NATIONAL SECURITY AGREEMENT — THIRD BUYER'S REDLINE

NATIONAL SECURITY AGREEMENT — THIRD BUYER'S REDLINE
PREPARED BY: CALDERWOOD & HARKNESS LLP 1750 K Street NW, Suite 800, Washington, DC 20006 Margaret "Peggy" Ashworth, Of Counsel; Lt. Col. (Ret.) David Caruso, Senior Counsel; Beatrice Holloway, Partner
SUBMITTED ON BEHALF OF: HALCYON SEMICONDUCTOR AKTIENGESELLSCHAFT Industriestraße 44, 01099 Dresden, Saxony, Germany
CFIUS Case No.: CFIUS-023-07-3841
NSA Docket Reference: NSA-2024-0019
Parties:
1.  Halcyon Semiconductor Aktiengesellschaft ("HSAG")
2.  Halcyon US Holdings Inc.
3.  Marlowe Asset Management Photonics Inc. ("VPI")
4.  The United States of America, acting through the U.S. Department of the Treasury, the U.S. Department of Defense, and the U.S. Department of Energy
Date of CFIUS Draft Circulation: November 3, 2023  
Formatting Convention:
DISTRIBUTION:
•  CFIUS (Department of the Treasury, Office of Investment Security; Department of Defense; Department of Energy)
•  Wethersfield & Gale LLP (Harrison Whitfield), counsel to Marlowe Asset Management Photonics Inc.
CONFIDENTIAL TREATMENT REQUESTED — This document and all attachments hereto are subject to the confidentiality provisions of 50 U.S.C. § 4565(c) and the regulations promulgated thereunder. Any unauthorized disclosure, distribution, or reproduction of this document or any portion thereof is strictly prohibited.
TRANSMITTAL LETTER
Calderwood & Harkness LLP 1750 K Street NW, Suite 800 Washington, DC 20006
VIA HAND DELIVERY AND ELECTRONIC MAIL
U.S. Department of the Treasury Office of Investment Security 1500 Pennsylvania Avenue NW Washington, DC 20220
Attention: Staff Chairperson, Committee on Foreign Investment in the United States
U.S. Department of Defense Office of the Under Secretary of Defense for Acquisition and Sustainment 3010 Defense Pentagon Washington, DC 20301-3010
U.S. Department of Energy Office of intelligence and Counterintelligence 1000 Independence Avenue SW Washington, DC 20585
Dear Staff Chairperson and Agency Representatives:
(1) Board Composition and Security Board Member Qualifications (Section 3); (2) Technology Access and TCP Scope (Sections 2, 5); (3) Monitor Scope and Independence (Sections 8); (4) Cost Allocation (Section 8.3); (5) Personnel Retention Requirements (Section 4); (6) Cybersecurity Standards (Section 7); (7) Penalty Provisions (Section 12); and (8) Term and Sunset Provisions (Section 11).
HSAG identifies the following  
Respectfully submitted,
Margaret "Peggy" Ashworth Of Counsel, National Security & CFIUS Practice
Beatrice Holloway Partner
Calderwood & Harkness LLP 1750 K Street NW, Suite 800 Washington, DC 20006 Tel: (202) 555-3840
cc: Harrison Whitfield, Partner, Wethersfield & Gale LLP, 2000 Pennsylvania Avenue NW, Suite 600, Washington, DC 20006
NATIONAL SECURITY AGREEMENT
CFIUS Case No. CFIUS-023-07-3841 NSA Docket Reference NSA-2024-0019
This NATIONAL SECURITY AGREEMENT (this "Agreement" or "NSA") is entered into as of the date last set forth on the signature pages hereto (the "Effective Date"), by and among:
(1) HALCYON SEMICONDUCTOR AKTIENGESELLSCHAFT, an Aktiengesellschaft organized and existing under the laws of the Federal Republic of Germany, registered with the Amtsgericht Dresden under HRB 28416, having its principal offices at Industriestraße 44, 01099 Dresden, Saxony, Germany, LEI 5299007KXQ2M4GHILZ38, XETRA ticker symbol HLC (hereinafter referred to as the "Acquiror" or "HSAG");
(2) HALCYON US HOLDINGS INC., a corporation organized and existing under the laws of the State of Delaware, with its registered agent at 160 Greentree Drive, Suite 101, Dover, Delaware 19904, EIN 93-2841067 (hereinafter referred to as the "Acquisition Vehicle");
(3) Marlowe Asset Management PHOTONICS INC., a corporation organized and existing under the laws of the State of Delaware, having its principal offices at 7400 Ridgeline Parkway, Colorado Springs, Colorado 80919, EIN 26-4371885 (hereinafter referred to as the "Acquired Business" or "VPI"); and
(4) THE UNITED STATES OF AMERICA, acting through the U.S. Department of the Treasury, the U.S. Department of Defense, and the U.S. Department of Energy (collectively, the "Monitoring Agencies," and each individually, a "Monitoring Agency").
Each of HSAG, the Acquisition Vehicle, VPI, and the United States of America is sometimes referred to herein individually as a "Party" and collectively as the "Parties."
>  
SECTION 1: RECITALS AND PREAMBLE
1.1 Transaction Recitals
WHEREAS, the Acquiror, through the Acquisition Vehicle, has entered into that certain Stock Purchase Agreement, dated as of June 10, 2023 (the "SPA"), with VPI and its stockholders, pursuant to which the Acquisition Vehicle will acquire one hundred percent (100%) of the issued and outstanding equity interests of VPI for an aggregate base purchase price of One Billion Four Hundred Twenty Million Dollars ($1,420,000,000) in cash, together with potential earnout consideration of up to Eighty-Five Million Dollars ($85,000,000) payable upon achievement of CY2024 and CY2025 government-contract revenue milestones, and subject to an escrow holdback of Seventy-One Million Dollars ($71,000,000) (representing 5% of the base purchase price) for indemnification purposes, held by Pinnacle Trust Company, N.A., resulting in maximum aggregate transaction consideration of One Billion Five Hundred Five Million Dollars ($1,505,000,000) (the "Transaction");
WHEREAS, the Acquisition Vehicle was incorporated in the State of Delaware on June 5, 2023, for the sole purpose of effectuating the Transaction and is a wholly owned, direct subsidiary of the Acquiror;
WHEREAS, HSAG and VPI jointly submitted a voluntary notice of the Transaction to the Committee on Foreign Investment in the United States ("CFIUS" or the "Committee") on July 14, 2023, pursuant to Section 721 of the Defense Production Act of 1950, as amended (50 U.S.C. § 4565), and the regulations promulgated thereunder at Title 31, Code of Federal Regulations, Parts 800 and 802 (the "Regulations");
WHEREAS, the Committee accepted the joint voluntary notice and commenced its review of the Transaction on July 21, 2023, in accordance with 50 U.S.C. § 4565(b)(1)(A);
WHEREAS, following the initial forty-five (45) day review period, the Committee initiated a formal investigation of the Transaction on September 4, 2023, in accordance with 50 U.S.C. § 4565(b)(2);
WHEREAS, on October 20, 2023, the Committee communicated four (4) preliminary national security concerns to the Parties relating to the Transaction (the "Preliminary National Security Concerns");
>  
1.2 Purpose Recitals
WHEREAS, the Parties have determined that the national security risks identified during the Committee's review and investigation of the Transaction can be mitigated through the implementation of certain measures, conditions, and obligations set forth in this Agreement, thereby permitting the Transaction to proceed consistent with the national security interests of the United States;
WHEREAS, the Parties enter into this Agreement voluntarily and without compulsion, acknowledging that the terms and conditions set forth herein are intended to address the specific national security concerns identified by the Committee in connection with the Transaction;
WHEREAS, compliance with the terms and conditions of this Agreement is a condition precedent to the Committee's determination not to send a report to the President of the United States recommending that the President exercise authority under 50 U.S.C. § 4565(d) to suspend or prohibit the Transaction, and is a condition to the Committee's issuance of a safe-harbor determination with respect to the Transaction under 50 U.S.C. § 4565(b)(1)(D);
>  
1.3 Statutory and Regulatory Authority
WHEREAS, this Agreement is entered into pursuant to the authority of the Committee under Section 721 of the Defense Production Act of 1950, as amended by the Foreign Investment Risk Review Modernization Act of 2018 ("FIRRMA"), Pub. L. No. 115-232, §§ 1701–1728 (codified at 50 U.S.C. § 4565); Executive Order 11858, as amended by Executive Order 13456 and Executive Order 14083; and the implementing regulations at 31 C.F.R. Parts 800 and 802;
NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
>  
SECTION 2: DEFINITIONS
As used in this Agreement, the following terms shall have the meanings set forth below. Capitalized terms used but not defined in this Section 2 shall have the meanings ascribed to them elsewhere in this Agreement. A comprehensive glossary of defined terms is set forth in Annex A, which, when finalized, shall be incorporated by reference into this Section 2.
"Acquired Business" means Marlowe Asset Management Photonics Inc. and all of its direct and indirect subsidiaries, successors, and assigns, including without limitation all divisions, operating units, and business operations of VPI as of the Effective Date.
"Acquiror" means Halcyon Semiconductor Aktiengesellschaft, an Aktiengesellschaft organized under the laws of the Federal Republic of Germany, together with the Acquisition Vehicle and any other entity that is directly or indirectly controlled by HSAG that acquires any equity interest in or assets of the Acquired Business.
"Acquisition Vehicle" means Halcyon US Holdings Inc., a Delaware corporation and wholly owned subsidiary of the Acquiror formed for the purpose of effectuating the Transaction.
"Applicable Law" means all laws, statutes, regulations, rules, executive orders, and binding guidance of the United States of America, including without limitation the Defense Production Act, FIRRMA, the International Traffic in Arms Regulations ("ITAR"), the Export Administration Regulations ("EAR"), the National Industrial Security Program Operating Manual ("NISPOM"), and any successor regulations or guidance.
"Classified Information" means any information that has been determined, pursuant to Executive Order 13526, as amended, or any predecessor or successor order, to require protection against unauthorized disclosure in the interest of national security and that is so designated by a proper classification authority. The term includes information classified at the CONFIDENTIAL, SECRET, and TOP SECRET levels, as well as any Sensitive Compartmented Information ("SCI") and Special Access Program ("SAP") information.
"Controlled Technical Data" means any information, technical data, software, or technology that is: (a) classified as National Security Information; (b) controlled under the International Traffic in Arms Regulations (22 C.F.R. Parts 120–130), including without limitation defense articles and defense services within the scope of Category XI(a)(3) of the United States Munitions List; (c) controlled under the Export Administration Regulations (15 C.F.R. Parts 730–774), including without limitation items classified under Export Control Classification Numbers ("ECCNs") 3A001, 3A991, 3E001, and related ECCNs; or (d) any other proprietary technical information that is (i) developed under or in performance of a U.S. government contract, (ii) subject to government purpose rights or limited rights under DFARS 252.227-7013 or DFARS 252.227-7014, or (iii) directly related to products or technologies that are controlled under ITAR Category XI(a)(3) or EAR ECCNs 3A001, 3A991, or 3E001; or (iv) designated in writing by the Government Security Committee as "controlled" pursuant to written criteria approved by the Monitoring Agencies and posted to VPI's internal compliance portal, with the GSC designation referencing the specific criteria upon which it is based. For the avoidance of doubt, purely commercial, non-controlled technical information (including EAR99 information) that is not developed under or in performance of a U.S. government contract and is not directly related to ITAR- or EAR-controlled products and is not designated as controlled by the GSC pursuant to clause (iv) above shall not constitute "Controlled Technical Data."
>  
"Critical Technology" means the gallium nitride ("GaN") power amplifier technology, high-electron-mobility transistor ("HEMT") designs, millimeter-wave ("mmWave") architectures, and related compound semiconductor technologies developed by or for VPI that are subject to export controls under ECCN 3A001, ECCN 3A991, ECCN 3E001, and/or ITAR Category XI(a)(3), as well as any enhancements, derivatives, or successor technologies thereof.
"Facility Security Clearance" or "FCL" means the personnel security clearance and facility clearance granted to VPI by the Defense Counterintelligence and Security Agency ("DCSA") at the SECRET level, under which VPI is authorized to access, store, and process classified information at its cleared facility located at 9200 Innovation Boulevard, Albuquerque, New Mexico 87113 (CAGE Code 7VK92, DUNS Number 07-812-4493), and any successor clearance issued to VPI for the same facility located at 9200 Innovation Boulevard, Albuquerque, New Mexico 87113.
>  
"Government Security Committee" or "GSC" means the committee of the Board of Directors of VPI established pursuant to Section 3.3 of this Agreement, composed exclusively of the Security Board Members, and vested with exclusive authority over the matters described in Section 3.3.
"Material Change" means any material change in the business, operations, assets, senior personnel (at the Vice President level and above), or organizational structure of the Acquired Business that could reasonably be expected to have a significant adverse effect on the national security of the United States, including without limitation any divestiture of assets, any change in the nature or scope of VPI's classified or export-controlled government contracts, any material modification to VPI's classified facility or classified information technology infrastructure, any change to cleared personnel at the Vice President level and above in positions requiring access to Classified Information or Controlled Technical Data, any new foreign subcontracting arrangement involving classified or export-controlled work, any change to VPI's classified or export-controlled product lines, and any change to the Acquiror's ownership structure in which any person or affiliated group acquires beneficial ownership of ten percent (10%) or more of HSAG's outstanding voting securities or in which any person from a country identified in 31 C.F.R. § 800.401 or on OFAC's Specially Designated Nationals List acquires beneficial ownership of five percent (5%) or more of HSAG's outstanding voting securities. Notwithstanding the foregoing, the following shall not constitute a "Material Change": (i) ordinary-course personnel changes below the Vice President level; (ii) commercial (non-government) business activities not involving classified or export-controlled products; (iii) routine capital expenditures below Two Million Five Hundred Thousand Dollars ($2,500,000); and (iv) product development decisions relating to uncontrolled commercial products.
>  
"Monitoring Agencies" means the U.S. Department of the Treasury, the U.S. Department of Defense, and the U.S. Department of Energy, acting collectively in their capacity as the agencies designated by CFIUS to monitor compliance with this Agreement.
"Monitoring Agency" means, for purposes of day-to-day compliance monitoring and facility security oversight, the Defense Counterintelligence and Security Agency ("DCSA"), which shall serve as the primary point of contact for routine compliance matters under this Agreement.
"National Security Information" means information that has been classified at any level pursuant to Executive Order 13526, as amended, or any predecessor or successor order.
"Non-U.S. Person" means any person who is not a "U.S. person" as that term is defined in 22 C.F.R. § 120.62 (formerly § 120.15), including any foreign national, foreign government, or representative of a foreign government, but excluding any individual who is a citizen of the United States regardless of any additional nationalities held by such individual.
>  
"Security Board Member" means a member of VPI's Board of Directors who satisfies the qualifications set forth in Section 3.1 of this Agreement, including the requirement that such individual be a citizen of the United States and hold or be eligible for a security clearance at the level specified in Section 3.1(b)(ii).
"Security Director" means the Security Board Member designated pursuant to Section 3.4 of this Agreement who serves as the independent director responsible for overseeing VPI's compliance with this Agreement and who has direct reporting obligations to the Monitoring Agencies.
"Technology Control Plan" or "TCP" means the comprehensive plan established pursuant to Section 5 and set forth in detail in Annex B, governing the protection of Controlled Technical Data, Classified Information, and Critical Technology from unauthorized disclosure to Non-U.S. Persons, including without limitation the physical, electronic, and procedural controls required to prevent unauthorized access to or transfer of such data.
"Transaction" has the meaning set forth in the recitals to this Agreement.
The foregoing defined terms are supplemented by the additional defined terms set forth in Annex A, which shall be incorporated by reference upon finalization. In the event of any inconsistency between the definitions in this Section 2 and those in Annex A, the definitions in this Section 2 shall control.
SECTION 3: BOARD GOVERNANCE AND GOVERNMENT SECURITY COMMITTEE
3.1 Board Reconstitution
(a) Effective as of the closing of the Transaction (the "Closing"), the Board of Directors of VPI (the "Board") shall be reconstituted to consist of five (5) members, as follows:
(i) Three (3) individuals who satisfy the qualifications for "Security Board Members" as set forth in this Section 3.1 (each, a "Security Board Member"); and
(ii) Two (2) individuals designated by the Acquiror (each, an "Acquiror Designee"), subject to the restrictions set forth in Section 3.2.
(b) Each Security Board Member must satisfy all of the following qualifications:
(i) Be a citizen of the United States of America;
(ii) Hold, or be eligible for and willing to obtain, a security clearance at the TOP SECRET/Sensitive Compartmented Information (TS/SCI) level, as determined by DCSA; provided, however, that (A) the Security Board Member designated as the Security Director pursuant to Section 3.4 must hold a security clearance at the TOP SECRET/Sensitive Compartmented Information (TS/SCI) level at the time of appointment, (B) the Security Board Member who serves as or designates the Facility Security Officer must hold or be eligible for a security clearance at the TOP SECRET/Sensitive Compartmented Information (TS/SCI) level, and (C) the third Security Board Member must hold or be eligible for TS/SCI and must obtain TS/SCI within twelve (12) months of appointment if not already held at the time of appointment; during such twelve (12) month period, the third Security Board Member may serve with SECRET clearance, which is sufficient for access to all VPI programs below the TS/SCI level;
(iii) Have relevant experience in national security, defense technology, semiconductor industry operations, or government contracting;
(iv) Be approved by the Monitoring Agencies prior to appointment; and
(v) Not be an officer, director, employee, agent, or consultant of HSAG or any HSAG affiliate (other than VPI) at the time of appointment or at any time during the three (3) years prior to appointment.
(c) The initial Security Board Members shall be identified and approved prior to the Closing. The Parties shall cooperate to identify qualified candidates, and the Monitoring Agencies shall have final approval authority over the appointment of each Security Board Member.
(d) In the event of a vacancy among the Security Board Members, the remaining Security Board Members, in consultation with the Monitoring Agencies, shall identify a replacement who satisfies the qualifications set forth in Section 3.1(b). No vacancy shall remain unfilled for more than sixty (60) days.
>  
3.2 Acquiror Designee Restrictions
(a) The Acquiror Designees shall be subject to the following restrictions in connection with their service on the Board:
(i) No Acquiror Designee may hold, access, receive, or be provided with any Classified Information, Controlled Technical Data, or export-controlled information of any kind;
(ii) No Acquiror Designee may attend, participate in, or vote on any matter considered by the Government Security Committee or otherwise within the GSC's exclusive authority as set forth in Section 3.3;
(iii) No Acquiror Designee may communicate, transmit, or otherwise make available to any Non-U.S. Person any Controlled Technical Data, Classified Information, or export-controlled information of any kind without the prior written approval of the Government Security Committee; provided, however, that this Section 3.2(a)(iii) shall not apply to (A) financial information (including revenue, costs, margins, balance sheet data, and tax information) required for HSAG's consolidated financial reporting, regulatory compliance, or debt covenant compliance under the $900 million term loan credit agreement with Meridian National Bank, Atlas Commercial Lending AG, and Pacific Basin Credit Corp.; (B) non-technical commercial information (including customer lists, marketing materials, and pricing information) that does not constitute Controlled Technical Data; or (C) information that is publicly available; and
(iii-1) The Acquiror Designees shall provide to the GSC a quarterly summary log of categories of non-controlled information shared with HSAG pursuant to the carve-outs in Section 3.2(a)(iii)(A) through (C), without disclosing the substance of the information itself; and
(iv) Each Acquiror Designee shall execute a non-disclosure agreement in a form approved by the Monitoring Agencies prior to assuming his or her seat on the Board.
(b) Nothing in this Section 3.2 shall prevent the Acquiror Designees from exercising their fiduciary duties as directors of VPI with respect to matters outside the GSC's exclusive authority, including without limitation approval of budgets, capital expenditure plans, commercial strategy, and non-classified business operations, subject to the restrictions set forth above.
>  
3.3 Government Security Committee
(a) The Board shall establish, effective as of the Closing, a Government Security Committee (the "GSC") composed exclusively of the three (3) Security Board Members appointed pursuant to Section 3.1.
(b) The GSC shall have exclusive authority over the following matters, and the full Board may not act on or override any GSC determination with respect to such matters:
(i) All matters relating to classified programs performed by VPI, including the oversight, administration, and performance of all contracts, subcontracts, and other agreements involving access to or use of Classified Information;
(ii) All matters relating to regulatory compliance with ITAR and EAR requirements, including compliance with VPI's DDTC Registration No. M-24817, the administration of all active DSP-5 export licenses, and the filing and maintenance of export authorizations; provided, however, that commercial business strategy decisions — including decisions about which products to develop, which markets to pursue, and which customers to serve — shall remain within the authority of the full Board, subject to the Technology Control Plan's controls on actual technology transfer;
(iii) Personnel security decisions, including the granting, denial, suspension, or revocation of facility access for any individual, the nomination and processing of individuals for security clearances, and the approval of changes to senior personnel at the Vice President level and above in positions requiring access to Classified Information or Controlled Technical Data, and the designation of the Facility Security Officer;
(iv) Facility security decisions at VPI's cleared facility located at 9200 Innovation Boulevard, Albuquerque, New Mexico 87113, including decisions regarding physical access controls, alarm systems, intrusion detection, and SCIF operations;
(v) All decisions relating to VPI's Facility Security Clearance (CAGE Code 7VK92), including applications for clearance upgrades, responses to DCSA inquiries, and corrective actions in response to security violations; and
(vi) Oversight and management of VPI's fourteen (14) active Department of Defense contracts with an aggregate remaining backlog of approximately One Hundred Ninety-Three Million Dollars ($193,000,000).
(c) The GSC shall have the authority to override any decision of the full Board on any matter within the GSC's exclusive authority as described in Section 3.3(b). In the event of a conflict between a decision of the full Board and a determination of the GSC with respect to any matter within the GSC's exclusive authority, the GSC's determination shall control.
(d) The GSC shall meet no less frequently than quarterly and shall maintain minutes of all meetings, which shall be made available to the Monitoring Agencies and the Third-Party Monitor upon request.
(e) The GSC must approve any changes to cleared personnel positions at the Vice President level and above, including new hires, reassignments, terminations, and promotions of such senior personnel who hold or require security clearances or who have access to Classified Information or Controlled Technical Data. For changes to cleared personnel positions below the Vice President level, VPI shall provide advance notification to the GSC and DCSA no fewer than five (5) business days before the effective date of such change. VPI shall provide the GSC with a monthly summary report of all cleared personnel actions below the Vice President level.
>  
> 
3.4 Security Director
(a) One of the three Security Board Members shall be designated as the "Security Director." The Security Director shall serve as the chair of the GSC and shall be the primary point of contact between VPI and the Monitoring Agencies for all matters relating to compliance with this Agreement.
(b) The Security Director must satisfy the following independence requirements in addition to the qualifications set forth in Section 3.1(b):
(i) The Security Director shall not have been an officer, director, employee, agent, consultant, or advisor of HSAG, the Acquisition Vehicle, or any affiliate of HSAG (other than VPI) at any time during the four (4) years preceding the date of his or her appointment;
(ii) The Security Director shall not have any direct or indirect financial interest in HSAG or any HSAG affiliate (other than VPI), including without limitation any equity ownership, option grants, deferred compensation, or consulting arrangements, at the time of appointment or during the term of service;
(iii) The Security Director shall not be a family member (as defined in 17 C.F.R. § 229.404(a)) of any officer, director, or five percent (5%) stockholder of HSAG.
(c) The Security Director shall have a direct reporting obligation to the Monitoring Agencies with respect to any compliance concern, potential violation, or national security issue arising under this Agreement. The Security Director may communicate directly with the Monitoring Agencies without prior notification to or approval from HSAG, the Acquisition Vehicle, or any other Party.
(d) The compensation of the Security Director shall be determined by the GSC and shall be paid by VPI at market rates for comparable independent director positions at defense-sector companies of similar size.
>  
SECTION 4: PERSONNEL PROVISIONS
4.1 Key Personnel Retention
(a) The following individuals (each, a "Key Person" and collectively, the "Key Personnel") shall remain employed by VPI in their current positions for a minimum period of twenty-four (24) months following the Closing (the "Retention Period"); provided, however, that Col. (Ret.) Bryce Hendrickson (Vice President of Government Programs and designated Facility Security Officer) shall remain employed for a minimum period of thirty (30) months following the Closing:
(i) Dr. Nathan Trevorrow, Chief Executive Officer of VPI;
(ii) Marissa Sung-Avila, President and Chief Operating Officer of VPI; and
(iii) Col. (Ret.) Bryce Hendrickson, Vice President of Government Programs and designated Facility Security Officer of VPI.
(b) VPI and HSAG shall take all commercially reasonable steps to retain each Key Person during the Retention Period, including without limitation maintaining compensation and benefits at levels no less favorable than those in effect as of the date of this Agreement.
(c) In the event that any Key Person departs VPI's employment during the Retention Period, whether by resignation, termination, disability, death, or any other reason:
(i) HSAG and VPI shall provide written notice to the Monitoring Agencies and the GSC no fewer than sixty (60) calendar days prior to the effective date of any voluntary departure or planned termination. In the case of involuntary departure, death, or disability, notice shall be provided within five (5) business days of the event;
(ii) The GSC, in consultation with the Monitoring Agencies, shall identify and approve a replacement for the departing Key Person. No replacement may assume the Key Person's duties until approved by the Monitoring Agencies;
(iii) The replacement must possess a security clearance at a level equal to or higher than that held by the departing Key Person and must have comparable qualifications, experience, and expertise; and
(iv) The Monitoring Agencies shall have twenty (20) business days following receipt of a complete replacement nomination package to approve or object to the proposed replacement.
(d) The obligations of this Section 4.1 are in addition to, and not in lieu of, any retention arrangements between HSAG, VPI, and the Key Personnel under the SPA or any employment agreements.
>  
4.2 Facility Security Officer
(a) Col. (Ret.) Bryce Hendrickson shall be retained as VPI's designated Facility Security Officer ("FSO") in accordance with the requirements of the National Industrial Security Program Operating Manual ("NISPOM"), 32 C.F.R. Part 117.
(b) The FSO shall report directly to the Government Security Committee, and not to HSAG management, the Acquisition Vehicle, or any person or entity other than the GSC and the Monitoring Agencies. The FSO's performance evaluations, compensation determinations, and continuation of employment shall be determined exclusively by the GSC.
(c) The FSO shall have independent authority, exercised in his or her sole discretion, to:
(i) Deny physical access to any VPI facility or portion thereof at which Classified Information is stored, processed, or used, or at which work is performed under classified contracts or ITAR-controlled programs, to any individual, including HSAG personnel and Acquiror Designees, if the FSO determines that such access would pose a risk to the security of Classified Information, Controlled Technical Data, or VPI's Facility Security Clearance;
(ii) Suspend or recommend the suspension of any individual's security clearance pending investigation;
(iii) Report security incidents, potential compromises of Classified Information, and suspected violations of this Agreement directly to DCSA without prior notification to or approval from HSAG or any other Party; and
(iv) Implement emergency security measures as the FSO deems necessary to protect Classified Information or the integrity of VPI's FCL.
(d) VPI and HSAG shall provide the FSO with all resources, personnel, and budget necessary to fulfill the FSO's responsibilities under NISPOM and this Agreement.
>  
4.3 Personnel Vetting
(a) All individuals newly hired by VPI after the Closing who will have access to Controlled Technical Data (as defined in Section 2) shall be subject to a background investigation conducted by or under the authority of DCSA, in accordance with NISPOM requirements applicable to VPI's Facility Security Clearance level.
(b) No individual who is a Non-U.S. Person may be employed by VPI in any position that involves access to Classified Information or ITAR-controlled technical data without prior authorization from the relevant U.S. government authority, including without limitation an individual export license from DDTC (for ITAR-controlled data) or BIS (for EAR-controlled data), or a determination that such access is otherwise authorized under Applicable Law.
(c) VPI shall maintain and provide to the GSC and the Monitor a current roster of all employees with access to Controlled Technical Data, updated no less frequently than quarterly.
>  
SECTION 5: TECHNOLOGY CONTROL PLAN
5.1 General Prohibition on Technology Transfer
(a) Neither VPI nor any person acting on behalf of VPI shall transfer, disclose, provide access to, or otherwise make available any Controlled Technical Data (as defined in Section 2) to any Non-U.S. Person, including without limitation any employee, officer, director, agent, consultant, or representative of HSAG or any HSAG affiliate, without prior written authorization from the appropriate U.S. government authority, as follows:
(i) For ITAR-controlled technical data: prior authorization from the Directorate of Defense Trade Controls ("DDTC") of the U.S. Department of State;
(ii) For EAR-controlled technical data: prior authorization from the Bureau of Industry and Security ("BIS") of the U.S. Department of Commerce; and
(iii) For Classified Information: prior authorization from the appropriate classification authority and DCSA.
(a-1) Notwithstanding Section 5.1(a), the following tiered framework shall govern information transfers between VPI and HSAG:
(i) Tier 1 — Absolute Prohibition: ITAR-controlled data (Category XI(a)(3)), Classified Information (including SAP and SCI data), and data classified under EAR ECCNs 3A001, 3A991, or 3E001 may not be transferred to any Non-U.S. Person under any circumstances without prior written authorization from the appropriate U.S. government authority as specified in Section 5.1(a). No exceptions.
(ii) Tier 2 — GSC Notification and Gatekeeper Approval: EAR-controlled data that is licensable under existing EAR license exceptions or for which a license application has been or will be submitted may be transferred through the gatekeeper process described in Section 5.4, with advance notification to the GSC no fewer than ten (10) business days prior to the proposed transfer. The GSC may object to the proposed transfer within the ten (10) business day period. If the GSC does not object within the ten (10) business day period, the transfer may proceed as proposed, subject to the requisite U.S. government authorization.
(iii) Tier 3 — No Restriction: Purely commercial, non-controlled technical data (EAR99 or otherwise not subject to export controls) that does not relate to classified programs or government contracts may be transferred between VPI and HSAG for legitimate commercial purposes without restriction under this Agreement, subject only to VPI's ordinary confidentiality and trade secret protections.
(b) The prohibition set forth in Section 5.1(a) applies to, and encompasses, the following categories of VPI intellectual property and technical information:
(i) VPI's forty-seven (47) issued U.S. patents, including twenty-three (23) patents developed in whole or in part with government funding and subject to march-in rights under 35 U.S.C. § 203 and the provisions of DFARS 252.227-7038 (Patent Rights — Ownership by the Contractor);
(ii) VPI's twelve (12) pending U.S. patent applications;
(iii) VPI's thirty-one (31) registered trade secrets; and
(iv) All other technical data, know-how, processes, designs, specifications, test results, manufacturing data, and engineering drawings related to Critical Technology.
(b-1) For the avoidance of doubt, government-funded intellectual property (including the twenty-three (23) patents referenced in Section 5.1(b)(i)) shall remain subject to the Tier 1 absolute prohibition regardless of classification status or ITAR/EAR classification status, as a further demonstration of HSAG's commitment to protecting government-funded IP.
(c) Nothing in this Section 5 shall be construed to authorize any transfer of Controlled Technical Data that would otherwise be prohibited under ITAR, EAR, or any other Applicable Law. This Section 5 imposes obligations in addition to, and not in lieu of, the requirements of ITAR, EAR, and all other applicable export control and national security laws and regulations.
>  
5.2 Physical and Electronic Access Controls
(a) VPI shall implement and maintain the following physical access controls at its cleared facility located at 9200 Innovation Boulevard, Albuquerque, New Mexico 87113:
(i) Badge-access systems restricting entry to classified work areas, specifically clean room Sections C-7 through C-12, to individuals who hold appropriate security clearances and have a verified need-to-know;
(ii) Controlled access points with card readers, biometric authentication, and security guard stations at all entrances to classified areas;
(iii) Intrusion detection systems, alarm monitoring, and closed-circuit video surveillance in accordance with NISPOM requirements;
(iv) Visitor management procedures requiring advance notification, escort, and sign-in/sign-out for all visitors to classified areas; and
(v) Comprehensive visitor logs maintained for all Non-U.S. Persons entering any VPI facility, whether classified or unclassified, to be retained for a period of not less than five (5) years and made available to the Monitoring Agencies and Monitor upon request.
(a-1) VPI's Colorado Springs headquarters at 7400 Ridgeline Parkway, Colorado Springs, Colorado 80919, shall maintain standard commercial building access controls (badge systems and visitor sign-in) and visitor logs for Non-U.S. Persons as required by Section 5.2(a)(v). The requirements of Sections 5.2(a)(i) through (iv) shall not apply to the Colorado Springs headquarters, which does not house classified work areas, ITAR-controlled programs, or SCIF operations.
(b) VPI shall implement and maintain the following electronic access controls:
(i) Role-based access controls for all databases, servers, file repositories, and network segments containing Controlled Technical Data;
(ii) Multi-factor authentication for all remote access to VPI systems containing Controlled Technical Data;
(iii) Encryption of Controlled Technical Data at rest (AES-256 or equivalent) and in transit (TLS 1.2 or higher);
(iv) Audit logging of all access to, modification of, and transfer of Controlled Technical Data, with logs retained for not less than three (3) years; and
(v) Quarterly reviews of access permissions to ensure that only authorized individuals retain access to Controlled Technical Data.
>  
5.3 Export Compliance Integration
(a) The Technology Control Plan shall be integrated with VPI's existing ITAR and EAR compliance program, and VPI shall maintain and operate both programs in a coordinated manner to ensure consistent treatment of controlled technical data.
(b) VPI shall maintain its active registration with the DDTC (Registration No. M-24817) and shall continue to comply with all terms and conditions of its existing export authorizations, including without limitation the three (3) active DSP-5 licenses currently in effect for authorized deliveries to NATO ally end-users in the United Kingdom and Australia.
(c) VPI shall not submit any new application for an export license, technical assistance agreement, manufacturing license agreement, or other ITAR or EAR authorization without prior review and approval by the GSC. The GSC shall have ten (10) business days following receipt of a complete application package to review and either approve, modify, or object to the proposed export authorization application. If the GSC does not object within ten (10) business days of receiving a complete application package, the application may be submitted as proposed (deemed approval). For applications involving ITAR Category XI(a)(3) items or classified end-use, the review period shall be extended to twenty (20) business days, with no deemed approval. The GSC shall have the authority to approve, modify, or reject any proposed export authorization application.
>  
5.4 Information Barriers
(a) VPI shall establish and maintain a "Chinese wall" information barrier between VPI technical personnel with access to Controlled Technical Data and HSAG's global research and development teams, including without limitation HSAG's design centers in Dresden, Germany; Taipei, Taiwan; and Austin, Texas (Halcyon US Inc.).
(b) VPI shall designate no fewer than two (2) and no more than four (4) individuals as "Gatekeepers" who are authorized to manage approved information flows between VPI and HSAG. Each Gatekeeper must:
(i) Be a U.S. citizen;
(ii) Hold or be eligible for a security clearance at the SECRET level or higher;
(iii) Be trained in ITAR, EAR, and classification requirements applicable to VPI's technical data;
(iv) Report to the FSO and the GSC; and
(v) Maintain records of all information transfers between VPI and HSAG, including the nature and classification of the information transferred, the identity of the sender and recipient, and the authorization under which the transfer was made.
(b-1) At least one (1) Gatekeeper must be approved by the GSC prior to commencing gatekeeper duties. A log of all information flows through the gatekeeper process shall be maintained and made available to the Third-Party Monitor during annual compliance audits conducted pursuant to Section 8.2.
(c) VPI's management shall provide a semi-annual written certification to the Monitoring Agencies and the Monitor, signed under oath by the CEO and FSO, attesting that no unauthorized transfers of Controlled Technical Data have occurred during the preceding six-month period. The first such certification shall be due six (6) months after the Closing, and subsequent certifications shall be due every six (6) months thereafter for the duration of this Agreement.
(d) The following categories of information shall not be subject to the information barrier or gatekeeper requirements and may flow freely between VPI and HSAG without gatekeeper involvement:
(i) Financial information, including revenue, expenses, margins, balance sheet data, forecasts, and tax information, required for HSAG's consolidated financial reporting, regulatory compliance, and lender reporting;
(ii) Non-technical commercial information, including customer lists, pricing information, market data, and marketing materials for uncontrolled products;
(iii) General operational information, including headcount, facility status, and supply chain logistics for uncontrolled components; and
(iv) Non-controlled product information, including specifications, datasheets, and design information for products that are not subject to ITAR, EAR (other than EAR99), or classification restrictions.
All other information flows between VPI and HSAG must proceed through the gatekeeper process described in Section 5.4(b).
>  
SECTION 6: FACILITY SECURITY AND ACCESS
6.1 Facility Security Clearance Maintenance
(a) VPI shall maintain its existing Facility Security Clearance at the SECRET level (CAGE Code 7VK92) in good standing throughout the term of this Agreement. VPI shall comply with all NISPOM requirements applicable to the FCL, including without limitation the requirements for personnel security, physical security, information security, and industrial security education and awareness.
(b) This Agreement shall serve as a Special Security Agreement ("SSA") equivalent for purposes of DCSA's foreign ownership, control, or influence ("FOCI") mitigation requirements. No separate FOCI mitigation plan, proxy agreement, or voting trust agreement shall be required beyond the terms of this Agreement.
(c) Any lapse, suspension, revocation, or downgrade of VPI's FCL, or any adverse action taken by DCSA with respect to VPI's FCL, must be reported by VPI to the Monitoring Agencies and the Monitor within twenty-four (24) hours of VPI's receipt of notice of such action.
>  
6.2 HSAG Personnel Access Restrictions
(a) No employee, officer, director, agent, consultant, or representative of HSAG or the Acquisition Vehicle (including without limitation the Acquiror Designees on VPI's Board) may access the classified areas of VPI's Albuquerque facility (Sections C-7 through C-12 of the clean room and the associated SCIF) without satisfying all of the following conditions:
(i) The individual must have received prior written approval from both DCSA and the GSC, which approval must be obtained through a formal request submitted no fewer than thirty (30) calendar days before the proposed date of access;
(ii) The request must include a written justification for the access, identifying the specific areas to be visited, the purpose of the visit, the duration of the visit, and the identity and qualifications of the individual;
(iii) The individual must hold a security clearance at the level required for the areas to be accessed;
(iv) The individual must be escorted at all times by the FSO or an FSO-designated escort; and
(v) No electronic devices (including mobile phones, laptops, tablets, recording devices, or wearable technology) may be brought into classified areas unless specifically authorized by the FSO.
(a-1) Security Board Members and Acquiror Designees who are citizens of the United States may access unclassified areas of VPI's Albuquerque facility upon a formal request submitted no fewer than fourteen (14) calendar days before the proposed date of access, submitted through the FSO, with the FSO forwarding such request to the GSC for final approval. Escort by a Security Board Member or the FSO shall be required. The thirty (30) day advance request period in Section 6.2(a)(i) shall apply only to access to classified areas (Sections C-7 through C-12 and the associated SCIF).
(b) Notwithstanding the foregoing, no HSAG personnel who are not citizens of the United States may access the classified areas of VPI's Albuquerque facility under any circumstances, regardless of the individual's security clearance status, nationality, or position within HSAG.
(c) The restrictions set forth in this Section 6.2 apply in addition to, and not in lieu of, all applicable NISPOM requirements and DCSA directives regarding foreign visitor access to cleared facilities.
>  
>  
6.3 Facility Modifications
(a) VPI shall provide written notification to the Monitoring Agencies no fewer than sixty (60) calendar days before commencing any physical modification, renovation, expansion, or alteration to classified work areas (Sections C-7 through C-12 and the associated SCIF), the perimeter security infrastructure (fencing, gates, guard stations, and lighting), or the alarm, intrusion detection, or access control systems at VPI's Albuquerque facility at 9200 Innovation Boulevard, Albuquerque, New Mexico 87113. Routine maintenance and modifications to unclassified, non-government areas of VPI's facilities shall not require notification under this Section 6.3(a). The notification shall include a description of the proposed modification, the affected areas of the facility, the estimated timeline, and the anticipated impact (if any) on the facility's security posture.
(b) VPI may not establish any new facility or site for the performance of classified work, ITAR-controlled work, or work under U.S. government contracts without the prior written approval of both DCSA and the GSC. Any such new facility must satisfy all applicable NISPOM requirements and must be included within the scope of VPI's FCL before commencing classified or ITAR-controlled work.
(c) VPI shall notify the Monitoring Agencies of any planned closure, relocation, or consolidation of VPI facilities no fewer than ninety (90) calendar days before the effective date of such action.
>  
SECTION 7: CYBERSECURITY REQUIREMENTS
7.1 NIST SP 800-171 Compliance
(a) VPI shall maintain full compliance with NIST Special Publication 800-171, Revision 2 (or any successor publication), Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, with respect to all information systems that process, store, or transmit Controlled Unclassified Information ("CUI") in connection with VPI's performance of U.S. government contracts.
(b) VPI shall achieve and maintain a minimum Supplier Performance Risk System ("SPRS") score of one hundred (100) within nine (9) months of the Closing. VPI shall comply with the following milestone framework: (i) VPI shall complete a gap assessment within sixty (60) days of the Closing; (ii) VPI shall submit a remediation plan to the GSC and the Monitor within ninety (90) days of the Closing; and (iii) VPI shall achieve a minimum SPRS score of one hundred (100) within nine (9) months of the Closing. VPI shall provide documentation of its SPRS score to the Monitoring Agencies and the Monitor within ten (10) business days of achieving the required score.
(c) VPI shall develop and maintain a System Security Plan ("SSP") and a Plan of Action and Milestones ("POA&M") in accordance with NIST SP 800-171 requirements, and shall make such documents available to the Monitoring Agencies and the Monitor upon request.
>  
7.2 Annual Penetration Testing
(a) VPI shall engage a qualified, independent third-party cybersecurity firm to conduct comprehensive penetration testing of all VPI information technology systems, networks, and applications no less frequently than once per calendar year.
(b) Penetration testing shall include, at a minimum, external network penetration testing, internal network penetration testing, web application testing, wireless network testing, and social engineering testing.
(c) The results of each penetration test, including all findings, identified vulnerabilities, and recommended remediation actions, shall be documented in a written report and provided to DCSA and the Monitor within thirty (30) calendar days of the completion of the test. VPI shall develop and implement a remediation plan for all critical and high-severity vulnerabilities within ninety (90) calendar days of the penetration test report.
>  
7.3 Cybersecurity Incident Reporting
(a) VPI shall report all cybersecurity incidents affecting VPI information systems to DCSA in accordance with the following timelines:
(i) Any cybersecurity incident involving a known or suspected compromise of Classified Information shall be reported within twenty-four (24) hours of discovery;
(ii) All other cybersecurity incidents affecting systems that process, store, or transmit Controlled Technical Data or CUI shall be reported within seventy-two (72) hours of discovery; and
(iii) VPI shall provide follow-up reports to DCSA at intervals of not more than seven (7) calendar days until the incident is resolved.
(b) Cybersecurity incident reports shall include, at a minimum, a description of the incident, the systems and data affected, the estimated scope of compromise, containment and remediation actions taken, and the identity of any individuals involved.
>  
7.4 IT System Segregation
(a) VPI's information technology systems, networks, and infrastructure shall be physically and logically separated from HSAG's global network and all information technology systems operated by or on behalf of HSAG or any HSAG affiliate. Specifically:
(i) VPI shall maintain its own independent network infrastructure, including firewalls, routers, switches, and domain controllers, with no physical or logical connections to HSAG's network;
(ii) VPI and HSAG shall not share any cloud computing infrastructure, cloud storage, email systems, enterprise resource planning ("ERP") platforms, collaboration tools, or data repositories; and
(iii) VPI shall not enter into any shared IT service contract with HSAG, share administrative access credentials with HSAG personnel, or maintain shared data environments with HSAG within any information technology service provider's platform. VPI may independently contract with IT service providers that also independently provide services to HSAG, provided that (A) the service contracts are separate and independent, (B) there is no shared administrative access, and (C) VPI data is stored in separate, segregated environments.
(b) VPI shall provide the Monitor with a network architecture diagram demonstrating compliance with this Section 7.4 within sixty (60) days of the Closing, and shall update such diagram annually or upon any material change to VPI's IT infrastructure.
>  
SECTION 8: THIRD-PARTY COMPLIANCE MONITOR
8.1 Appointment of Monitor
(a) Within thirty (30) calendar days of the Effective Date, HSAG and VPI shall jointly propose to the Monitoring Agencies the appointment of an independent Third-Party Monitor (the "Monitor") to oversee compliance with this Agreement.  
(b) The Monitor must satisfy all of the following qualifications:
(i) The Monitor must be independent of HSAG, the Acquisition Vehicle, VPI, and all affiliates of each, with no financial relationship other than the monitoring engagement itself;
(ii) The principal individual responsible for conducting monitoring activities must hold an active security clearance at the TOP SECRET/SCI level;
(iii) The Monitor must have demonstrated experience in monitoring compliance with national security agreements, FOCI mitigation agreements, or comparable government security arrangements;
(iv) The Monitor must maintain professional liability insurance in an amount not less than Five Million Dollars ($5,000,000); and
(v) The Monitor must be approved by the Monitoring Agencies prior to commencement of monitoring activities.
(c) If the Parties cannot agree on a Monitor within thirty (30) calendar days, or if the Monitoring Agencies do not approve the proposed Monitor, the Monitoring Agencies may designate a Monitor of their choosing. The costs of any Monitor designated by the Monitoring Agencies shall be borne solely by HSAG.
>  
8.2 Monitor Scope and Authority
(a) The Monitor shall have the following scope of authority and responsibility:
(i) Conduct comprehensive compliance audits of VPI's and HSAG's compliance with all provisions of this Agreement no less frequently than once per calendar year;
(ii) Conduct unannounced inspections of VPI facilities (7400 Ridgeline Parkway, Colorado Springs, Colorado 80919 and 9200 Innovation Boulevard, Albuquerque, New Mexico 87113) at any time, with or without advance notice. The Monitor may inspect HSAG's U.S. facilities upon not less than five (5) business days' advance notice and only to the extent such inspection relates to HSAG's compliance with the obligations set forth in this Agreement;
(iii) Review any documents, records, files, databases, communications, or other information in the possession of VPI that the Monitor deems relevant to assessing compliance with this Agreement, and review any documents, records, files, databases, communications, or other information in the possession of HSAG or the Acquisition Vehicle that directly relate to VPI or to HSAG's compliance with the obligations set forth in this Agreement;
(iv) Interview any employee, officer, director, agent, consultant, or contractor of VPI in connection with the Monitor's compliance assessment activities, and interview any employee, officer, director, agent, consultant, or contractor of HSAG or the Acquisition Vehicle who has direct responsibility for NSA compliance, VPI oversight, or VPI-related matters;
(v) Report findings, observations, and recommendations to the Monitoring Agencies (DCSA, Treasury, DoD, and DOE) in writing no less frequently than annually, with interim reports as warranted by the Monitor's findings; and
(vi) Report identified violations, areas of concern, and patterns of non-compliance to the Monitoring Agencies. The Monitor shall not have authority to initiate, recommend, or direct enforcement action, which authority is reserved solely to the Monitoring Agencies and CFIUS.
(b) VPI, HSAG, and the Acquisition Vehicle shall cooperate fully with the Monitor and shall provide the Monitor with access to facilities, personnel, records, and information as set forth in this Section 8.2. Failure to cooperate with the Monitor shall constitute a violation of this Agreement.
>  
>  
8.3 Monitor Costs
(a) All costs and expenses of the Third-Party Monitor, including without limitation fees, travel expenses, out-of-pocket costs, and reasonable expenses of support personnel, shall be borne solely by HSAG.
(b) Monitor fees shall be One Million Two Hundred Thousand Dollars ($1,200,000) per annum ($300,000 per quarter), payable quarterly by HSAG within thirty (30) days of receipt of the Monitor's invoice. The annual fee shall be subject to annual adjustment based on the Consumer Price Index for All Urban Consumers (CPI-U), U.S. City Average, as published by the Bureau of Labor Statistics. Any fee increase beyond CPI-U adjustments shall require the prior written approval of HSAG.
>  
8.4 Monitor Term
(a) The Monitor's engagement shall continue for the duration of this Agreement, as set forth in Section 11. In the event this Agreement is terminated or amended to remove the monitoring requirement, the Monitor's engagement shall terminate upon the effective date of such termination or amendment.
(b) If the Monitor resigns, is terminated for cause, or is otherwise unable to continue serving, the Parties shall appoint a replacement Monitor in accordance with the procedures set forth in Section 8.1 within sixty (60) days of the vacancy.
>  
SECTION 9: DATA SEGREGATION AND INFORMATION SECURITY
9.1 Physical Segregation
(a) All VPI servers, data storage devices, network equipment, backup systems, and other information technology hardware containing VPI data shall be physically housed at VPI facilities, specifically at VPI's Colorado Springs headquarters (7400 Ridgeline Parkway, Colorado Springs, Colorado 80919) or VPI's Albuquerque facility (9200 Innovation Boulevard, Albuquerque, New Mexico 87113).
(b) No VPI data of any kind — whether classified, controlled, or unclassified — may be stored at any HSAG facility, at any facility of any HSAG affiliate, or at any facility located outside the United States.
(c) VPI shall maintain a current inventory of all physical locations where VPI data is stored, and shall provide such inventory to the Monitor and the Monitoring Agencies upon request.
(d) Notwithstanding Section 9.1(a), VPI may maintain encrypted data backups at a U.S.-based third-party disaster recovery facility, provided that: (i) the facility is located within the continental United States; (ii) the facility operator meets the cybersecurity requirements of Section 7 (NIST SP 800-171 compliance); (iii) the backup data is encrypted at rest (AES-256 or equivalent) and in transit (TLS 1.2 or higher); (iv) the facility is not owned or operated by HSAG or any HSAG affiliate; and (v) the facility and operator are approved by the GSC. VPI shall notify the Monitor and the Monitoring Agencies of any disaster recovery facility within thirty (30) days of establishing such arrangement.
>  
9.2 Logical Segregation
(a) VPI's domain, active directory, email system, and all enterprise information systems shall be logically separated from HSAG's systems at all times. VPI shall maintain its own independent domain (currently vanguardphotonics.com) and shall not migrate to or integrate with any HSAG domain or email system.
(b) No HSAG employee, officer, director, or contractor (other than VPI employees or approved VPI board