the National Security Agreement NSA-2024-0019
among
HALCYON SEMICONDUCTOR AKTIENGESELLSCHAFT a stock corporation organized under the laws of the Federal Republic of Germany ("HSAG")
HALCYON US HOLDINGS INC. a corporation organized under the laws of the State of Delaware ("Halcyon US Holdings")
Marlowe Asset Management PHOTONICS INC. a corporation organized under the laws of the State of Colorado ("VPI")
and
THE UNITED STATES OF AMERICA acting through the U.S. Department of the Treasury, the Department of Defense, and the Department of Energy (the "U.S. Government" and, collectively with HSAG, Halcyon US Holdings, and VPI, the "Parties")
Execution Date: January 19, 2024 Effective Date: Upon Closing of the Acquisition (February 9, 2024)
This Annex D (the "Annex" or "Annex D") is incorporated by reference into and forms an integral part of the National Security Agreement (NSA-2024-0019) executed January 19, 2024, among the Parties (the "NSA"). This Annex D shall become effective upon the closing of the acquisition of one hundred percent (100%) of VPI's outstanding equity by Halcyon US Holdings Inc. (the "Closing"), which is expected to occur on February 9, 2024. Capitalized terms used but not defined herein shall have the meanings ascribed to them in Annex A (Definitions) of the NSA. In the event of any conflict between this Annex D and the body of the NSA, the provisions of the NSA shall control, unless this Annex D expressly provides a more restrictive requirement, in which case the more restrictive requirement shall govern.
Right-click to update Table of Contents
SECTION 1: PURPOSE AND SCOPE
1.1 Purpose. The purpose of this Annex D is to establish binding cybersecurity requirements for Marlowe Asset Management Photonics Inc. and its facilities, networks, and information systems, in order to safeguard Classified Information, Controlled Technical Data, and other sensitive information in connection with VPI's continuing operations following the acquisition of one hundred percent (100%) of VPI's outstanding equity by Halcyon US Holdings Inc., a Delaware corporation and wholly owned subsidiary of Halcyon Semiconductor Aktiengesellschaft, Industriestraße 44, 01099 Dresden, Saxony, Federal Republic of Germany. The requirements set forth herein are designed to address the unique risks arising from the foreign ownership of a cleared U.S. defense contractor engaged in the design, development, and fabrication of advanced gallium nitride (GaN) semiconductor devices with critical national security applications.
The Parties recognize that VPI's operations involve the processing, storage, and transmission of information of the highest sensitivity to the national security of the United States, and that the cybersecurity requirements set forth in this Annex D are essential to ensuring that the acquisition does not pose a risk to the confidentiality, integrity, or availability of such information. These requirements reflect the consensus of the Parties, informed by consultations with the Defense Counterintelligence and Security Agency (DCSA), and are intended to provide a robust and verifiable cybersecurity framework commensurate with the sensitivity of VPI's programs and the risks associated with foreign ownership, control, or influence (FOCI).
1.2 Scope. This Annex D applies to all VPI information systems, networks, infrastructure, and data repositories, including without limitation those located at or operated from:
(a) VPI's corporate headquarters at 7400 Ridgeline Parkway, Colorado Springs, Colorado 80919;
(b) VPI's cleared fabrication facility at 9200 Innovation Boulevard, Albuquerque, New Mexico 87113 (CAGE Code 7VK92); and
(c) any future VPI facilities, whether leased, owned, or operated by VPI, wherever located within the United States.
The scope of this Annex D extends to any information systems, networks, or data repositories that process, store, or transmit any of the following categories of information:
(a) Classified Information, up to and including information classified at the SECRET level;
(b) ITAR-controlled technical data, including technical data related to VPI's defense articles registered under VPI's Directorate of Defense Trade Controls (DDTC) Registration No. M-24817, encompassing Category XI(a)(3) defense articles (military electronics);
(c) EAR-controlled technical data, including technical data classified under Export Control Classification Numbers (ECCNs) 3A001 (electronic components), 3A991 (electronic components not controlled by 3A001), and 3E001 (technology for development or production of items controlled by 3A001);
(d) Controlled Unclassified Information (CUI) as defined under 32 C.F.R. Part 2002 and applicable CUI registries;
(e) VPI proprietary trade secrets and intellectual property, including but not limited to GaN epitaxial growth recipes, high electron mobility transistor (HEMT) design data, millimeter-wave (mmWave) power amplifier architectures, die-level reliability screening methodologies, and related process control parameters.
1.3 Relationship to Existing Obligations
The requirements of this Annex D supplement, and do not replace, VPI's existing obligations under the National Industrial Security Program Operating Manual (NISPOM, 32 C.F.R. Part 117), applicable Defense Federal Acquisition Regulation Supplement (DFARS) cybersecurity clauses (including DFARS 252.204-7012, "Safeguarding Covered Defense Information and Cyber Incident Reporting"), the International Traffic in Arms Regulations (22 C.F.R. Parts 120–130), the Export Administration Regulations (15 C.F.R. Parts 730–774), and any other applicable federal cybersecurity regulations or directives. Where this Annex D imposes requirements that are more restrictive than those imposed by existing legal or regulatory obligations, VPI shall comply with the more restrictive requirement. Nothing in this Annex D shall be construed to relieve VPI of any obligation arising under applicable law, regulation, or government contract.
SECTION 2: DEFINITIONS (CYBERSECURITY-SPECIFIC)
For purposes of this Annex D, the following terms shall have the meanings set forth below. These definitions are in addition to, and shall be read in conjunction with, the definitions set forth in Annex A (Definitions) of the NSA.
"Covered Information Systems" means all VPI information technology systems, networks, servers, workstations, laptop computers, mobile devices, cloud computing resources, operational technology (OT) systems, industrial control systems (ICS), supervisory control and data acquisition (SCADA) systems, and any other electronic systems or equipment used in VPI's operations, including without limitation all systems located at or operated from VPI's Colorado Springs headquarters, VPI's Albuquerque fabrication facility, and any future VPI facilities. The term includes both classified and unclassified systems, and encompasses systems used for research, development, design, fabrication, testing, quality assurance, engineering, administration, and any other VPI business functions.
"Cybersecurity Incident" means any event that actually or potentially jeopardizes the confidentiality, integrity, or availability of a Covered Information System, or the information that is processed, stored, or transmitted by such system. The term includes, without limitation, unauthorized access to a Covered Information System; unauthorized exfiltration, modification, or destruction of data; introduction of malware, ransomware, or other malicious code; denial-of-service or distributed denial-of-service attacks; exploitation of a software or hardware vulnerability; insider threat activity, including unauthorized disclosure of controlled or classified information; and any other event that triggers a reporting obligation under DFARS 252.204-7012, the NISPOM, or applicable law.
"HSAG Global Network" means all information technology systems, networks, cloud computing infrastructure, data centers, and data repositories that are owned, operated, managed, or controlled by HSAG, Halcyon US Holdings Inc., Halcyon US Inc. (11501 Alterra Parkway, Suite 300, Austin, Texas 78758), or any other direct or indirect subsidiary, affiliate, joint venture partner, or agent of HSAG, wherever located worldwide, excluding the VPI Segregated Network. The HSAG Global Network includes all systems operated by or on behalf of HSAG's semiconductor design, manufacturing, and sales operations in Germany, the United Kingdom, Singapore, the People's Republic of China, the Republic of Korea, Japan, and any other jurisdiction in which HSAG or its affiliates maintain operations.
"VPI Segregated Network" means VPI's standalone information technology environment, encompassing all Covered Information Systems, which is required to be physically and logically separated from the HSAG Global Network at all times, as set forth in Section 4 of this Annex D. The VPI Segregated Network includes all VPI-owned and VPI-operated hardware, software, network infrastructure, and data repositories, together with any VPI-contracted cloud environments that are independently provisioned and maintained.
"Third-Party Monitor" means Whitmore Compliance Group LLC, a limited liability company organized under the laws of the Commonwealth of Virginia, with principal offices at 1300 Crystal Drive, Suite 710, Arlington, Virginia 22202, and its principal, Gerald Whitmore, engaged pursuant to the Third-Party Compliance Monitor Agreement annexed to the NSA. References to the Third-Party Monitor in this Annex D include the Third-Party Monitor's authorized officers, employees, subcontractors, and agents acting within the scope of the Third-Party Compliance Monitor Agreement.
"Government Security Committee" or "GSC" has the meaning ascribed to such term in Annex C (Corporate Governance Requirements) of the NSA, and refers to the committee of VPI's reconstituted Board of Directors composed of the three Security Board Members, each of whom is a U.S. citizen holding or eligible to hold a personnel security clearance at the TOP SECRET/SCI level.
"DCSA" means the Defense Counterintelligence and Security Agency, an agency of the United States Department of Defense, or any successor agency thereto.
"Monitoring Agencies" means the U.S. Department of the Treasury (acting through the Office of Investment Security), the Department of Defense, and the Department of Energy, each in its capacity as a CFIUS monitoring agency under NSA-2024-0019, and their respective authorized representatives.
"NIST SP 800-171" means National Institute of Standards and Technology Special Publication 800-171, titled "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations," including all appendices and supplemental materials, as amended, revised, or superseded from time to time. As of the execution date of the NSA, the current version is Revision 2, published in February 2020 (updated January 2021).
"Penetration Test" means an authorized simulated cyberattack conducted by an approved independent third-party assessment firm against one or more Covered Information Systems, for the purpose of identifying exploitable vulnerabilities and evaluating the security posture of such systems. Penetration Tests may include external and internal network testing, web application testing, wireless network testing, social engineering testing, and physical security testing, as specified in Section 6 of this Annex D.
SECTION 3: BASELINE CYBERSECURITY STANDARDS — NIST SP 800-171 COMPLIANCE
3.1 General Compliance Obligation
VPI shall implement, maintain, and continuously comply with all security requirements set forth in NIST SP 800-171 with respect to all Covered Information Systems that process, store, or transmit Controlled Unclassified Information (CUI), Controlled Technical Data, or other sensitive unclassified information. As of the execution date of this NSA, the applicable version is NIST SP 800-171, Revision 2. VPI shall transition to any subsequent revision of NIST SP 800-171 (including Revision 3 or any successor publication) within twelve (12) months of its publication by NIST, unless a different transition timeline is specified by NIST, the Department of Defense, or the Monitoring Agencies, in which case VPI shall comply with the shorter of the two timelines.
Compliance with NIST SP 800-171 shall encompass all fourteen (14) families of security requirements, specifically:
(i) Access Control (AC);
(ii) Awareness and Training (AT);
(iii) Audit and Accountability (AU);
(iv) Configuration Management (CM);
(v) Identification and Authentication (IA);
(vi) Incident Response (IR);
(vii) Maintenance (MA);
(viii) Media Protection (MP);
(ix) Personnel Security (PS);
(x) Physical Protection (PE);
(xi) Risk Assessment (RA);
(xii) Security Assessment (CA);
(xiii) System and Communications Protection (SC); and
(xiv) System and Information Integrity (SI).
VPI shall implement each derived security requirement within each family and shall document the specific implementation of each requirement in its System Security Plan, as described in Section 3.2.
3.2 System Security Plan (SSP)
VPI shall develop and maintain a comprehensive System Security Plan (SSP) for each Covered Information System, or for groups of interconnected Covered Information Systems where appropriate, in accordance with NIST SP 800-171, Section 3.12 (Security Assessment). The SSP shall document, at a minimum:
(a) a description of the system boundary, including hardware, software, network topology, and data flows;
(b) the categorization of information processed, stored, and transmitted by the system (e.g., CUI, ITAR-controlled data, EAR-controlled data, VPI proprietary information);
(c) the specific implementation of each NIST SP 800-171 security requirement applicable to the system, including a description of the security controls, technologies, and procedures employed;
(d) the roles and responsibilities of personnel responsible for system security;
(e) the interconnections between the system and any other systems (whether internal to VPI or external), and the security measures applied to such interconnections; and
(f) the status of any security requirements that are not yet fully implemented, with cross-references to the Plan of Action and Milestones (POA&M) described in Section 3.3.
The SSP shall be reviewed and updated at least annually, and within thirty (30) calendar days of any material change to VPI's information systems, network architecture, or security posture. Material changes include, without limitation, the deployment of new Covered Information Systems, significant changes to network topology, changes to cloud service providers, and changes to the types of information processed by a system.
The SSP shall be made available, in its entirety and without redaction (except as required for classification purposes), to the Third-Party Monitor (Whitmore Compliance Group LLC) for purposes of conducting the annual compliance audit described in Section 13. The SSP shall also be made available, upon written request, to the Monitoring Agencies and to DCSA. VPI shall provide the SSP within ten (10) business days of any such request.
3.3 Plan of Action and Milestones (POA&M)
VPI shall develop and maintain a Plan of Action and Milestones (POA&M) that documents any NIST SP 800-171 security requirements that are not yet fully implemented, together with the specific actions planned to achieve full implementation, the resources allocated, and the target remediation dates. No target remediation date shall exceed one hundred eighty (180) calendar days from the date of identification of the deficiency, unless an extension is approved in writing by the GSC and the Third-Party Monitor based on a documented risk assessment and compensating controls analysis.
POA&M items shall be reported to the Government Security Committee on a quarterly basis, in writing, with a status update for each open item. The POA&M shall be made available to the Third-Party Monitor (Whitmore Compliance Group LLC) during the annual compliance audit and at any other time upon request. VPI shall promptly notify the GSC and the Third-Party Monitor of any POA&M item that is at risk of exceeding its target remediation date.
3.4 CMMC Alignment
VPI shall take commercially reasonable steps to prepare for Cybersecurity Maturity Model Certification (CMMC) at the level required for its current and anticipated U.S. Department of Defense contracts. As of the execution date of this NSA, VPI anticipates that CMMC Level 2 (Advanced) certification will be required for the majority of its DoD contracts involving CUI. VPI's CMMC preparation activities shall include, at a minimum, gap assessments against the CMMC framework, remediation of identified gaps, documentation of security practices and processes, and engagement with CMMC-accredited assessment organizations.
Upon the effective date of any final rule promulgated by the Department of Defense implementing CMMC requirements applicable to VPI's DoD contracts, VPI shall achieve and maintain the required level of CMMC certification within the timeframe mandated by such final rule. If the mandated timeframe is shorter than twelve (12) months, VPI shall use best efforts to comply within the shorter timeframe and shall notify the GSC and the Monitoring Agencies if compliance within the mandated timeframe is not feasible, together with a plan for achieving compliance as expeditiously as practicable.
CMMC preparation activities, including gap assessment results, remediation progress, and engagement with assessment organizations, shall be documented and included as a component of the annual compliance audit conducted by the Third-Party Monitor.
3.5 Classified Information Systems
Classified information systems — that is, Covered Information Systems that process, store, or transmit information classified at the CONFIDENTIAL or SECRET level, located at VPI's Albuquerque fabrication facility (9200 Innovation Boulevard, Albuquerque, NM 87113, CAGE Code 7VK92) — shall comply with all applicable requirements under the National Industrial Security Program Operating Manual (NISPOM, 32 C.F.R. Part 117), any DCSA-imposed security directives or system security plans, and the requirements of this Annex D, to the extent consistent with NISPOM and DCSA guidance. In the event of any conflict between this Annex D and the NISPOM or a DCSA security directive with respect to classified systems, the NISPOM or DCSA directive shall control.
VPI's Facility Security Officer, Col. (Ret.) Bryce Hendrickson, who holds a personnel security clearance at the TOP SECRET/Sensitive Compartmented Information (TS/SCI) level, shall maintain primary oversight of all classified information systems and shall serve as the principal point of contact for DCSA on all matters relating to the security of classified systems. Col. (Ret.) Hendrickson shall report directly to the GSC on the cybersecurity posture of classified systems, including any incidents, vulnerabilities, or compliance issues.
SECTION 4: NETWORK SEGREGATION — PHYSICAL AND LOGICAL SEPARATION
4.1 Mandatory Separation Requirement
VPI shall establish and maintain all Covered Information Systems as part of the VPI Segregated Network, which shall be physically and logically separated from the HSAG Global Network at all times. This separation is a fundamental requirement of this Annex D and the NSA, and is essential to ensuring that HSAG, its affiliates, and foreign persons do not obtain unauthorized access to Classified Information, Controlled Technical Data, ITAR-controlled data, EAR-controlled data, CUI, or VPI proprietary trade secrets.
No direct or indirect network connection of any kind shall exist between the VPI Segregated Network and the HSAG Global Network. This prohibition encompasses, without limitation, virtual private network (VPN) tunnels, dedicated leased circuits, multiprotocol label switching (MPLS) connections, application programming interface (API) integrations, file transfer protocol (FTP or SFTP) connections, web service connections, email bridges, database replication links, remote desktop connections, and any other electronic data pathway or communication channel, whether encrypted or unencrypted, persistent or transient.
4.2 Physical Separation Requirements
VPI's network infrastructure shall be physically distinct and separate from HSAG network infrastructure. Specifically:
(a) All network hardware — including routers, switches, firewalls, intrusion detection and prevention systems, servers, storage area networks (SANs), network-attached storage (NAS) devices, cabling, patch panels, and network termination points — shall be owned by VPI, procured independently by VPI, and physically located within VPI-controlled facilities.
(b) No hardware owned, leased, or controlled by HSAG, Halcyon US Holdings Inc., Halcyon US Inc., or any other HSAG affiliate shall be installed, connected, or present in any VPI facility, including VPI's Colorado Springs headquarters and the Albuquerque fabrication facility. Similarly, no VPI hardware shall be installed, connected, or present in any HSAG facility, including the Halcyon US Inc. facility at 11501 Alterra Parkway, Suite 300, Austin, Texas 78758, or any HSAG facility outside the United States.
(c) VPI's data centers and server rooms at both the Colorado Springs headquarters and the Albuquerque fabrication facility shall be secured with physical access controls (including electronic card access, biometric authentication, and visitor logging) that are managed independently of any HSAG access management or physical security system. HSAG personnel shall not be granted unescorted access to any VPI data center or server room.
(d) Network cabling and telecommunications infrastructure at VPI facilities shall be physically separated from any building infrastructure shared with or accessible to HSAG. Where VPI occupies space in a multi-tenant building, VPI shall ensure that its telecommunications demarcation points, cable pathways, and wiring closets are segregated and secured from access by HSAG or other tenants.
4.3 Logical Separation Requirements
VPI shall maintain separate and independent instances of the following systems and services, with no integration, federation, synchronization, or data sharing with corresponding HSAG systems:
(a) Identity and Access Management: VPI shall maintain its own Active Directory domain (or equivalent identity management system), separate from any HSAG Active Directory forest or domain. No trust relationships, federation agreements, or single sign-on (SSO) integrations shall exist between VPI and HSAG identity management systems.
(b) Domain Name Systems: VPI shall maintain its own DNS infrastructure, with DNS zones and records managed independently of HSAG DNS infrastructure.
(c) Email Systems: VPI shall maintain its own email system (including email servers, email security gateways, and email archival systems), with a separate email domain. No email routing, relay, or forwarding arrangements shall exist between VPI and HSAG email systems, except as may be implemented through the Authorized Exchange Gateway described in Section 4.5.
(d) Enterprise Resource Planning (ERP) Systems: VPI shall maintain its own ERP system (or equivalent business management system) for financial, procurement, inventory, and operational management functions. The VPI ERP system shall not be integrated with, or share a database instance with, any HSAG ERP system.
(e) Source Code Repositories: VPI shall maintain its own source code repositories and version control systems, with access restricted to authorized VPI personnel. No HSAG personnel shall have access to VPI source code repositories.
(f) Engineering Design Tools and Product Lifecycle Management (PLM) Systems: VPI shall maintain its own electronic design automation (EDA) tools, computer-aided design (CAD) systems, simulation tools, and PLM systems, with access restricted to authorized VPI personnel.
(g) Backup and Disaster Recovery Systems: VPI shall maintain its own backup infrastructure and disaster recovery systems, separate from HSAG backup and disaster recovery infrastructure. VPI backup data shall not be stored on HSAG-controlled systems or media.
No HSAG personnel — including employees, officers, directors, agents, consultants, or contractors of HSAG, Halcyon US Holdings Inc., Halcyon US Inc., or any other HSAG affiliate — shall have user accounts, access credentials, or administrative privileges on any VPI Covered Information System, except as expressly authorized under Section 4.5 of this Annex D.
4.4 Prohibition on Shared Cloud Infrastructure
VPI shall not use any cloud computing service, platform, or infrastructure that is shared with, co-tenanted by, or accessible to HSAG or any HSAG affiliate. This prohibition applies to all cloud service models, including Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS), and any hybrid or specialized cloud offerings.
VPI's cloud service providers, if any, shall be contracted independently by VPI, under separate contractual agreements, with separate customer accounts, separate tenant environments, separate encryption keys, and separate administrative credentials. VPI shall ensure that its cloud service provider agreements include contractual provisions prohibiting the cloud service provider from granting access to VPI's cloud environment or data to HSAG or any HSAG affiliate without VPI's express written consent and, where required, U.S. government authorization.
Cloud service providers used by VPI for processing, storing, or transmitting Controlled Technical Data, CUI, ITAR-controlled information, or EAR-controlled information must be authorized under the Federal Risk and Authorization Management Program (FedRAMP) at the Moderate baseline or higher, or must meet equivalent security standards that have been reviewed and approved in writing by the GSC. VPI shall maintain documentation of the FedRAMP authorization status (or equivalent assessment) of each cloud service provider used for controlled data.
VPI shall not migrate any Covered Information System or data to a cloud provider selected, recommended, or designated by HSAG without prior written approval from the GSC and written notification to the Monitoring Agencies at least thirty (30) calendar days in advance of the proposed migration. The notification shall include a description of the proposed cloud provider, the FedRAMP authorization status, the data types to be migrated, and a risk assessment of the proposed migration.
4.5 Authorized Information Sharing Channels
The Parties acknowledge that, following the acquisition, VPI and HSAG will have a legitimate need to exchange certain categories of non-controlled business information for purposes of corporate governance, financial reporting, regulatory compliance (other than export control and national security compliance), and operational coordination. Any such exchange of non-controlled business information between VPI and HSAG shall be conducted only through an approved secure data exchange mechanism (the "Authorized Exchange Gateway") that is documented in the Technology Control Plan (NSA Annex B).
The Authorized Exchange Gateway shall be designed, implemented, and operated in accordance with the following requirements:
(a) The Authorized Exchange Gateway shall be a one-way or two-way controlled data transfer mechanism (as specified in the Technology Control Plan) that permits the transfer only of specifically approved categories of non-controlled business information, such as aggregated financial reporting data, non-technical commercial sales information, human resources data (limited to non-cleared personnel), and corporate governance communications.
(b) The Authorized Exchange Gateway shall incorporate data inspection and filtering capabilities to prevent the transfer of Classified Information, Controlled Technical Data, ITAR-controlled data, EAR-controlled data, CUI, or VPI proprietary trade secrets.
(c) The Authorized Exchange Gateway shall be reviewed and approved by the GSC prior to implementation. The GSC may impose conditions on the operation of the Authorized Exchange Gateway, including limitations on the categories of data that may be transferred, logging requirements, and periodic reviews.
(d) The Authorized Exchange Gateway shall be subject to monitoring by the Third-Party Monitor (Whitmore Compliance Group LLC), including periodic review of transfer logs and data inspection reports.
Under no circumstances shall Controlled Technical Data, ITAR-controlled data, EAR-controlled data, Classified Information, or VPI trade secrets relating to GaN epitaxial recipes, HEMT designs, mmWave power amplifier architectures, die-level reliability screening processes, or any other controlled or sensitive technical information be transmitted through the Authorized Exchange Gateway or any other channel to HSAG personnel, HSAG affiliates, or any foreign person, without prior authorization from the U.S. Government as required by the Technology Control Plan (NSA Annex B) and applicable export control regulations.
4.6 Network Segregation Verification
VPI shall engage an independent third-party cybersecurity assessment firm (the "Segregation Assessor"), approved by the GSC and the Third-Party Monitor, to verify the physical and logical separation of the VPI Segregated Network from the HSAG Global Network. The initial verification shall be completed within ninety (90) calendar days of the Closing (i.e., by May 10, 2024), and subsequent verifications shall be conducted annually thereafter.
The Segregation Assessor shall be a U.S.-owned and U.S.-operated firm with no business relationship with HSAG or any HSAG affiliate. The Segregation Assessor shall conduct a comprehensive assessment including, at a minimum:
(a) physical inspection of VPI network infrastructure at both the Colorado Springs headquarters and the Albuquerque fabrication facility to confirm the absence of HSAG-owned or HSAG-connected hardware;
(b) logical testing of VPI networks to confirm the absence of any network connectivity, routing paths, or data pathways to the HSAG Global Network;
(c) review of VPI's Active Directory, DNS, email, ERP, and other logical systems to confirm independence from HSAG systems;
(d) review of the Authorized Exchange Gateway (if implemented) to confirm that it operates in accordance with the specifications approved by the GSC and the Technology Control Plan; and
(e) review of cloud service provider configurations to confirm tenant isolation from HSAG cloud environments.
The Segregation Assessor shall deliver a written verification report to the GSC, the Third-Party Monitor (Whitmore Compliance Group LLC), and the Monitoring Agencies within thirty (30) calendar days of completing the assessment. The report shall identify any deviations from the segregation requirements of this Section 4, together with an assessment of risk and recommended remediation actions. Any identified deviations shall be remediated by VPI within the timeframes established in Section 13.3.
SECTION 5: CYBERSECURITY INCIDENT REPORTING
5.1 Incident Reporting Obligation to DCSA
VPI shall report any Cybersecurity Incident affecting a Covered Information System to the Defense Counterintelligence and Security Agency (DCSA) within seventy-two (72) hours of discovery of the incident. For purposes of this Section 5, "Discovery" means the point in time at which VPI's cybersecurity personnel, the FSO, the chief information security officer, or any other responsible VPI official has a reasonable basis to conclude that a Cybersecurity Incident has occurred or is occurring.
The initial incident report to DCSA shall include, at a minimum, the following information to the extent known at the time of reporting:
(a) the date and time of discovery of the Cybersecurity Incident;
(b) the nature and scope of the incident, including a description of the attack vector, method of intrusion, or other circumstances giving rise to the incident;
(c) identification of the affected Covered Information Systems, including system names, locations (Colorado Springs or Albuquerque), and network segments;
(d) the types of data potentially affected, specified by category (e.g., Classified Information, CUI, ITAR-controlled data, EAR-controlled data, VPI proprietary trade secrets, other);
(e) an initial assessment of the actual or potential impact of the incident on the confidentiality, integrity, and availability of affected systems and data;
(f) a description of the containment and remediation actions taken or underway at the time of the report; and
(g) the identity and contact information of the VPI personnel managing the incident response, including the Facility Security Officer (Col. (Ret.) Bryce Hendrickson) and the incident response team lead.
The initial report may be submitted in preliminary form, with the understanding that additional details will be provided in supplemental reports as described in Section 5.4.
5.2 Concurrent Notification to Monitoring Agencies and GSC
Concurrent with, or within the same seventy-two (72) hour window as, the notification to DCSA described in Section 5.1, VPI shall notify the Monitoring Agencies (the U.S. Department of the Treasury, the Department of Defense, and the Department of Energy) and the Government Security Committee of the Cybersecurity Incident. Notification to the Monitoring Agencies shall be directed to the designated points of contact identified in Annex F (Points of Contact) of the NSA, or as otherwise specified by the Monitoring Agencies in writing.
The Third-Party Monitor (Whitmore Compliance Group LLC) shall also be notified of the Cybersecurity Incident within the same seventy-two (72) hour window. Notification to the Third-Party Monitor shall include the same information provided in the initial report to DCSA, and the Third-Party Monitor shall be entitled to participate in incident response coordination as an observer, subject to classification restrictions.
5.3 Notification to HSAG
VPI may provide HSAG with a general notification that a Cybersecurity Incident has occurred, limited to:
(a) the fact that an incident has occurred;
(b) the general category of the incident (e.g., network intrusion, malware event, data loss, service disruption);
(c) the potential or actual impact on VPI's business operations, financial performance, or ability to perform its contractual obligations; and
(d) an estimated timeline for resolution.
VPI shall not disclose to HSAG, or to any HSAG personnel, any of the following without prior written approval from the GSC and, if classified information is involved, DCSA:
(a) technical details of the Cybersecurity Incident, including attack vectors, indicators of compromise, or forensic findings;
(b) identification of the specific Classified Information, Controlled Technical Data, ITAR-controlled data, EAR-controlled data, or trade secrets affected by the incident;
(c) details of VPI's cybersecurity defenses, vulnerabilities, or remediation measures; or
(d) any information that could compromise the integrity of an ongoing investigation or response.
The purpose of this limitation is to prevent the inadvertent or deliberate disclosure of national security information, controlled technical data, or cybersecurity vulnerability information to foreign persons, consistent with the FOCI mitigation objectives of the NSA.
5.4 Follow-Up Reporting
Following the initial incident report, VPI shall provide supplemental written reports to DCSA and the Monitoring Agencies at seven (7) calendar day intervals until the Cybersecurity Incident is fully resolved. Each supplemental report shall provide an update on:
(a) the status of the investigation, including any new findings regarding the scope, origin, or attribution of the incident;
(b) the status of containment and remediation actions;
(c) any additional systems or data identified as affected since the prior report;
(d) the status of evidence preservation and forensic analysis; and
(e) any changes to the assessed impact of the incident.
A final incident report shall be submitted to DCSA and the Monitoring Agencies within thirty (30) calendar days of incident closure (i.e., the date on which VPI determines that the incident has been fully contained, remediated, and that affected systems have been restored to normal operations). The final report shall include:
(a) a comprehensive root cause analysis identifying the underlying technical, procedural, or personnel factors that contributed to the incident;
(b) a full description of the scope of compromise, including all systems and data affected;
(c) a data impact assessment, specifying the categories and quantities of information potentially compromised;
(d) a description of all remediation actions completed; and
(e) a description of measures implemented to prevent recurrence of the same or similar incidents, including any changes to security controls, procedures, or training.
5.5 Incident Reporting for Classified Systems
Notwithstanding the seventy-two (72) hour reporting window set forth in Section 5.1, Cybersecurity Incidents involving classified information systems — that is, Covered Information Systems that process, store, or transmit information classified at the CONFIDENTIAL or SECRET level — shall be reported to DCSA immediately upon discovery, in accordance with NISPOM requirements (32 C.F.R. Part 117) and any applicable DCSA security directives. "Immediately" means without unreasonable delay, and in no event later than twenty-four (24) hours after discovery.
The Facility Security Officer, Col. (Ret.) Bryce Hendrickson, shall personally oversee the reporting and response for any Cybersecurity Incident involving classified systems, including direct communication with DCSA, coordination with the GSC, and management of the incident response team. The FSO shall ensure that all response activities are conducted in compliance with NISPOM requirements and that classified information involved in or arising from the incident (including forensic evidence and investigation findings) is handled in accordance with its classification level.
5.6 Preservation of Evidence
VPI shall preserve all logs, forensic images, disk images, memory captures, network packet captures, malware samples, and any other evidence related to any Cybersecurity Incident for a minimum of three (3) years following incident closure, or such longer period as may be directed in writing by DCSA or the Monitoring Agencies. Evidence shall be stored securely, with appropriate access controls and chain-of-custody documentation, on VPI-controlled infrastructure within the VPI Segregated Network.
Evidence shall be made available to the Third-Party Monitor (Whitmore Compliance Group LLC), DCSA, the Monitoring Agencies, and any U.S. Government investigative agency upon request. VPI shall not destroy, modify, or dispose of any incident-related evidence without prior written authorization from the Monitoring Agencies.
SECTION 6: ANNUAL THIRD-PARTY PENETRATION TESTING
6.1 Requirement. VPI shall engage an independent, qualified third-party cybersecurity assessment firm (the "Penetration Testing Firm") to conduct comprehensive penetration testing of all Covered Information Systems at least once per calendar year. The purpose of the annual penetration test is to identify exploitable vulnerabilities in VPI's cybersecurity defenses, assess the effectiveness of security controls, and provide actionable recommendations for remediation.
The first penetration test under this Annex D shall be completed within one hundred eighty (180) calendar days of the Closing (i.e., by August 7, 2024). Subsequent penetration tests shall be completed at intervals not exceeding twelve (12) months from the date of completion of the prior test.
6.2 Selection and Approval of Penetration Testing Firm
The Penetration Testing Firm shall be selected by VPI, subject to prior approval by the Government Security Committee. In selecting the Penetration Testing Firm, VPI shall apply the following mandatory criteria:
(a) The Penetration Testing Firm shall be a U.S.-owned and U.S.-operated entity, with no foreign ownership, control, or influence (FOCI) as defined in 32 C.F.R. Part 117.
(b) The Penetration Testing Firm shall not have any current or prior (within the past three years) business relationship, contractual arrangement, or financial interest with HSAG, Halcyon US Holdings Inc., Halcyon US Inc., or any other HSAG affiliate.
(c) All personnel of the Penetration Testing Firm who will participate in the penetration testing engagement shall be United States citizens.
(d) The Penetration Testing Firm shall hold one or more recognized industry certifications relevant to penetration testing services, such as certification from the Council of Registered Ethical Security Testers (CREST), adherence to the Penetration Testing Execution Standard (PTES), or equivalent certifications or qualifications accepted by the GSC.
(e) The Penetration Testing Firm shall have demonstrable experience conducting penetration testing for U.S. Government contractors, cleared defense contractors, or organizations subject to NIST SP 800-171, CMMC, or NISPOM requirements.
VPI shall submit the proposed Penetration Testing Firm to the GSC for approval at least thirty (30) calendar days prior to the planned start of the engagement. The GSC may reject the proposed firm for cause and require VPI to identify an alternative firm.
6.3 Scope of Testing
Each annual penetration test shall encompass the following areas, at a minimum:
(a) External Network Penetration Testing: Testing of VPI's internet-facing network perimeter, including firewalls, web servers, VPN gateways, email gateways, and DNS servers, to identify vulnerabilities exploitable from outside the VPI Segregated Network.
(b) Internal Network Penetration Testing: Testing conducted from within the VPI Segregated Network to identify vulnerabilities exploitable by an attacker who has gained initial access to the internal network, including lateral movement, privilege escalation, and data exfiltration paths.
(c) Web Application Testing: Testing of any VPI web-facing applications, portals, or interfaces (including customer portals, supplier portals, and internal web applications) for common web application vulnerabilities, in accordance with the OWASP Testing Guide or equivalent methodology.
(d) Wireless Network Testing: Testing of VPI's wireless network infrastructure at both the Colorado Springs headquarters and the Albuquerque fabrication facility, including identification of rogue access points, weak encryption, and unauthorized wireless devices.
(e) Social Engineering Testing: Simulated phishing campaigns, pretexting scenarios, and other social engineering techniques designed to assess the susceptibility of VPI personnel to social engineering attacks and the effectiveness of VPI's security awareness training.
(f) Physical Security Testing of IT Access Points: Assessment of physical security controls protecting IT infrastructure access points at both VPI facilities, including server rooms, data centers, wiring closets, and network equipment rooms, to identify vulnerabilities that could enable unauthorized physical access to Covered Information Systems.
(g) Testing of the Authorized Exchange Gateway: If the Authorized Exchange Gateway described in Section 4.5 has been implemented, the penetration test shall include testing of the Gateway to verify that it cannot be exploited to transfer controlled data, bypass data inspection controls, or provide unauthorized access between the VPI Segregated Network and the HSAG Global Network.
Classified information systems shall be tested in accordance with procedures and rules of engagement approved by DCSA, and only by penetration testing personnel who hold appropriate personnel security clearances.
6.4 Reporting. The Penetration Testing Firm shall deliver a comprehensive written report of findings to VPI's Government Security Committee within thirty (30) calendar days of the completion of the penetration test. The report shall include, at a minimum:
(a) an executive summary of the overall assessment, including an assessment of VPI's cybersecurity posture relative to the prior year's assessment (for tests after the initial test);
(b) a detailed description of each identified vulnerability, including the affected system or application, the attack vector, the method of exploitation, and the evidence of successful exploitation (or, if the vulnerability was identified but not exploited, an explanation of the potential exploitation path);
(c) a severity rating for each identified vulnerability, using an established severity rating framework (e.g., the Common Vulnerability Scoring System (CVSS));
(d) an assessment of the potential business and national security impact of each vulnerability, including the potential for unauthorized access to Classified Information, Controlled Technical Data, ITAR/EAR-controlled data, or VPI trade secrets;
(e) prioritized remediation recommendations for each identified vulnerability; and
(f) a summary of any positive findings (i.e., security controls that performed effectively during the test).
VPI shall provide copies of the penetration testing report to the Third-Party Monitor (Whitmore Compliance Group LLC) within five (5) business days of receipt. The report shall also be made available to the Monitoring Agencies upon written request.
Identified vulnerabilities shall be remediated by VPI within the following timeframes, measured from the date of delivery of the penetration testing report to the GSC:
• Critical-severity findings: thirty (30) calendar days;
• High-severity findings: thirty (30) calendar days;
• Medium-severity findings: ninety (90) calendar days;
• Low-severity findings: one hundred eighty (180) calendar days.
Remediation timelines and status shall be documented in the POA&M described in Section 3.3. VPI shall report remediation progress to the GSC and the Third-Party Monitor on a monthly basis until all findings are closed.