CONTROLLED — NOT FOR PUBLIC RELEASE

CONTROLLED — NOT FOR PUBLIC RELEASE
ANNEX E
TO NATIONAL SECURITY AGREEMENT
(NSA-2024-0019)
— ANNUAL COMPLIANCE REPORT TEMPLATE —
CONTROLLED — NOT FOR PUBLIC RELEASE
NATIONAL SECURITY AGREEMENT ANNEX E — ANNUAL COMPLIANCE REPORT TEMPLATE
National Security Agreement Reference: National Security Agreement dated January 19, 2024 (the "NSA" or "Agreement"), entered into among Halcyon Semiconductor Aktiengesellschaft, a corporation organized under the laws of the Federal Republic of Germany ("HSAG"), Halcyon US Holdings Inc., a Delaware corporation ("Halcyon US Holdings"), Marlowe Asset Management Photonics Inc., a Delaware corporation ("VPI" and, together with HSAG and Halcyon US Holdings, the "Covered Parties"), and the United States of America, acting through the U.S. Department of the Treasury, the U.S. Department of Defense, and the U.S. Department of Energy (collectively, the "Monitoring Agencies" or the "U.S. Government").
CFIUS Case No.: CFIUS-023-07-3841
Prepared by:
Whitmore Compliance Group LLC 1300 Crystal Drive, Suite 710 Arlington, VA 22202
Principal / Third-Party Monitor: Gerald Whitmore
Template Version: 1.0
Effective Date: January 19, 2024 (date of NSA execution)
Distribution:
•  Defense Counterintelligence and Security Agency (DCSA)
•  U.S. Department of the Treasury, Office of Investment Security
•  U.S. Department of Defense
•  U.S. Department of Energy
•  Whitmore Compliance Group LLC (retained copy)
•  Covered Parties (HSAG, Halcyon US Holdings Inc., VPI)
Note: This template shall be used for all annual compliance audit reports required under Section 7.2 of the NSA. The first Annual Compliance Report is due no later than January 19, 2025, covering the period from the acquisition closing date (February 9, 2024) through the end of the first reporting year (January 18, 2025). All subsequent annual reports shall follow this template and the reporting guidelines set forth herein, unless this template is amended with the prior written approval of all parties and the Committee on Foreign Investment in the United States ("CFIUS").
Right-click to update Table of Contents
SECTION 1
GENERAL INSTRUCTIONS AND REPORTING GUIDELINES
1.1 Purpose of the Annual Compliance Report
The Annual Compliance Report (the "Report" or "ACR") is the principal instrument through which the Third-Party Monitor documents and communicates its independent findings regarding the Covered Parties' compliance with the terms, conditions, and obligations imposed under National Security Agreement No. NSA-2024-0019 (the "NSA"). The Report is prepared by the Third-Party Monitor — Whitmore Compliance Group LLC, acting through its Principal, Gerald Whitmore — and is submitted to the CFIUS Monitoring Agencies on an annual basis in accordance with the schedule and procedures set forth in this Annex E.
The purpose of the Annual Compliance Report is to provide the Monitoring Agencies with a comprehensive, independent, and objective assessment of whether the Covered Parties — Halcyon Semiconductor AG ("HSAG"), Halcyon US Holdings Inc. ("Halcyon US Holdings"), and Marlowe Asset Management Photonics Inc. ("VPI") — have fulfilled their respective obligations under the NSA during each reporting period. The Report is intended to enable the Monitoring Agencies to evaluate the effectiveness of the mitigation measures imposed by the NSA, to identify areas of non-compliance or emerging risk, and to determine whether additional action by the U.S. Government is warranted.
The Report covers all compliance areas specified in the NSA, including but not limited to the following:
(a) Board governance and Government Security Committee operations, as specified in the NSA and Annex C — Governance Provisions and Government Security Committee Charter;
(b) Technology Control Plan adherence, including controls on the transfer and access of Controlled Technical Data, as specified in Annex B — Technology Control Plan;
(c) Cybersecurity requirements, including compliance with the NIST SP 800-171 framework, penetration testing, IT system segregation, and incident reporting, as specified in Annex D — Cybersecurity Requirements;
(d) Facility access controls, including restrictions on access by HSAG personnel to classified areas of VPI facilities, as specified in Annex F — Facility Access Procedures;
(e) Data segregation requirements, including the physical and logical separation of VPI IT systems from the HSAG global network;
(f) Personnel continuity obligations, including the retention of key VPI personnel for the required periods;
(g) Pre-notification obligations for material changes to VPI's business;
(h) Government contract and export control compliance, including ITAR and EAR obligations; and
(i) intellectual property protections, including restrictions on the transfer of VPI patents and trade secrets to non-U.S. HSAG entities.
The Report is submitted to each of the following CFIUS Monitoring Agencies: the Defense Counterintelligence and Security Agency ("DCSA"), the U.S. Department of the Treasury (Office of Investment Security), the U.S. Department of Defense, and the U.S. Department of Energy. A copy of the Report is also retained by Whitmore Compliance Group LLC and provided to each Covered Party in accordance with the distribution procedures set forth in Appendix 6 to this template.
1.2 Reporting Period
Each Annual Compliance Report shall cover a single reporting period as defined below. The Monitor shall clearly identify the applicable reporting period on the cover page and throughout the Report using the following template fields:
Reporting Period Start Date: _______
Reporting Period End Date: _______
The first reporting period shall commence on the acquisition closing date, February 9, 2024, and shall end on January 18, 2025. This initial reporting period reflects the interval between the date on which HSAG's acquisition of VPI was consummated and the day immediately preceding the first anniversary of NSA execution. Subsequent reporting periods shall consist of twelve-month intervals running from January 19 through January 18 of the following calendar year (e.g., the second reporting period will run from January 19, 2025, through January 18, 2026; the third from January 19, 2026, through January 18, 2027; and so forth for the duration of the NSA's effectiveness).
The completed Annual Compliance Report shall be submitted to each Monitoring Agency no later than thirty (30) calendar days following the end of the applicable reporting period. For the first annual report, the submission deadline is February 17, 2025. If the submission deadline falls on a weekend or federal holiday, the Report shall be due on the next business day. The Monitor shall transmit the Report via the secure transmission channels designated by each Monitoring Agency and shall confirm receipt within three (3) business days of submission.
In the event that the Monitor requires additional time to complete the Report, the Monitor shall submit a written request for an extension to the lead Monitoring Agency (DCSA) no later than fifteen (15) calendar days before the original submission deadline, identifying the reason for the requested extension and the proposed revised deadline. Extensions are granted at the sole discretion of the Monitoring Agencies and shall not exceed thirty (30) additional calendar days absent extraordinary circumstances.
1.3 Monitor Identification and Independence Certification
1.3.1 Monitor Identification
The following information shall be provided for each Report:
Monitor Entity Name: Whitmore Compliance Group LLC
Principal Name: Gerald Whitmore
Address: 1300 Crystal Drive, Suite 710, Arlington, VA 22202
Telephone: _______
Email: _______
Alternate Contact (Deputy Principal): _______
1.3.2 Independence Certification
The Monitor shall include the following signed certification in each Report. The certification shall be executed by the Principal personally:
INDEPENDENCE CERTIFICATION
I, Gerald Whitmore, Principal of Whitmore Compliance Group LLC (the "Monitor"), hereby certify as follows in connection with the Annual Compliance Report for the reporting period from __ to __ under National Security Agreement No. NSA-2024-0019:
1.  The Monitor and all Monitor personnel who participated in the preparation of this Report have maintained complete independence from all Covered Parties — Halcyon Semiconductor AG, Halcyon US Holdings Inc., and Marlowe Asset Management Photonics Inc. — during the entirety of the reporting period.
2.  No conflicts of interest, whether actual or apparent, have arisen during the reporting period that would impair the Monitor's objectivity, impartiality, or professional judgment.
3.  Neither the Monitor nor any of its personnel, officers, directors, or affiliates maintains any financial relationship with HSAG, Halcyon US Holdings Inc., or VPI, other than the engagement agreement providing for annual compensation of One Million Two Hundred Thousand Dollars ($1,200,000) per annum, payable in quarterly installments of Three Hundred Thousand Dollars ($300,000) per quarter by HSAG, subject to adjustment in accordance with the Consumer Price Index (CPI-U) on each anniversary of the engagement date, as provided for in NSA Section 7.4.
4.  The Monitor has not received, and has not been offered, any gift, gratuity, compensation, entertainment, loan, or thing of value from any Covered Party, any officer, director, employee, or agent of any Covered Party, or any affiliate of any Covered Party, other than the compensation described in paragraph 3 above.
5.  The Monitor has disclosed to the Monitoring Agencies any circumstance, relationship, or event that could reasonably be perceived as affecting the Monitor's independence, objectivity, or impartiality. As of the date of this certification, [no such circumstance, relationship, or event exists / the following circumstances have been disclosed: ______].
This certification is made under penalty of perjury and in accordance with the requirements of NSA-2024-0019.
________________________________________
Gerald Whitmore Principal, Whitmore Compliance Group LLC
Date: ________
1.3.3 Disclosure of Audit Personnel
The Monitor shall provide a complete listing of all personnel who participated in the conduct of the annual compliance audit and the preparation of this Report. The following information shall be provided for each individual:
All Monitor personnel who had access to Classified Information during the audit must hold active security clearances at or above the level required for such access. The Monitor shall confirm that all such clearances were verified by DCSA prior to the commencement of audit activities involving classified materials.
1.4 Methodology
1.4.1 Audit Methodology
The Monitor shall describe, in each Report, the specific audit methodology employed to assess compliance with the NSA during the applicable reporting period. The methodology shall include, at a minimum, the following components:
(a) Document Review. Comprehensive review of relevant corporate documents, policies, procedures, records, and correspondence, including but not limited to: board and GSC meeting minutes and agendas; TCP procedures and training records; cybersecurity policies, System Security Plans, and penetration test reports; facility visitor logs; IT architecture diagrams and network configuration documentation; export license applications and records; personnel records; data transfer logs; and any incident reports filed during the reporting period.
(b) Personnel Interviews. Structured and unstructured interviews with key VPI and HSAG personnel, including members of VPI's board of directors, the Government Security Committee, VPI executive management, the Facility Security Officer, IT security staff, export compliance personnel, and other employees as deemed relevant by the Monitor. The Monitor shall identify all personnel interviewed in Appendix 2 to the Report.
(c) Site Visits and Physical Inspections. On-site visits to VPI facilities, including the headquarters at 7400 Ridgeline Parkway, Colorado Springs, CO 80919, and the Albuquerque fabrication facility at 9200 Innovation Boulevard, Albuquerque, NM 87113. Site visits shall include physical inspection of classified and controlled areas, data centers, server rooms, access control systems, visitor management systems, and other physical security infrastructure. The Monitor shall identify all site visits in Appendix 3 to the Report.
(d) System Inspections. Technical inspection and testing of IT systems, network infrastructure, access controls, data loss prevention tools, firewall configurations, and other cybersecurity controls as relevant to the compliance areas being assessed.
(e) Sampling Procedures. Where the volume of records or transactions precludes a complete review, the Monitor shall employ statistically valid sampling procedures. The Monitor shall describe the sampling methodology, sample size, and basis for sample selection in each relevant section of the Report.
(f) Testing of Controls. Where appropriate, the Monitor shall conduct independent testing of controls, including but not limited to: testing of access controls to classified areas; testing of TCP information-sharing controls; testing of DLP tool effectiveness; and verification of cybersecurity incident response procedures.
1.4.2 Personnel Interviewed
The Monitor shall identify all VPI and HSAG personnel interviewed during the audit period. A complete listing shall be provided in Appendix 2 to the Report. In this section, the Monitor shall provide a summary identifying the total number of interviews conducted, the general categories of personnel interviewed (e.g., executive management, IT staff, facility security, export compliance, cleared program managers), and any limitations encountered in scheduling or conducting interviews.
1.4.3 Facilities Visited
The Monitor shall identify all VPI facilities visited during the audit period. The primary facilities subject to review are:
(a) VPI Headquarters: 7400 Ridgeline Parkway, Colorado Springs, CO 80919
(b) VPI Albuquerque Fabrication Facility: 9200 Innovation Boulevard, Albuquerque, NM 87113
A complete log of all site visits shall be provided in Appendix 3 to the Report. The Monitor shall note any areas of VPI facilities that were not visited during the audit period and the reason for any such omission.
1.4.4 Applicable Authorities and Standards
The Monitor's assessment is conducted with reference to the following NSA provisions, annexes, and regulatory standards:
(a) NSA-2024-0019, including all sections and exhibits thereto;
(b) Annex A — Definitions;
(c) Annex B — Technology Control Plan;
(d) Annex C — Governance Provisions and Government Security Committee Charter;
(e) Annex D — Cybersecurity Requirements;
(f) Annex F — Facility Access Procedures;
(g) National Institute of Standards and Technology Special Publication 800-171, Revision 2 ("NIST SP 800-171"), Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations;
(h) International Traffic in Arms Regulations, 22 C.F.R. Parts 120–130 ("ITAR");
(i) Export Administration Regulations, 15 C.F.R. Parts 730–774 ("EAR");
(j) National Industrial Security Program Operating Manual ("NISPOM"), 32 C.F.R. Part 117;
(k) Defense Federal Acquisition Regulation Supplement ("DFARS"), particularly DFARS 252.209-7002 and DFARS 252.227-7038; and
(l) Federal Acquisition Regulation ("FAR"), particularly FAR 42.12 (Novation and Change-of-Name Agreements).
1.5 Definitions
All capitalized terms used in this template have the meanings set forth in Annex A to the NSA, unless otherwise defined herein. The following key defined terms are referenced throughout this template and are used with the meanings assigned to them in Annex A:
"Classified Information" means information that has been determined pursuant to Executive Order 13526, or any predecessor or successor order, to require protection against unauthorized disclosure in the interest of national security and that is marked to indicate its classified status when in documentary form.
"Controlled Technical Data" means technical data subject to export controls under the ITAR (22 C.F.R. § 120.33) or the EAR (15 C.F.R. § 772.1), or technical data that is subject to restrictions on access or dissemination under the terms of a U.S. Government contract, grant, or cooperative agreement.
"Covered Parties" means, collectively, HSAG, Halcyon US Holdings Inc., and VPI.
"Facility Security Clearance" or "FCL" means a determination by DCSA that a facility is eligible for access to classified information at a specified level.
"Government Security Committee" or "GSC" means the committee of VPI's board of directors established pursuant to NSA Section 5 and Annex C, composed of the three Security Board Members, and vested with exclusive authority over classified and ITAR-controlled programs, personnel security decisions, and facility security matters.
"HSAG Designee" means a member of VPI's board of directors designated by HSAG pursuant to NSA Section 5.2(b) and Annex C, Section 3.
"Security Board Member" means a member of VPI's board of directors appointed in accordance with NSA Section 5.2(a) and Annex C, Section 2, who is a U.S. citizen holding or eligible for a personnel security clearance at the TOP SECRET/SCI level.
"Technology Control Plan" or "TCP" means the plan set forth in Annex B to the NSA, governing the protection of Controlled Technical Data and Classified Information within VPI and between VPI and HSAG entities.
"Third-Party Monitor" or "Monitor" means Whitmore Compliance Group LLC, acting through its Principal, Gerald Whitmore, appointed pursuant to NSA Section 7 to monitor and report on the Covered Parties' compliance with the NSA.
"VPI" means Marlowe Asset Management Photonics Inc., a Delaware corporation.
Additional abbreviations used throughout this template are defined in the Glossary of abbreviations set forth in Appendix 4.
1.6 Classification of Findings
1.6.1 Compliance Status Categories
The Monitor shall classify each compliance area, and each individual finding, using one of the following four compliance status categories:
(a) Compliant. The Covered Parties are in full compliance with the applicable NSA requirement(s). No deficiencies, deviations, or areas of concern were identified. The relevant controls are functioning as designed and are effective in achieving the intended mitigation objectives.
(b) Compliant with Observations. The Covered Parties are in substantive compliance with the applicable NSA requirement(s), but the Monitor has identified one or more observations that warrant attention. Observations may include minor procedural irregularities that do not rise to the level of non-compliance, opportunities for improvement in the design or operation of controls, emerging trends that could present compliance risk in the future, or documentation deficiencies that do not affect the substance of compliance. No corrective action is formally required, but the Monitor may recommend voluntary improvements.
(c) Non-Compliant — Minor. The Covered Parties have failed to comply with one or more applicable NSA requirements in a manner that constitutes a deviation from the terms of the NSA but does not, in the Monitor's professional judgment, rise to the level of a material non-compliance. Minor non-compliance findings typically involve isolated procedural lapses, administrative errors, or documentation failures that did not result in the actual compromise of Classified Information, Controlled Technical Data, or other protected interests. Corrective action is required, and the Monitor shall specify the recommended corrective action and a proposed timeline for remediation.
(d) Non-Compliant — Material. The Covered Parties have failed to comply with one or more applicable NSA requirements in a manner that constitutes a material breach of the NSA. Material non-compliance findings include, but are not limited to: unauthorized access to Classified Information by non-cleared or non-U.S. persons; unauthorized transfer of Controlled Technical Data to HSAG or other non-U.S. entities; failure to maintain the required board composition or GSC structure; failure to maintain VPI's Facility Security Clearance; unauthorized facility access by HSAG personnel to classified areas; and systemic failures in cybersecurity controls. Material non-compliance requires immediate corrective action and triggers the notification obligations set forth in NSA Section 12.3.
1.6.2 Implications of Material Non-Compliance
Material non-compliance with the terms of the NSA may result in significant consequences for the Covered Parties, including but not limited to civil penalties of up to Two Hundred Fifty Thousand Dollars ($250,000) per violation per day, as provided in NSA Section 12.3 and consistent with the authorities granted to the President under Section 721(l)(3) of the Defense Production Act of 1950, as amended (50 U.S.C. § 4565(l)(3)). In addition, the U.S. Government may seek injunctive relief in the United States District Court for the District of Columbia, or any other court of competent jurisdiction, to compel compliance with the terms of the NSA. In the most severe cases, persistent or egregious material non-compliance may result in the U.S. Government seeking an order of mandated divestiture of VPI by HSAG, as provided in NSA Section 12.4.
The Monitor shall immediately notify DCSA and the other Monitoring Agencies upon identification of any event or condition that the Monitor believes may constitute material non-compliance, without waiting for the completion of the Annual Compliance Report. Such interim notifications shall be made in writing within five (5) business days of discovery and shall be followed by a detailed description in the next Annual Compliance Report.
SECTION 2
EXECUTIVE SUMMARY
2.1 Overall Compliance Assessment
Overall Compliance Rating for Reporting Period: _______
[The Monitor shall insert one of the following ratings: "Compliant," "Compliant with Observations," "Non-Compliant — Minor," or "Non-Compliant — Material." The overall rating reflects the Monitor's holistic assessment of the Covered Parties' compliance across all NSA compliance areas during the reporting period.]
Summary Narrative:
[The Monitor shall provide a high-level narrative assessment, not to exceed two pages, summarizing whether the Covered Parties are in compliance with the terms and conditions of NSA-2024-0019. The narrative should address the Monitor's overall level of confidence in the Covered Parties' compliance posture, highlight any overarching themes or patterns observed during the audit, and provide context for the detailed findings set forth in Sections 3 through 11 of this Report.]
________________________________________
________________________________________
________________________________________
________________________________________
________________________________________
Summary of Findings by Category:
2.2 Summary of Key Findings
The Monitor shall provide a bullet-point summary of the most significant compliance observations and findings across all NSA compliance areas. This summary is intended to highlight matters of particular importance to the Monitoring Agencies and does not replace the detailed analysis in subsequent sections.
•  [Key Finding 1 — e.g., Board governance: summary of compliance status and any notable observations]
•  [Key Finding 2 — e.g., TCP compliance: summary of any controlled data transfer concerns]
•  [Key Finding 3 — e.g., Cybersecurity: summary of penetration testing results and IT segregation status]
•  [Key Finding 4 — e.g., Facility access: summary of visitor log review and any deviations]
•  [Key Finding 5 — e.g., Personnel continuity: status of key personnel retention obligations]
•  [Additional findings as applicable]
Areas of Concern or Risk Trends:
[The Monitor shall identify any areas of concern or risk trends that, while not yet constituting non-compliance, may require attention from the Covered Parties or the Monitoring Agencies. Examples include emerging personnel turnover trends, increasing volume of HSAG personnel visits, evolving cybersecurity threat landscape, or anticipated changes to VPI's government contract portfolio.]
________________________________________
________________________________________
________________________________________
2.3 Comparison to Prior Year (for Reports After Year 1)
Comparison Narrative:
[For the second and subsequent Annual Compliance Reports, the Monitor shall provide a comparative analysis of the current period's findings relative to the prior reporting period. This analysis should address whether overall compliance has improved, remained stable, or deteriorated; identify any recurring findings; and note the resolution status of previously identified observations and corrective actions.]
[For the first Annual Compliance Report: N/A — This section is not applicable to the first annual report, as there is no prior reporting period for comparison.]
Status of Previously Identified Observations and Corrective Actions:
[For the second and subsequent Annual Compliance Reports, the Monitor shall provide a summary table tracking the disposition of all observations and corrective actions identified in prior reports. See Section 12.2 for the detailed corrective action tracking table.]
[For the first Annual Compliance Report: N/A.]
2.4 Recommendations
The Monitor shall provide a summary of recommendations for remediation or improvement, if any, arising from the current reporting period's audit findings. Recommendations shall be prioritized by urgency using the following framework:
Priority 1 — Immediate Action Required. Recommendations addressing material non-compliance or conditions that pose an imminent risk to the effectiveness of NSA mitigation measures. Target implementation: within thirty (30) calendar days.
Priority 2 — Near-Term Action Required. Recommendations addressing minor non-compliance or conditions that, if left unaddressed, may develop into material compliance risks. Target implementation: within ninety (90) calendar days.
Priority 3 — Advisory. Recommendations for voluntary improvements to enhance the effectiveness of controls, address emerging risks, or adopt best practices. Target implementation: within the next reporting period.
Summary of Recommendations:
SECTION 3
BOARD GOVERNANCE AND GOVERNMENT SECURITY COMMITTEE COMPLIANCE
3.1 Board Composition Verification
The Monitor shall verify that VPI's board of directors is constituted in accordance with the requirements of the NSA and Annex C — Governance Provisions and Government Security Committee Charter. Under NSA Section 5.2 and Annex C, VPI's board of directors shall consist of five (5) members, constituted as follows:
(a) Three (3) Security Board Members, each of whom must be a United States citizen who holds or is eligible for a personnel security clearance at the TOP SECRET/Sensitive Compartmented Information (TS/SCI) level. The Security Board Members shall include at least one Independent Security Director who has no prior employment, consulting, or other business relationship with any Covered Party other than service on VPI's board of directors. The Security Board Members constitute the Government Security Committee and exercise exclusive authority over all classified and ITAR-controlled programs, personnel security decisions, and facility security matters.
(b) Two (2) HSAG Designees, designated by HSAG to represent its interests as the acquiring party. HSAG Designees are not required to be U.S. citizens and are not permitted to hold, access, or be provided access to Classified Information. HSAG Designees may not participate in GSC deliberations or vote on matters within GSC-exclusive authority.
The Monitor shall complete the following table based on its verification of board composition during the reporting period:
The Monitor shall verify the following with respect to board composition:
(a) That no changes in board composition occurred during the reporting period without the prior written approvals required under the NSA and Annex C, including approvals by the GSC (for Security Board Member replacements) and DCSA (for personnel security clearance eligibility determinations).
(b) That each Security Board Member held an active personnel security clearance at the TS/SCI level throughout the reporting period, or, in the case of a newly appointed member, that a clearance application was submitted promptly and interim access arrangements were authorized by DCSA.
(c) That the Independent Security Director satisfied the independence requirements set forth in Annex C, Section 2.3, throughout the reporting period.
(d) That the HSAG Designees have not held, accessed, or been provided access to Classified Information at any time during the reporting period. The Monitor shall review access logs, facility visitor records, and interviews with the Facility Security Officer and GSC members to verify this requirement.
(e) That the HSAG Designees have not attended or participated in any GSC meeting or deliberation, and have not been provided with GSC meeting minutes, agendas, or other materials pertaining to matters within GSC-exclusive authority, except to the extent that redacted or unclassified summaries have been provided in accordance with the procedures set forth in Annex C, Section 4.6.
3.2 Government Security Committee (GSC) Operations
The Monitor shall verify that the Government Security Committee has been operating in accordance with the requirements of the NSA and Annex C. Specifically, the Monitor shall assess the following:
GSC Composition: The Monitor shall confirm that the GSC is composed of the three (3) Security Board Members identified in the table above, and that no other individuals have been appointed to or participated in the GSC in any capacity.
GSC Meetings: The Monitor shall review all GSC meeting minutes and agendas for the reporting period. The Monitor shall report the following:
•  Total number of GSC meetings held during the reporting period: __
•  Number of meetings at which a quorum was present (quorum = 2 of 3 Security Board Members): __
•  Number of meetings conducted in person vs. by secure teleconference or videoconference: In Person: __ / Secure Remote: __
GSC Authority: The Monitor shall verify that the GSC exercised exclusive authority over the following matters during the reporting period, as required by NSA Section 5.4 and Annex C, Section 5:
(a) All matters relating to classified and ITAR-controlled programs, including the acceptance of new classified contracts, the sponsorship of personnel for security clearances, and decisions regarding the handling, storage, and transmission of Classified Information and Controlled Technical Data;
(b) All personnel security decisions, including the initiation and adjudication of personnel security clearance applications, the reporting of adverse information, and the suspension or revocation of access to Classified Information;
(c) All facility security matters, including the maintenance of VPI's Facility Security Clearance, compliance with NISPOM requirements, and the implementation of physical security measures at VPI facilities; and
(d) All communications with DCSA, the contracting officers for classified contracts, and other U.S. Government officials regarding security matters.
Improper Influence Assessment: The Monitor shall assess whether any matters within GSC-exclusive authority were improperly decided, influenced, directed, or interfered with by the HSAG Designees, HSAG management, or any other non-U.S. person during the reporting period. The Monitor shall conduct interviews with each GSC member and review relevant correspondence, email communications, and meeting records to support this assessment.
GSC-Approved Actions: The Monitor shall provide a summary of significant actions approved by the GSC during the reporting period, including but not limited to:
•  New classified contract awards: __
•  Personnel clearance sponsorships initiated: __
•  Personnel clearance sponsorships completed: __
•  Facility modifications approved: __
•  Other significant actions: _______
3.3 Findings and Observations — Board Governance
Compliance Status: _______
[Compliant / Compliant with Observations / Non-Compliant — Minor / Non-Compliant — Material]
Narrative Description of Findings or Observations:
________________________________________
________________________________________
________________________________________
________________________________________
________________________________________
________________________________________
Recommended Corrective Actions (if applicable):
________________________________________
________________________________________
________________________________________
SECTION 4
TECHNOLOGY CONTROL PLAN (TCP) COMPLIANCE
4.1 TCP Implementation Status
This section assesses the Covered Parties' compliance with the Technology Control Plan set forth in Annex B to the NSA. The TCP establishes the procedures and controls governing the identification, marking, handling, storage, transmission, and protection of Controlled Technical Data and Classified Information within VPI and between VPI and HSAG entities. The TCP is a cornerstone of the mitigation framework imposed by the NSA and is intended to prevent the unauthorized transfer of defense-related and export-controlled technology to foreign persons.
The Monitor shall verify the following with respect to TCP implementation:
(a) Operative Status. Confirmation that the TCP has been fully implemented and is operative at all VPI facilities, including the Colorado Springs headquarters (7400 Ridgeline Parkway, Colorado Springs, CO 80919) and the Albuquerque fabrication facility (9200 Innovation Boulevard, Albuquerque, NM 87113). The Monitor shall assess whether TCP procedures are being followed in practice and not merely documented in policy.
(b) TCP Training. Review of TCP training records to verify that all VPI employees with access to Controlled Technical Data or Classified Information have received TCP training within the reporting period. The Monitor shall report the following:
•  Total number of VPI employees required to complete TCP training: __
•  Number of VPI employees who completed TCP training during the reporting period: __
•  Training completion rate: ___%
•  Training methodology (e.g., in-person, online, hybrid): _______
•  Date(s) of training sessions: _______
•  Training content reviewed by Monitor (Y/N): __
(c) TCP Procedures Manual. Confirmation that VPI maintains a current TCP procedures manual and that the manual has been updated to reflect any changes to applicable regulations, NSA requirements, or VPI operations during the reporting period.
4.2 Controlled Technical Data Access and Transfer Review
The Monitor shall conduct a detailed review of all instances in which Controlled Technical Data — including data controlled under the International Traffic in Arms Regulations (ITAR), Category XI(a)(3) of the United States Munitions List, and data classified under Export Control Classification Numbers (ECCNs) 3A001, 3A991, and 3E001 under the Export Administration Regulations (EAR) — was accessed, transferred, shared, or otherwise made available during the reporting period.
The Monitor shall assess the following:
(a) Whether any ITAR-controlled or EAR-controlled technical data or technology was transferred to, accessed by, or shared with any non-U.S. person during the reporting period, whether within VPI or externally. For purposes of this assessment, "non-U.S. person" includes HSAG personnel (including HSAG Designees on VPI's board), employees of HSAG entities outside the United States, and any other foreign nationals.
(b) Whether any transfers of Controlled Technical Data occurred without prior authorization from the relevant U.S. Government authority (i.e., the Directorate of Defense Trade Controls for ITAR-controlled data; the Bureau of Industry and Security for EAR-controlled data).
(c) A review of any export license applications submitted by VPI during the reporting period. The Monitor shall reference VPI's DDTC Registration No. M-24817 and shall identify the status of all active DSP-5 licenses, including any amendments or renewals filed during the reporting period.
(d) A review of information-sharing procedures between VPI and HSAG for legitimate business purposes, including financial reporting, corporate governance, and strategic planning. The Monitor shall confirm that all Controlled Technical Data was excluded from such information-sharing absent prior U.S. Government authorization. The Monitor shall review the specific protocols, data classification procedures, and access controls that VPI employs to segregate controlled information from information that may be shared with HSAG.
(e) Sampling of electronic communications (email, instant messaging, collaboration platforms), file transfers (including via FTP, SFTP, cloud storage, and removable media), and data room access logs for compliance with TCP restrictions. The Monitor shall describe the sampling methodology employed and the results of the sample review.
4.3 Intra-Company Technology Sharing Protocols
The Monitor shall review the protocols governing information sharing between VPI facilities (Colorado Springs headquarters and Albuquerque fabrication facility) and HSAG entities, including:
(a) Halcyon US Holdings Inc. (Austin, TX — 11501 Alterra Parkway, Suite 300, Austin, TX 78758);
(b) HSAG headquarters (Dresden, Federal Republic of Germany); and
(c) Any other HSAG subsidiaries, affiliates, or related entities that had contact with VPI during the reporting period.
The Monitor shall verify that unclassified but controlled technical data — including data subject to ITAR controls, EAR controls, or U.S. Government contract restrictions — was not shared across the HSAG corporate network, including through shared email domains, enterprise resource planning (ERP) systems, shared cloud infrastructure, or inter-company collaboration tools.
The Monitor shall also assess any research and development ("R&D") collaboration activities between VPI and HSAG during the reporting period. Where R&D collaboration has occurred, the Monitor shall evaluate whether such collaboration complied with TCP restrictions, including:
(a) Whether the scope of the collaboration was limited to uncontrolled commercial technology;
(b) Whether appropriate technology screening was conducted before the initiation of the collaboration to identify and exclude any controlled information;
(c) Whether TCP-compliant information barriers were in place during the collaboration; and
(d) Whether any technology resulting from the collaboration is subject to U.S. Government rights or restrictions.
4.4 Trade Secret Protections
The Monitor shall review VPI's trade secret management program to verify that VPI's proprietary trade secrets are adequately protected and have not been improperly disclosed to HSAG or third parties during the reporting period. As of the acquisition closing date, VPI maintained thirty-one (31) registered internal trade secrets, consisting primarily of proprietary Gallium Nitride (GaN) epitaxial growth recipes and die-level reliability screening processes. These trade secrets represent core competitive advantages and defense-relevant technical capabilities.
The Monitor shall verify the following:
(a) That VPI maintains a current register of all trade secrets and that the register has been updated to reflect any additions, modifications, or retirements during the reporting period;
(b) That all trade secrets are subject to TCP protections, including access controls, marking requirements, and handling procedures;
(c) That no trade secrets have been disclosed to HSAG personnel, including HSAG Designees, without prior authorization from the GSC and, where applicable, the relevant U.S. Government authority;
(d) That non-disclosure agreements with adequate protections are in place for all VPI employees with access to trade secrets; and
(e) That VPI has implemented reasonable measures to prevent the inadvertent disclosure of trade secrets through electronic communications, data transfers, or other channels.
4.5 Findings and Observations — TCP
Compliance Status: _______
[Compliant / Compliant with Observations / Non-Compliant — Minor / Non-Compliant — Material]
Narrative Description of Findings or Observations:
________________________________________
________________________________________
________________________________________
________________________________________
________________________________________
________________________________________
Recommended Corrective Actions (if applicable):
________________________________________
________________________________________
________________________________________
SECTION 5
CYBERSECURITY COMPLIANCE
5.1 NIST SP 800-171 Compliance Status
This section assesses VPI's compliance with the cybersecurity requirements set forth in Annex D to the NSA. Annex D requires VPI to maintain cybersecurity controls consistent with the NIST SP 800-171 framework (Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations), as well as additional cybersecurity measures specific to the national security concerns underlying the NSA.
The Monitor shall verify the following:
(a) NIST SP 800-171 Compliance. Confirmation that VPI maintains compliance with all fourteen (14) families of security requirements set forth in NIST SP 800-171, including: Access Control; Awareness and Training; Audit and Accountability; Configuration Management; Identification and Authentication; Incident Response; Maintenance; Media Protection; Personnel Security; Physical Protection; Risk Assessment; Security Assessment; System and Communications Protection; and System and Information Integrity.
(b) System Security Plan (SSP). Summary of any updates to VPI's System Security Plan during the reporting period, including the date of the most recent revision, the scope of changes, and the reason for the updates. The Monitor shall confirm that the SSP accurately reflects VPI's current system architecture, security controls, and operating environment.
(c) Plan of Action & Milestones (POA&M). Status of any POA&M items outstanding at the beginning of the reporting period, any new POA&M items identified during the reporting period, and the status of remediation efforts. The Monitor shall report:
•  POA&M items open at the start of the reporting period: __
•  POA&M items added during the reporting period: __
•  POA&M items closed during the reporting period: __
•  POA&M items open at the end of the reporting period: __
•  Average age of open POA&M items (in days): __
5.2 Annual Third-Party Penetration Testing
Annex D requires VPI to conduct annual third-party penetration testing of its IT systems and network infrastructure. The Monitor shall verify that such testing was conducted during the reporting period and shall report the following:
(a) Confirmation of Testing. Confirmation that annual third-party penetration testing was conducted during the reporting period, as required by Annex D.
(b) Penetration Testing Firm. Identification of the penetration testing firm engaged to conduct the testing:
•  Firm Name: _______
•  Date(s) of Testing: _______
•  Scope of Testing (internal, external, web applications, wireless, social engineering, etc.): _______
(c) Results Summary. Summary of penetration testing results, categorized by severity:
(d) Remediation Status. Status of remediation for all identified vulnerabilities, particularly those rated Critical or High:
5.3 IT System Segregation
The Monitor shall verify that VPI's IT systems remain physically and logically separated from the HSAG global network, as required by the NSA and Annex D. This requirement is fundamental to the mitigation framework and is intended to prevent unauthorized electronic access by HSAG to VPI's Controlled Technical Data, Classified Information, and other protected information.
The Monitor shall assess the following:
(a) Physical Separation. Verification that VPI's IT infrastructure — including servers, storage devices, network switches, routers, firewalls, and other network equipment — is maintained in dedicated, physically separated facilities that are not shared with any HSAG entity.
(b) Logical Separation. Verification that VPI's network domains, Active Directory forests, email systems, cloud environments, and collaboration platforms are logically separated from the HSAG global network and do not share trust relationships, authentication services, or administrative access with any HSAG network or system.
(c) No Shared Cloud Infrastructure. Confirmation that no shared cloud infrastructure — including Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS) — exists between VPI and any HSAG entity. The Monitor shall identify all cloud service providers used by VPI and confirm that VPI's cloud accounts, tenancies, and subscriptions are entirely separate from those of HSAG.
(d) Network Architecture Review. Review of VPI's network architecture diagrams and firewall configurations, including verification that no network connections, VPN tunnels, or other electronic pathways exist between VPI and HSAG networks, except as specifically authorized by the NSA and approved by the Monitoring Agencies.
(e) Exceptions and Requested Interconnections. Assessment of any exceptions to the IT segregation requirement that were requested, granted, or denied during the reporting period. For each exception:
5.4 Cybersecurity Incident Reporting
The Monitor shall review all cybersecurity incidents that occurred during the reporting period and assess compliance with the incident reporting requirements set forth in the NSA and Annex D. Under Annex D, VPI is required to report any cybersecurity incident affecting VPI systems to DCSA within seventy-two (72) hours of detection.
The Monitor shall complete the following table:
If no reportable cybersecurity incidents occurred during the reporting period, the Monitor shall include the following statement:
"The Monitor confirms that zero reportable cybersecurity incidents occurred at VPI during the reporting period from ____________ to ____________."
Regardless of whether any incidents occurred, the Monitor shall verify that VPI's cybersecurity incident reporting procedures are:
(a) Documented in VPI's Incident Response Plan and consistent with the requirements of Annex D;
(b) Tested during the reporting period through tabletop exercises or simulated incident response drills; and
(c) Capable of meeting the 72-hour DCSA reporting requirement, including during non-business hours, weekends, and federal holidays.
5.5 Findings and Observations — Cybersecurity
Compliance Status: _______
[Compliant / Compliant with Observations / Non-Compliant — Minor / Non-Compliant — Material]
Narrative Description of Findings or Observations:
________________________________________
________________________________________
________________________________________
________________________________________
________________________________________
________________________________________
Recommended Corrective Actions (if applicable):
________________________________________
________________________________________
________________________________________
SECTION 6
FACILITY ACCESS COMPLIANCE
6.1 Classified Facility Access Controls
This section assesses compliance with the facility access requirements set forth in Annex F — Facility Access Procedures. Annex F establishes strict controls on access to VPI's classified facilities, with particular emphasis on preventing unauthorized access by HSAG personnel, non-U.S. persons, and non-cleared individuals.
The Monitor shall verify that HSAG personnel have not accessed VPI classified facilities — specifically, the Albuquerque fabrication facility classified clean room sections C-7 through C-12 — during the reporting period without the prior written approval of both DCSA and the Government Security Committee (GSC). The classified sections of the Albuquerque facility house VPI's defense-oriented GaN device fabrication lines and contain Classified Information, ITAR-controlled technical data, and equipment subject to export controls.
The Monitor shall review the visitor logs for the Albuquerque fabrication facility (9200 Innovation Boulevard, Albuquerque, NM 87113) for the entire reporting period. The Monitor shall complete the following table for all visits by non-VPI personnel to classified areas of the Albuquerque facility:
The Monitor shall verify that all visits to classified areas were conducted in compliance with the following requirements:
(a) Prior written DCSA approval was obtained for each visit;
(b) Prior written GSC approval was obtained for each visit;
(c) Each visitor possessed a valid personnel security clearance at the appropriate level;
(d) Each visitor was escorted at all times by a cleared VPI employee designated by the FSO;
(e) No recording devices, cameras, personal electronic devices, or other prohibited items were brought into classified areas; and
(f) A visitor log entry was completed and signed by both the visitor and the escort for each visit.
6.2 Unclassified Facility Access
The Monitor shall also review visits by HSAG personnel to unclassified areas of VPI facilities, including the Colorado Springs headquarters and the unclassified portions of the Albuquerque fabrication facility (areas outside classified clean room sections C-7 through C-12). While access by HSAG personnel to unclassified areas is generally permitted under the NSA, such visits are subject to the advance notice and escort requirements set forth in Annex F.
The Monitor shall verify the following:
(a) That HSAG provided advance written notice to VPI's Facility Security Officer at least five (5) business days before each visit, as required by Annex F, Section 3.2;
(b) That each HSAG visitor was escorted by a designated VPI employee during the visit;
(c) That HSAG visitors did not enter or attempt to enter any classified or restricted areas during the visit;
(d) That prohibited items controls were enforced, including the prohibition on personal electronic devices in areas adjacent to classified zones; and
(e) That a complete record of each visit was maintained in VPI's visitor management system.
6.3 Facility Security Clearance (FCL) Status
The Monitor shall verify the status of VPI's Facility Security Clearance ("FCL") during the reporting period. As of the acquisition closing date, VPI held an FCL at the SECRET level, issued by DCSA under CAGE Code 7VK92. The NSA functions as a Special Security Agreement (SSA) equivalent for purposes of mitigating foreign ownership, control, or influence (FOCI) concerns associated with the HSAG acquisition.
The Monitor shall confirm the following:
(a) That VPI's FCL at the SECRET level remains active and in good standing as of the end of the reporting period;
(b) That VPI's CAGE Code (7VK92) remains current and accurately reflects VPI's ownership structure;
(c) The identity and continued service of VPI's Facility Security Officer. The initial FSO designated under the NSA was Col. (Ret.) Bryce Hendrickson, VP of Government Programs. The current FSO is: _______
(d) A summary of any DCSA inspections, security reviews, or vulnerability assessments of VPI's FCL conducted during the reporting period, including the dates of such inspections and their outcomes:
(e) Confirmation that the NSA continues to function as an SSA-equivalent for FOCI mitigation purposes and that DCSA has not revoked, suspended, or otherwise modified VPI's FCL during the reporting period.
6.4 Findings and Observations — Facility Access
Compliance Status: _______
[Compliant / Compliant with Observations / Non-Compliant — Minor / Non-Compliant — Material]
Narrative Description of Findings or Observations:
________________________________________
________________________________________
________________________________________
________________________________________
________________________________________
________________________________________
Recommended Corrective Actions (if applicable):
________________________________________
________________________________________
________________________________________
SECTION 7
DATA SEGREGATION COMPLIANCE
7.1 Physical Segregation
The Monitor shall verify that VPI's physical IT infrastructure is maintained separately from HSAG systems. The NSA and Annex D require that VPI's servers, storage systems, network equipment, and other physical IT assets be housed in dedicated facilities that are not shared with, co-located with, or accessible to any HSAG entity.
The Monitor shall assess the following:
(a) Data Center Locations. Identification and verification of all data center locations housing VPI IT infrastructure. The Monitor shall confirm that no VPI data center is located within an HSAG-owned or HSAG-leased facility, and that no HSAG IT equipment is co-located in a VPI data center.
(b) Physical Access Controls. Review of physical access controls to VPI data centers and server rooms, including badge access systems, biometric controls, visitor logs, and surveillance systems. The Monitor shall verify that HSAG personnel do not have access credentials to VPI data centers.
(c) Data Residency. Confirmation that no VPI data resides on HSAG-controlled hardware, including servers, storage area networks (SANs), network-attached storage (NAS), or backup media. The Monitor shall verify that VPI's backup and disaster recovery systems are maintained independently from HSAG systems.
7.2 Logical Segregation
The Monitor shall verify that VPI's network domains, email systems, cloud environments, and collaboration platforms are logically separated from the HSAG global network. Logical segregation is essential to preventing electronic pathways through which Controlled Technical Data or Classified Information could be accessed by HSAG personnel.
The Monitor shall assess the following:
(a) Active Directory and Identity Management. Review of VPI's Active Directory (AD) forest and domain structure to confirm that VPI operates an independent AD forest with no trust relationships, forest trusts, or domain trusts with any HSAG AD forest or domain. The Monitor shall verify that VPI's identity management systems (including single sign-on, multi-factor authentication, and privileged access management) are not integrated with or dependent upon HSAG identity management infrastructure.
(b) DNS Infrastructure. Confirmation that VPI operates independent DNS servers and that VPI's DNS zone is not hosted on, forwarded to, or managed by HSAG DNS infrastructure.
(c) Email Systems. Verification that VPI operates an independent email system (including mail servers, email security gateways, and email archiving systems) that is not federated with, connected to, or routing through HSAG email infrastructure.
(d) Cloud Environments. Confirmation that VPI's cloud environments (IaaS, PaaS, and SaaS) are maintained in separate cloud accounts, subscriptions, and tenancies from those of HSAG. The Monitor shall identify all cloud service providers used by VPI and confirm the separation of each environment.
(e) Collaboration Platforms. Verification that VPI does not use HSAG-managed collaboration platforms (e.g., shared Northgate Data Systems tenants, shared Aldermere Systems sites, shared confluence or Jira instances) for any purpose. Where VPI uses collaboration platforms, the Monitor shall confirm that such platforms are independently managed and provisioned.
(f) Cross-Domain Access. Comprehensive review for any instances of cross-domain access between VPI and HSAG systems, including shared service accounts, cross-domain authentication, shared administrative tools, or remote access pathways.
7.3 Data Transfer Controls
The Monitor shall review all approved data transfers between VPI and HSAG systems during the reporting period. Where such transfers have occurred, the Monitor shall verify that:
(a) Each transfer was conducted in accordance with the TCP and the data transfer procedures approved by the GSC;
(b) The transferred data did not include Classified Information, ITAR-controlled technical data, or EAR-controlled technical data, absent prior U.S. Government authorization;
(c) The transferred data was reviewed and approved by VPI's export compliance officer or designated TCP officer prior to transfer;
(d) The transfer was logged and a record was maintained, including the date, time, sender, recipient, description of data, and method of transfer; and
(e) The transfer was conducted using approved methods (e.g., encrypted file transfer, secure data room) and not through unapproved channels (e.g., personal email, unencrypted removable media, consumer file-sharing services).
The Monitor shall also review the configuration and effectiveness of VPI's data loss prevention (DLP) tools, including:
(a) Confirmation that DLP tools are deployed on VPI endpoints, network gateways, and email systems;
(b) Review of DLP policies and rules to ensure they are configured to detect and prevent the unauthorized transfer of Controlled Technical Data and other protected information;
(c) Review of DLP alerts generated during the reporting period, including the number of alerts, the disposition of each alert, and any confirmed policy violations; and
(d) Assessment of whether DLP tool coverage is adequate given VPI's current operating environment and data flows.
7.4 Findings and Observations — Data Segregation
Compliance Status: _______
[Compliant / Compliant with Observations / Non-Compliant — Minor / Non-Compliant — Material]
Narrative Description of Findings or Observations:
________________________________________
________________________________________
________________________________________
________________________________________
________________________________________
________________________________________
Recommended Corrective Actions (if applicable):
________________________________________
________________________________________
________________________________________
SECTION 8
PERSONNEL CONTINUITY COMPLIANCE
8.1 Key Personnel Retention Status
The NSA requires that certain key VPI personnel remain employed by VPI for a minimum of twenty-four (24) months following the acquisition closing date (February 9, 2024). This retention requirement is designed to ensure continuity of leadership, preservation of institutional knowledge, and maintenance of critical government relationships during the post-acquisition transition period. The 24-month retention period expires on February 9, 2026.
The Monitor shall verify the continued employment of the following key personnel and shall complete the table below:
If any key personnel departure occurred during the reporting period, the Monitor shall verify the following:
(a) That the departing individual's replacement was identified and proposed to the GSC and DCSA in advance of the departure, where practicable;
(b) That the replacement was approved by the GSC and, where required, by DCSA;
(c) That the replacement satisfies all applicable requirements under the NSA, including citizenship, clearance eligibility, and qualifications;
(d) That adequate transition arrangements were implemented to minimize disruption to classified programs and government contract performance; and
(e) The circumstances of the departure (voluntary resignation, termination for cause, retirement, disability, or other) and whether any concerns regarding the departure were raised by the GSC, DCSA, or contracting officers.
8.2 Cleared Pers