ANNEX F TO NATIONAL SECURITY AGREEMENT
FACILITY ACCESS PROCEDURES
NSA Reference: NSA-2024-0019 CFIUS Case No.: CFIUS-023-07-3841 Effective Date: January 19, 2024
Parties:
This Annex F to the National Security Agreement (this "Annex") is entered into by and among:
(1) Halcyon Semiconductor Aktiengesellschaft, a German corporation organized under the laws of the Federal Republic of Germany, with its registered office in Munich, Germany ("HSAG");
(2) Halcyon US Holdings Inc., a Delaware corporation and wholly owned subsidiary of HSAG ("Halcyon US Holdings");
(3) Marlowe Asset Management Photonics Inc., a Delaware corporation with principal offices in Colorado Springs, Colorado ("VPI"); and
(4) The United States of America, acting through the U.S. Department of the Treasury (as Chair of the Committee on Foreign Investment in the United States), the U.S. Department of Defense, and the U.S. Department of Energy (collectively, the "Government Parties," and each individually a "Government Party").
HSAG, Halcyon US Holdings, VPI, and the Government Parties are referred to herein individually as a "Party" and collectively as the "Parties."
Incorporation and Defined Terms. This Annex F is incorporated into and forms an integral part of the National Security Agreement dated January 19, 2024, entered into among the Parties in connection with CFIUS Case No. CFIUS-023-07-3841 (the "Agreement"). This Annex shall be read and construed together with the Agreement and all other Annexes thereto. Capitalized terms used but not otherwise defined in this Annex shall have the meanings ascribed to such terms in Annex A (Definitions) to the Agreement. In the event of any conflict between the provisions of this Annex and the provisions of the Agreement, the Agreement shall control, except to the extent that this Annex imposes more restrictive requirements, in which case the more restrictive requirements shall govern.
Right-click to update Table of Contents
SECTION 1 — PURPOSE AND SCOPE
1.1 Purpose. The purpose of this Annex F is to establish comprehensive protocols and procedures governing all visits by HSAG Personnel (as defined in Section 14.1 hereof) to any VPI Facility (as defined in Section 14.2 hereof). These procedures are designed to safeguard Classified Information, Controlled Technical Data, VPI trade secrets, and other sensitive materials and information maintained at VPI Facilities, while permitting HSAG to exercise its legitimate rights as the indirect parent company of VPI in a manner consistent with the national security objectives of the Agreement. For purposes of this Annex, "HSAG Personnel" includes all directors, officers, employees, agents, consultants, and contractors of HSAG, Halcyon US Holdings Inc., Halcyon US Inc., and any other non-VPI HSAG subsidiary or affiliate, as further specified in Section 14.1. These procedures are intended to complement and reinforce the access restrictions, information-sharing controls, and governance structures established under the Agreement and its other Annexes.
1.2 Scope of Facilities Covered. These Facility Access Procedures apply to the following two VPI Facilities, which constitute the entirety of VPI's physical operations as of the Effective Date:
(a) VPI Headquarters, located at 7400 Ridgeline Parkway, Colorado Springs, CO 80919 (the "Colorado Springs Facility"). The Colorado Springs Facility houses VPI's administrative offices, unclassified design and engineering laboratories, and corporate support functions. The Colorado Springs Facility does not hold a Facility Security Clearance and does not store, process, or handle Classified Information, although certain areas within the Colorado Springs Facility contain Controlled Technical Data and VPI trade secrets subject to the restrictions set forth in Sections 7 and 9 of this Annex.
(b) VPI Fabrication Facility, located at 9200 Innovation Boulevard, Albuquerque, NM 87113 (the "Albuquerque Facility"). The Albuquerque Facility is a state-of-the-art, approximately 45,000 square foot gallium nitride on silicon carbide (GaN-on-SiC) fabrication facility that supports classified and unclassified programs for the U.S. Department of Defense and other U.S. Government customers. The Albuquerque Facility holds a Facility Security Clearance at the SECRET level, issued by the Defense Counterintelligence and Security Agency ("DCSA"), and is identified by CAGE Code 7VK92. The Albuquerque Facility includes both classified areas (as described in Section 2.1(b)) and designated unclassified areas (as described in Section 2.1(a)).
If VPI establishes, acquires, or begins operations at any additional facility during the term of the Agreement, such facility shall automatically become a "VPI Facility" subject to these Facility Access Procedures upon written notice from the Government Security Committee to the Parties, and the GSC, in consultation with the FSO and DCSA, shall determine the appropriate zone designations for such facility within 30 calendar days of its establishment or acquisition.
1.3 Governing Authority. These Facility Access Procedures are promulgated pursuant to Section 8.4 of the Agreement, which authorizes the Government Security Committee to establish, implement, and enforce facility access controls as necessary to protect national security interests. These procedures shall be administered by the Government Security Committee ("GSC"), as constituted and empowered under Annex C (Governance Provisions & Security Board Charter), in coordination with VPI's Facility Security Officer ("FSO"). The current FSO is Col. (Ret.) Bryce Hendrickson, a U.S. citizen holding an active TS/SCI personnel security clearance. The administration and enforcement of these procedures is subject to the oversight of the Defense Counterintelligence and Security Agency ("DCSA"), which retains authority under the National Industrial Security Program Operating Manual (32 C.F.R. Part 117) and applicable DCSA directives over VPI's Facility Security Clearance and personnel security clearance determinations. Nothing in this Annex shall be construed to limit or restrict the authority of DCSA, or any other agency of the United States Government, to impose additional access restrictions or security requirements on VPI or its facilities.
1.4 Relationship to Other Annexes. These Facility Access Procedures are designed to be read in conjunction with and to complement the following Annexes to the Agreement:
(a) Annex B (Technology Control Plan). Annex B establishes the Technology Control Plan ("TCP") governing the identification, handling, storage, transmission, and access controls applicable to Controlled Technical Data and other sensitive technical information. The access restrictions and information-sharing protocols set forth in the TCP shall apply to all visits by HSAG Personnel to VPI Facilities, and no HSAG Personnel shall access any Controlled Technical Data during a visit except in strict compliance with the TCP. Where this Annex references TCP authorization or TCP-compliant access authorization, such references are to the authorization procedures set forth in Sections 4 through 7 of Annex B.
(b) Annex C (Governance Provisions & Security Board Charter). Annex C establishes the composition, powers, and procedures of the Government Security Committee and the reconstituted VPI Board of Directors. The GSC's authority to approve, deny, condition, or revoke facility access under this Annex is derived from Annex C. All references herein to GSC approval, GSC consent, or GSC determination shall be understood to require action in accordance with the procedures set forth in Annex C, including quorum and voting requirements.
(c) Annex D (Cybersecurity Requirements). Annex D establishes cybersecurity requirements applicable to VPI's information technology systems, including the mandatory physical and logical separation of VPI IT systems from HSAG's global network and the prohibition on shared cloud infrastructure. The restrictions on electronic devices, data storage media, and network connectivity set forth in Section 9 of this Annex are intended to be consistent with and to reinforce the data segregation and cybersecurity requirements of Annex D.
(d) Annex E (Third-Party Monitor). Annex E establishes the role, responsibilities, and authority of the Third-Party Monitor, Whitmore Compliance Group LLC. The Third-Party Monitor's oversight of facility access compliance under this Annex is part of its broader compliance monitoring function under Annex E.
SECTION 2 — FACILITY CLASSIFICATION AND ACCESS ZONES
2.1 Facility Classification Designations. Each area within the VPI Facilities shall be classified into one of the following three access zone categories. These designations determine the level of access restrictions applicable to HSAG Personnel and the approval procedures required for any visit.
(a) Unclassified Areas. The following areas are designated as Unclassified Areas:
(i) All areas of the VPI Headquarters at 7400 Ridgeline Parkway, Colorado Springs, CO 80919, including administrative offices, reception areas, visitor conference rooms, and common areas, provided that certain areas within the Colorado Springs Facility may also be designated as Restricted Technology Areas under Section 2.1(c) below.
(ii) The following designated unclassified areas of the VPI Fabrication Facility at 9200 Innovation Boulevard, Albuquerque, NM 87113: the main lobby and reception area, the administrative wing (first floor, Sections A-1 through A-6), the visitor conference rooms (Rooms V-101, V-102, V-103, and V-104), and the employee cafeteria.
Unclassified Areas are those areas where no Classified Information is stored, processed, discussed, or accessible, and where no ITAR-controlled defense articles or EAR-controlled items are present, unless such areas are separately designated as Restricted Technology Areas.
(b) Classified Areas. The following areas are designated as Classified Areas:
(i) Clean room Sections C-7, C-8, C-9, C-10, C-11, and C-12 of the VPI Fabrication Facility at 9200 Innovation Boulevard, Albuquerque, NM 87113.
(ii) Any other areas within the VPI Fabrication Facility where Classified Information is stored, processed, or discussed, as designated by the FSO from time to time in consultation with DCSA.
(iii) Any area where ITAR-controlled defense articles classified under Category XI(a)(3) of the United States Munitions List (22 C.F.R. § 121.1) are stored, processed, manufactured, or tested, to the extent such articles are classified.
(iv) Any area where EAR-controlled items classified under ECCN 3A001, 3A991, or 3E001 are stored, processed, or handled in connection with a classified program or contract.
Classified Areas are subject to the most stringent access restrictions under this Annex. Access by HSAG Personnel to Classified Areas is presumptively prohibited and may be authorized only in accordance with the extraordinary procedures set forth in Section 6.
(c) Restricted Technology Areas. The following areas are designated as Restricted Technology Areas:
(i) Any area within either VPI Facility where Controlled Technical Data (as defined in Annex A) is accessible, whether or not such data is classified, including research and development laboratories, engineering workstations, testing and characterization facilities, and document storage rooms containing technical documentation.
(ii) R&D laboratories at the Colorado Springs Facility housing trade secret information related to VPI's thirty-one (31) registered internal trade secrets, including but not limited to GaN epitaxial growth recipes, die-level reliability screening processes, thermal management specifications, and related proprietary process documentation.
(iii) Any area within the Albuquerque Facility that is not designated as a Classified Area but that contains ITAR-controlled defense articles (Category XI(a)(3)) or EAR-controlled items (ECCN 3A001, 3A991, 3E001) in an unclassified context.
Restricted Technology Areas require heightened access controls as set forth in Section 7 of this Annex, even though they may not hold Classified Information. The designation of an area as a Restricted Technology Area is not mutually exclusive with its designation as a Classified Area; an area may be both a Classified Area and a Restricted Technology Area.
2.2 Zone Demarcation. VPI shall establish and maintain clear physical demarcation of all access zones within each VPI Facility. Such demarcation shall include, at a minimum:
(a) Visible signage at each transition point between access zones, identifying the zone classification and applicable access restrictions. Signage shall conform to DCSA and National Industrial Security Program requirements for classified facility markings.
(b) Access-control points at the boundary of each Classified Area and each Restricted Technology Area, including badge readers, cipher locks, mantraps (for Classified Areas), and, where appropriate, biometric access controls.
(c) Color-coded zone indicators, as follows: green indicators for Unclassified Areas; amber indicators for Restricted Technology Areas; and red indicators for Classified Areas. Color-coded striping shall be applied to corridor floors and doorframes at zone boundaries.
(d) Comprehensive floor plans reflecting all zone demarcations, identifying each area by its zone classification, room number, and function. Floor plans shall be prepared and maintained by the FSO, and shall be updated within thirty (30) calendar days of any change in zone boundaries, room assignments, or facility layout.
Current floor plans shall be provided to DCSA and the Third-Party Monitor (Whitmore Compliance Group LLC) upon request. Floor plans reflecting Classified Area boundaries shall be marked and handled at the appropriate classification level.
2.3 Periodic Zone Review. The Government Security Committee shall conduct a formal review and confirmation of all zone designations within each VPI Facility at least once per calendar year. In addition, the GSC shall conduct an expedited zone review within ten (10) business days of any of the following events:
(a) Any change to VPI's classified programs, including the award, modification, or termination of any classified contract or subcontract.
(b) Any change to VPI's government contracts or subcontracts involving ITAR-controlled defense articles or EAR-controlled items.
(c) Any change to VPI's export-controlled activities, including the issuance, amendment, or revocation of any export license, agreement, or authorization under the ITAR or EAR.
(d) Any physical modification to a VPI Facility that affects room assignments, access-control points, or the location of classified or controlled materials.
(e) Any directive or guidance from DCSA or another U.S. Government agency requiring a change in facility security posture.
The results of each zone review shall be documented in writing by the GSC and provided to the FSO, DCSA, and the Third-Party Monitor within five (5) business days of completion. Any changes to zone designations resulting from a zone review shall be implemented by the FSO within thirty (30) calendar days, or such shorter period as directed by the GSC.
SECTION 3 — ACCESS CATEGORIES FOR HSAG PERSONNEL
All HSAG Personnel seeking access to any VPI Facility shall be classified into one of the following four access categories. The applicable access category determines the scope of areas that may be visited, the approval procedures required, and the specific restrictions that apply. The FSO, in consultation with the GSC, shall determine the appropriate access category for each individual visitor based on the information provided in the visit notice under Section 5.2 or Section 6.3, as applicable.
3.1 Category 1: HSAG Board Designees. Category 1 comprises the two (2) HSAG-designated members of the reconstituted VPI Board of Directors, as appointed in accordance with Annex C (Governance Provisions & Security Board Charter). As of the Effective Date, the Category 1 individuals are those persons designated by HSAG to serve as directors of VPI pursuant to Section 3.2(a) of Annex C.
(a) Permitted Access. Category 1 personnel may access Unclassified Areas of both VPI Facilities, subject to the visit procedures set forth in Section 5 of this Annex.
(b) Prohibited Access. Category 1 personnel may NOT access Classified Areas or Restricted Technology Areas under any circumstances without express prior written approval from both the GSC (acting unanimously) and DCSA, obtained in accordance with the procedures set forth in Section 6 of this Annex (for Classified Areas) or Section 7 of this Annex (for Restricted Technology Areas).
(c) Classified Information. Category 1 personnel may not hold, access, receive, or discuss Classified Information at any classification level. No provision of this Annex or the Agreement shall be construed to authorize or require the granting of a personnel security clearance to any Category 1 individual.
(d) Board Meetings. Attendance by Category 1 personnel at VPI Board of Directors meetings held at a VPI Facility shall be subject to the visit procedures in Section 5, and all such meetings shall be held in designated visitor conference rooms within Unclassified Areas. Any agenda items involving Classified Information or Controlled Technical Data shall be addressed in executive session from which Category 1 personnel are excluded, consistent with Annex C.
3.2 Category 2: HSAG Senior Management. Category 2 comprises senior management personnel of HSAG and its affiliates (other than VPI), including but not limited to the following individuals:
• Dr. Maximilian Ehrhardt, Chief Executive Officer (Vorstandsvorsitzender) of HSAG
• Katarina Brückner, Chief Financial Officer (Finanzvorstand) of HSAG
• Stefan Lohse, General Counsel (Chefjustitiar) of HSAG
• Other members of the HSAG Vorstand (Management Board), as constituted from time to time
• Direct reports of any member of the HSAG Vorstand, to the extent such individuals seek access to a VPI Facility
(a) Permitted Access. Category 2 personnel are subject to the same access restrictions as Category 1 personnel. Visits by Category 2 personnel are limited to Unclassified Areas of VPI Facilities, for legitimate business oversight purposes including, without limitation, financial reporting reviews, corporate governance consultations, integration planning for unclassified business lines, and meetings with VPI management on matters not involving Classified Information or Controlled Technical Data.
(b) Prohibited Access. Category 2 personnel may NOT access Classified Areas or Restricted Technology Areas under any circumstances without express prior written approval from both the GSC (acting unanimously) and DCSA, obtained in accordance with Sections 6 and 7 of this Annex, as applicable.
(c) Classified Information. Category 2 personnel may not hold, access, receive, or discuss Classified Information at any classification level.
3.3 Category 3: HSAG Technical Personnel. Category 3 comprises all engineers, scientists, and technical staff employed by or engaged by HSAG, Halcyon US Inc. (with principal offices in Austin, Texas; Employer Identification Number 81-3056429), or any other HSAG affiliate (other than VPI), who seek access to a VPI Facility in a technical capacity.
(a) Permitted Access. Category 3 personnel may access Unclassified Areas of VPI Facilities only, subject to the visit procedures set forth in Section 5 of this Annex.
(b) Prohibited Access. Category 3 personnel are strictly prohibited from accessing Restricted Technology Areas or any area containing Controlled Technical Data without prior TCP authorization obtained in accordance with Annex B (Technology Control Plan). Category 3 personnel are prohibited from accessing Classified Areas under all circumstances, subject only to the extraordinary access procedures in Section 6.
(c) Technical Discussions. All technical discussions between Category 3 personnel and VPI employees during a visit must be pre-approved by the GSC. The visit notice submitted under Section 5.2 shall include a detailed, written agenda identifying all topics to be discussed. No discussion of any topic not appearing on the pre-approved agenda shall be permitted. The assigned VPI escort shall monitor all discussions and shall intervene to terminate any discussion that deviates from the approved agenda or that approaches the boundary of Classified Information, Controlled Technical Data, or VPI trade secrets not authorized for disclosure.
(d) Deemed Export Considerations. To the extent that any Category 3 personnel are not U.S. Persons, the additional restrictions set forth in Section 3.5 shall apply.
3.4 Category 4: HSAG Contractors and Agents. Category 4 comprises all external consultants, independent auditors, legal counsel, financial advisors, and other third parties acting on behalf of or at the direction of HSAG or any HSAG affiliate (other than VPI) who seek access to a VPI Facility. Without limitation, Category 4 includes personnel of the following entities to the extent they seek access to VPI Facilities in connection with HSAG's ownership of VPI:
• Leinberger & Hess Wirtschaftsprüfungsgesellschaft (independent auditors to HSAG)
• Calderwood & Harkness LLP (U.S. outside counsel to HSAG)
• Schilling Frey Rechtsanwälte (German outside counsel to HSAG)
• Ashgrove Capital Group (financial advisors to HSAG)
• Any other third-party professional advisor, consultant, or contractor engaged by HSAG or its affiliates
(a) Permitted Access. Category 4 personnel are subject to the same access restrictions as Category 3 personnel. Access is limited to Unclassified Areas of VPI Facilities, subject to the visit procedures in Section 5.
(b) Prohibited Access. Category 4 personnel are prohibited from accessing Restricted Technology Areas or Classified Areas, subject only to the procedures in Sections 6 and 7.
(c) Additional Identification Requirements. In addition to the identification requirements set forth in Section 5.3, Category 4 personnel must provide documentation establishing their affiliation with and authorization by the HSAG entity on whose behalf they are visiting, including a letter of engagement or authorization on the letterhead of such entity, identifying the individual by name and specifying the scope of the engagement. Such documentation shall be provided to the FSO as part of the visit notice under Section 5.2.
(d) Confidentiality Obligations. Category 4 personnel must have executed a confidentiality and non-disclosure agreement in form and substance satisfactory to the GSC prior to visiting any VPI Facility, and a copy of such agreement must be provided to the FSO as part of the visit notice.
3.5 Non-U.S. Person Restrictions. Any HSAG Personnel in any access category who is not a U.S. Person, as defined under the International Traffic in Arms Regulations ("ITAR") at 22 C.F.R. § 120.62 and the Export Administration Regulations ("EAR") at 15 C.F.R. § 772.1, is subject to the following additional restrictions:
(a) Such individual is prohibited from accessing any ITAR-controlled defense article, ITAR-controlled technical data, or ITAR-controlled defense service, in any form, at any VPI Facility, without a valid export authorization (license, agreement, or exemption) issued by the U.S. Department of State, Directorate of Defense Trade Controls ("DDTC"), consistent with VPI's DDTC Registration (Registration Number M-24817) and the Technology Control Plan (Annex B).
(b) Such individual is prohibited from accessing any EAR-controlled technical data or technology that would constitute a "deemed export" under 15 C.F.R. § 734.13 without a valid export license or applicable license exception issued by the U.S. Department of Commerce, Bureau of Industry and Security ("BIS").
(c) The FSO shall verify the U.S. Person status of each proposed visitor as part of the visit approval process. Any individual whose U.S. Person status cannot be confirmed shall be treated as a non-U.S. Person for purposes of these procedures.
(d) All visits by non-U.S. Person HSAG Personnel shall be subject to heightened escort protocols, including a one-to-one escort ratio (one VPI escort per non-U.S. Person visitor) and continuous visual monitoring by the escort.
SECTION 4 — GENERAL PRINCIPLES GOVERNING ALL VISITS
The following general principles apply to all visits by HSAG Personnel to any VPI Facility, regardless of the access category of the visitor or the classification of the area being visited. These principles are mandatory and shall be applied in addition to, and not in limitation of, the specific procedural requirements set forth in Sections 5, 6, and 7.
4.1 Legitimate Business Purpose Requirement. All visits by HSAG Personnel to any VPI Facility must serve a documented, legitimate business purpose related to HSAG's ownership interest in VPI. The stated business purpose must be identified in writing in the visit notice submitted under Section 5.2 or Section 6.3, as applicable, and must be approved by the GSC prior to the visit. No visit shall be used as a pretext for accessing, observing, photographing, copying, or otherwise obtaining Classified Information, Controlled Technical Data, VPI trade secrets, or restricted technology. The GSC retains sole discretion to determine whether a stated business purpose is legitimate and sufficient to justify a visit.
4.2 Need-to-Know and Minimum Access. Consistent with the principle of minimum necessary access, HSAG Personnel visitors shall be granted access only to those specific areas and categories of information that are directly necessary for the stated and approved purpose of the visit. No visitor shall be permitted to access any area or information beyond the scope identified in the approved visit notice. VPI personnel and escorts shall apply the "need-to-know" standard in real time during visits and shall refuse to provide access to or share any information that is not within the approved scope, even if requested by the visitor.
4.3 Escort Requirement. All HSAG Personnel must be escorted at all times while present in any VPI Facility. No HSAG Personnel visitor may be present in any area of a VPI Facility without a designated VPI escort approved by the FSO. Escorts shall remain within visual and auditory range of their assigned visitors at all times. The escort requirement applies from the moment the visitor passes through the access-control point at the facility entrance until the moment the visitor exits the facility and surrenders the visitor badge. Escort responsibilities include monitoring visitor movements, monitoring all conversations and discussions, ensuring compliance with access zone restrictions, and reporting any compliance concerns to the FSO. The specific qualifications and ratios for escorts are set forth in Sections 5.5, 6.5, and 7 of this Annex.
4.4 Duration Limitations. The following duration limitations shall apply to all visits by HSAG Personnel:
(a) Individual Visit Duration. No individual visit by any HSAG Personnel visitor shall exceed five (5) consecutive business days in duration, absent prior written approval from the GSC. Requests for extended visits must be submitted to the GSC in writing at least ten (10) business days in advance and must include a detailed justification for the extended duration.
(b) Aggregate Quarterly Limitation. Total HSAG Personnel visits to each VPI Facility shall not exceed thirty (30) person-days per calendar quarter per facility. For purposes of this limitation, a "person-day" means one HSAG Personnel visitor present at a VPI Facility for any portion of one business day. If multiple HSAG Personnel visitors are present on the same day, each visitor counts as one person-day. Visits exceeding the thirty (30) person-day quarterly limit require prior written approval from both the GSC and DCSA.
(c) Tracking. The FSO shall maintain a running tally of person-days consumed in each calendar quarter for each VPI Facility and shall notify the GSC when seventy-five percent (75%) of the quarterly allocation has been utilized.
4.5 Language of Discussions. All discussions between HSAG Personnel and VPI employees during any visit to a VPI Facility shall be conducted in the English language. This requirement is essential to enable effective monitoring by the assigned VPI escort, to facilitate accurate compliance documentation, and to ensure that the escort can identify and intervene in any discussion that approaches the boundary of Classified Information, Controlled Technical Data, or other restricted subject matter. The use of any language other than English during a visit shall be treated as a compliance concern and shall be documented and reported by the escort in accordance with Section 10 of this Annex. This requirement applies to all oral communications, including formal meetings, informal conversations, telephone calls, and video conferences conducted while the visitor is present at a VPI Facility.
SECTION 5 — PROCEDURES FOR VISITS TO UNCLASSIFIED AREAS
5.1 Applicable Facilities. The procedures in this Section 5 apply to visits by HSAG Personnel to the following areas:
(a) VPI Headquarters, 7400 Ridgeline Parkway, Colorado Springs, CO 80919 — all areas designated as Unclassified Areas pursuant to Section 2.1(a)(i). Note that certain areas within the Colorado Springs Facility may be separately designated as Restricted Technology Areas under Section 2.1(c), in which case the more restrictive procedures in Section 7 shall apply to those areas.
(b) VPI Fabrication Facility, 9200 Innovation Boulevard, Albuquerque, NM 87113 — designated Unclassified Areas only, specifically: the main lobby and reception area, the administrative wing (first floor, Sections A-1 through A-6), the visitor conference rooms (Rooms V-101, V-102, V-103, and V-104), and the employee cafeteria. HSAG Personnel visiting the Albuquerque Facility under this Section 5 shall be escorted directly from the lobby to the approved unclassified area and shall not traverse or pass through any Classified Area or Restricted Technology Area at any time.
5.2 Advance Notice Requirements. The following advance notice procedures must be completed prior to any visit by HSAG Personnel to an Unclassified Area of a VPI Facility:
(a) Notice Period. HSAG must provide written notice to the FSO (Col. (Ret.) Bryce Hendrickson) and the GSC no fewer than ten (10) business days prior to the proposed first day of the visit. The notice shall be submitted in writing, by email to the FSO at the secure email address designated by the FSO for this purpose, with a copy to each member of the GSC.
(b) Content of Notice. Each visit notice must include the following information for each proposed visitor:
(i) Full legal name, title or position, employer (including, for Category 4 personnel, the name of the HSAG entity on whose behalf the visit is being conducted), and citizenship (country of citizenship; dual or multiple citizenships must be disclosed);
(ii) Proposed dates and times of the visit, including the anticipated time of arrival and departure for each day;
(iii) A detailed statement of the business purpose of the visit, including the specific matters to be discussed or reviewed and the business justification for the visit;
(iv) Identification of the specific VPI Facility and the specific areas within that facility to be visited;
(v) A comprehensive list of all topics to be discussed during the visit, with sufficient specificity to enable the GSC and FSO to evaluate the risk of inadvertent disclosure of Classified Information, Controlled Technical Data, or VPI trade secrets;
(vi) A complete list of all electronic devices proposed to be brought on-site by each visitor, including make, model, and serial number of each device; and
(vii) For Category 4 personnel, the additional documentation required by Section 3.4(c), including the letter of engagement or authorization and evidence of an executed confidentiality agreement.
(c) GSC Review and Approval. Upon receipt of a complete visit notice, the GSC shall have five (5) business days to review the notice and take one of the following actions:
(i) Approve the visit as proposed;
(ii) Approve with Modifications, including but not limited to modifications to the proposed dates, areas to be visited, topics to be discussed, or the number of visitors permitted; or
(iii) Deny the visit request.
(d) Denial Without Cause. The GSC may deny any visit request without providing a reason. A denial by the GSC is final and is not subject to appeal to the full VPI Board of Directors. The GSC's exercise of its discretion under this Section 5.2(d) shall not give rise to any claim by HSAG, Halcyon US Holdings, or any other person for breach of the Agreement or any other cause of action.
5.3 Visitor Identification and Credentials. Each HSAG Personnel visitor must comply with the following identification and credentialing requirements upon arrival at the VPI Facility:
(a) U.S. Persons. Each visitor who is a U.S. Person shall present a valid, unexpired, government-issued photo identification document, such as a U.S. passport, U.S. passport card, or valid U.S. state-issued driver's license, to VPI security personnel at the facility entrance.
(b) Non-U.S. Persons. Each visitor who is not a U.S. Person shall present a valid, unexpired passport issued by the visitor's country of citizenship, together with a valid U.S. Visa or other evidence of lawful immigration status in the United States. The FSO or designated security personnel shall verify the visitor's identity and immigration status and shall record the passport number, country of issuance, and visa type in the Visitor Log.
(c) Verification. VPI security personnel shall verify the identity of each visitor against the approved visit notice and shall confirm that the visitor is authorized for the visit. Any discrepancy between the visitor's identity documents and the information provided in the visit notice shall result in denial of entry pending resolution.
5.4 Visitor Acknowledgment Form. Prior to entering any area of a VPI Facility beyond the main lobby, each HSAG Personnel visitor must read and sign the Visitor Acknowledgment Form attached hereto as Attachment F-1. By signing the Visitor Acknowledgment Form, the visitor acknowledges and agrees to comply with all access restrictions, prohibited items requirements, and confidentiality obligations set forth in this Annex. A signed original of the Visitor Acknowledgment Form shall be retained by the FSO and maintained in the visitor's file. No visitor who refuses to sign the Visitor Acknowledgment Form shall be permitted to enter the facility beyond the main lobby.
5.5 Visitor Badges. All HSAG Personnel visitors shall be issued a distinctively marked temporary visitor badge upon arrival. Visitor badges shall have a red border and shall display the word "VISITOR" prominently on both the front and back. The badge shall include the visitor's name, the date, and the visitor badge number. Visitor badges must be worn visibly on the outer garment at all times while the visitor is present in any area of the VPI Facility. Badges must be surrendered to VPI security personnel upon departure from the facility and may not be retained by the visitor under any circumstances. The FSO shall maintain a log of all visitor badges issued and returned, and shall investigate and report any unreturned badge as a security incident in accordance with Section 10.
5.6 Escort Protocol. The following escort protocols apply to all visits by HSAG Personnel to Unclassified Areas:
(a) Designation. A VPI-designated escort shall accompany each visitor or group of visitors at all times while the visitor is present in any area of the VPI Facility beyond the main lobby. Escorts shall be selected by the FSO from among VPI employees who hold at least a SECRET personnel security clearance. The FSO shall maintain a roster of approved escorts and shall ensure that sufficient escorts are available for each approved visit.
(b) Escort Ratio. Each escort may accompany a maximum of four (4) HSAG Personnel visitors simultaneously. If more than four visitors are approved for a visit, additional escorts must be assigned to maintain the four-to-one ratio or better.
(c) Escort Responsibilities. The assigned escort is responsible for:
(i) Meeting the visitor(s) at the facility entrance and accompanying them to the approved meeting space;
(ii) Remaining within visual and auditory range of the visitor(s) at all times;
(iii) Ensuring that the visitor(s) do not deviate from the approved route between the facility entrance and the approved meeting space;
(iv) Ensuring that the visitor(s) do not enter any area outside the scope of the approved visit, including Classified Areas, Restricted Technology Areas, or any Unclassified Area not specified in the approved visit notice;
(v) Monitoring all conversations and discussions to ensure they remain within the scope of the pre-approved agenda and do not approach Classified Information, Controlled Technical Data, or VPI trade secrets not authorized for discussion;
(vi) Intervening immediately if the visitor(s) attempt to access any prohibited area, device, or information, or if any discussion deviates from the approved agenda;
(vii) Ensuring that the visitor(s) comply with all prohibited items restrictions set forth in Section 9; and
(viii) Accompanying the visitor(s) to the facility exit at the conclusion of the visit and confirming surrender of the visitor badge.
(d) Escort Reporting. The assigned escort shall document any compliance concerns, anomalies, or incidents observed during the visit in writing and shall deliver such documentation to the FSO within twenty-four (24) hours of the conclusion of the visit. If no concerns are noted, the escort shall submit a brief written confirmation of an uneventful visit.
5.7 Approved Meeting Spaces. All meetings between HSAG Personnel and VPI employees during visits to Unclassified Areas shall take place only in pre-designated visitor conference rooms that have been reviewed and certified by the FSO as free of Classified Information, Controlled Technical Data, and restricted technology materials. Prior to each visit, the FSO or a designee shall conduct an inspection of the designated meeting space to confirm that no classified or controlled materials are present and that no classified or controlled information is displayed on whiteboards, monitors, or other surfaces. The certification of the meeting space shall be documented in writing. During the visit, the doors of the visitor conference room shall remain closed, and no VPI employee with access to classified programs shall enter the room unless specifically designated as a meeting participant or escort on the approved visit notice.
SECTION 6 — PROCEDURES FOR VISITS TO CLASSIFIED AREAS
6.1 Applicable Areas. The procedures in this Section 6 apply to all requests for access by HSAG Personnel to any Classified Area within any VPI Facility, specifically including, without limitation:
(a) Clean room Sections C-7, C-8, C-9, C-10, C-11, and C-12 of the VPI Fabrication Facility at 9200 Innovation Boulevard, Albuquerque, NM 87113;
(b) Any other area within the VPI Fabrication Facility that is designated as a Classified Area under VPI's Facility Security Clearance at the SECRET level (CAGE Code 7VK92); and
(c) Any other area at any VPI Facility that is hereafter designated as a Classified Area in accordance with Section 2.3 of this Annex.
6.2 General Prohibition. HSAG Personnel are presumptively prohibited from accessing any Classified Area of any VPI Facility. This prohibition applies to all categories of HSAG Personnel, including Category 1 (HSAG Board Designees), Category 2 (HSAG Senior Management), Category 3 (HSAG Technical Personnel), and Category 4 (HSAG Contractors and Agents). The general prohibition reflects the national security determination underlying the Agreement that access by HSAG Personnel to classified areas presents risks to the national security of the United States that ordinarily cannot be adequately mitigated. Access may be authorized only in extraordinary circumstances, and only upon the strict satisfaction of all conditions set forth in Section 6.3. The burden of demonstrating that extraordinary circumstances exist shall rest entirely upon HSAG.
6.3 Conditions for Access. Access by HSAG Personnel to any Classified Area may be authorized only if all of the following conditions are satisfied:
(a) Written Request. HSAG shall submit a detailed written request to the GSC at least thirty (30) calendar days prior to the proposed date of the visit. The written request shall include, at a minimum: (i) a statement of the extraordinary business justification for the proposed access, with specificity as to why the stated purpose cannot be accomplished through alternative means (including written communications, meetings in unclassified areas, or review of redacted or unclassified summaries); (ii) identification of the specific Classified Areas for which access is requested, by room or section number; (iii) the proposed date(s) and duration of the visit; (iv) the full name, title, employer, citizenship, and personnel security clearance status of each individual for whom access is requested; and (v) a statement of the specific information or activities the visitor expects to encounter or observe in the Classified Area.
(b) Unanimous GSC Approval. All three (3) members of the Government Security Committee must provide their express, written, unanimous approval of the access request. The GSC shall consider the request in light of the national security interests of the United States, the adequacy of the stated justification, the availability of alternative means to accomplish the stated purpose, and any other factors the GSC deems relevant. The Security Board Members constituting the GSC must be U.S. citizens who hold or are eligible for TS/SCI clearances, as required by Annex C.
(c) DCSA Approval. The FSO, upon receiving a favorable recommendation from the GSC, shall submit the access request to DCSA for review and approval. DCSA shall have fifteen (15) business days from receipt of the request to approve or deny the access. If DCSA does not respond within fifteen (15) business days, the request shall be deemed denied.
(d) Personnel Security Clearance. The requesting individual must hold the requisite U.S. Government personnel security clearance at the appropriate level for the Classified Area to be visited. Under no circumstances may any individual who does not hold an active, current personnel security clearance at the required level be permitted to access any Classified Area. For areas holding a Facility Security Clearance at the SECRET level, the individual must hold at minimum a SECRET clearance. No provision of this Annex shall be construed to require or authorize DCSA, VPI, or any other entity to sponsor any HSAG Personnel for a personnel security clearance.
(e) CFIUS Monitoring Agency Notification. The GSC shall provide written notification to each of the CFIUS monitoring agencies — the Department of the Treasury, the Department of Defense, and the Department of Energy — at least ten (10) business days before the proposed date of the visit. The notification shall include the information contained in the written request under paragraph (a) above and the approvals obtained under paragraphs (b) and (c) above. Any monitoring agency may object to the proposed visit, and any such objection shall constitute grounds for denial.
(f) Third-Party Monitor Notification. The Third-Party Monitor, Whitmore Compliance Group LLC (Principal: Gerald Whitmore), shall be notified of the proposed visit at least ten (10) business days in advance and shall be given the opportunity, at the Third-Party Monitor's sole discretion, to observe or participate in the visit, to designate a representative to be present during the visit, or to conduct a pre-visit or post-visit review. The Third-Party Monitor's decision not to observe or participate shall not constitute a waiver of any monitoring or audit right.
6.4 Denial. Either the GSC or DCSA may deny any request for access to Classified Areas without providing a reason or explanation. Any denial by the GSC or DCSA is final and non-appealable. The denial of a request for access to a Classified Area shall not give rise to any claim by HSAG, Halcyon US Holdings, or any other person for breach of the Agreement, diminution of shareholder rights, or any other cause of action. The Parties acknowledge that the presumptive prohibition on access to Classified Areas is a fundamental element of the national security protections established by the Agreement and that the preservation of this prohibition is essential to the Government Parties' willingness to approve the transaction reviewed under CFIUS Case No. CFIUS-023-07-3841.
6.5 Classified Area Escort Requirements. If access to a Classified Area is approved pursuant to this Section 6, the following enhanced escort requirements shall apply:
(a) The visitor must be escorted at all times by the FSO personally or by a VPI employee holding an active TS/SCI personnel security clearance who has been specifically designated by the FSO for this purpose.
(b) A one-to-one escort ratio is required: one escort for each HSAG Personnel visitor in the Classified Area. No exceptions to the one-to-one ratio are permitted.
(c) The escort shall maintain continuous physical proximity to the visitor and shall have the authority to terminate the visit immediately if any compliance concern arises.
(d) The escort shall ensure that the visitor does not access, photograph, copy, record, or remove any Classified Information, and shall take all necessary steps to prevent inadvertent exposure to classified materials not within the approved scope of the visit.
6.6 Post-Visit Reporting. Within forty-eight (48) hours of the conclusion of any approved visit to a Classified Area, the FSO shall prepare and submit a detailed written report to each of the following recipients:
(a) The Government Security Committee; (b) DCSA; (c) The Third-Party Monitor (Whitmore Compliance Group LLC).
The post-visit report shall include, at a minimum:
(i) The date, time of entry, and time of departure for each visitor; (ii) The full identity of each visitor and each escort; (iii) The specific Classified Areas accessed, identified by room and section number; (iv) A summary of all topics discussed during the visit; (v) A description of any incidents, anomalies, compliance concerns, or security-relevant observations; and (vi) The FSO's assessment of whether the visit was conducted in compliance with all applicable requirements of this Annex and the Agreement.
The post-visit report shall be classified at the appropriate level if it contains or references Classified Information.
SECTION 7 — PROCEDURES FOR VISITS TO RESTRICTED TECHNOLOGY AREAS (UNCLASSIFIED BUT CONTROLLED)
7.1 Applicability. The procedures in this Section 7 apply to any request by HSAG Personnel to access a Restricted Technology Area within any VPI Facility. Restricted Technology Areas include areas containing Controlled Technical Data that is not classified but is subject to export controls under the International Traffic in Arms Regulations (ITAR, 22 C.F.R. Parts 120–130) or the Export Administration Regulations (EAR, 15 C.F.R. Parts 730–774), or containing VPI trade secrets. Without limitation, Restricted Technology Areas include research and development laboratories at both VPI Facilities, engineering workstations containing technical design data, testing and characterization facilities, and document storage rooms containing proprietary process documentation. The specific areas designated as Restricted Technology Areas are identified in Section 2.1(c) of this Annex and on the floor plans maintained by the FSO.
7.2 Access by U.S. Person HSAG Personnel. A U.S. Person who is an HSAG Personnel visitor may be permitted access to a Restricted Technology Area only upon satisfaction of all of the following conditions:
(a) Advance Notice. HSAG must submit a written request to the GSC at least ten (10) business days in advance of the proposed visit, specifying the Restricted Technology Area(s) to be visited, the business justification, the identity and qualifications of the proposed visitor(s), and the categories of Controlled Technical Data or trade secret information expected to be encountered.
(b) GSC Approval. The GSC must provide prior written approval of the visit. The GSC may impose conditions on the visit, including limitations on the areas to be accessed, the information to be viewed, and the duration of the visit.
(c) TCP Authorization. A TCP-compliant access authorization must be obtained in accordance with Annex B (Technology Control Plan). The TCP authorization shall specify the categories of Controlled Technical Data that the visitor is authorized to access and shall confirm that such access is consistent with all applicable export control requirements.
(d) Continuous Escort. The visitor must be accompanied at all times by a VPI escort designated by the FSO. The escort must hold at least a SECRET personnel security clearance and must be knowledgeable about the TCP requirements applicable to the Restricted Technology Area being visited.
7.3 Access by Non-U.S. Person HSAG Personnel. Any HSAG Personnel who is not a U.S. Person is presumptively prohibited from accessing any Restricted Technology Area. Access may be authorized only in extraordinary circumstances and only if all of the following conditions are satisfied:
(a) Export Authorization. A valid deemed export license or applicable license exception under the ITAR or EAR has been obtained for the specific technology or technical data to which the visitor will be exposed. The export authorization must be in effect at the time of the visit and must cover the specific visitor by name or under a valid comprehensive authorization. VPI's export compliance office shall review and confirm the validity and scope of the export authorization prior to the visit.
(b) Unanimous GSC Approval. All three (3) members of the Government Security Committee must provide their express, written, unanimous approval of the visit.
(c) DCSA Notification. DCSA must be notified of the proposed visit at least fifteen (15) business days in advance, and DCSA must not have objected to the visit within that period.
(d) TCP Compliance. The Technology Control Plan (Annex B) shall govern all information-sharing protocols during such visits. The FSO shall ensure that the visitor is not exposed to any Controlled Technical Data or technology beyond the scope of the valid export authorization.
(e) Enhanced Escort. A one-to-one escort ratio (one VPI escort per non-U.S. Person visitor) shall apply. The escort must be knowledgeable about export control requirements and authorized to terminate the visit immediately if any potential export control violation is identified.
7.4 Documentation. The FSO shall maintain a separate log of all visits to Restricted Technology Areas, distinct from the general Visitor Log maintained under Section 8. The Restricted Technology Area visit log shall include, for each visit:
(a) The full identity, citizenship, and access category of the visitor; (b) The date and time of entry and departure; (c) The specific Restricted Technology Area(s) accessed; (d) A description of the categories of Controlled Technical Data or trade secret information accessed or potentially accessed during the visit; (e) The TCP authorization reference number relied upon; (f) For non-U.S. Persons, the export authorization reference number and issuing agency; (g) The identity and clearance level of the assigned escort; and (h) Any incidents, concerns, or observations noted by the escort.
The Restricted Technology Area visit log shall be maintained on VPI's segregated IT systems, with hard copies stored in a secured location designated by the FSO, and shall be retained for a minimum of seven (7) years. The log shall be available for review by the GSC, DCSA, the Third-Party Monitor, and the CFIUS monitoring agencies under the same terms as the general Visitor Log (Section 8.4).
SECTION 8 — VISITOR LOG REQUIREMENTS
8.1 Mandatory Visitor Logs. The FSO shall establish and maintain a comprehensive Visitor Log at each VPI Facility, recording all visits by HSAG Personnel in all access categories (Category 1 through Category 4). A separate Visitor Log shall be maintained for each VPI Facility. The Visitor Log is a controlled security document and shall be maintained in accordance with the requirements of this Section 8. No visit by HSAG Personnel shall take place without a corresponding entry in the Visitor Log.
8.2 Log Contents. Each entry in the Visitor Log shall include the following information:
(a) Full legal name of the visitor;
(b) Title or position of the visitor;
(c) Employer of the visitor (including, for Category 4 personnel, the name of the third-party firm and the HSAG entity on whose behalf the visit is conducted);
(d) Citizenship of the visitor (all citizenships held);
(e) Access Category of the visitor (Category 1, 2, 3, or 4, as determined pursuant to Section 3);
(f) Date of the visit;
(g) Time of arrival (check-in time);
(h) Time of departure (check-out time);
(i) Visitor badge number assigned;
(j) VPI Facility visited (Colorado Springs or Albuquerque);
(k) Specific areas and access zones accessed during the visit;
(l) Full name and personnel security clearance level of the assigned VPI escort;
(m) Stated business purpose of the visit, as approved by the GSC;
(n) GSC approval reference number and date of approval;
(o) DCSA approval reference number and date of approval (if applicable, for visits to Classified Areas under Section 6 or Restricted Technology Areas under Section 7);
(p) Notation of any incidents, anomalies, compliance concerns, or deviations from approved visit parameters, as reported by the escort or observed by security personnel.
8.3 Log Format and Retention. Visitor Logs shall be maintained in both electronic and hard-copy format, as follows:
(a) Electronic Format. Electronic Visitor Logs shall be maintained on VPI's segregated IT systems, which are physically and logically separated from HSAG's global network and do not utilize shared cloud infrastructure, in accordance with Annex D (Cybersecurity Requirements). Electronic logs shall be encrypted at rest and in transit and shall be accessible only to authorized VPI personnel designated by the FSO.