CALDERWOOD & HARKNESS LLP Attorneys at Law
1750 K Street NW, Suite 800
January 26, 2024
PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION
MEMORANDUM
To:
Dr. Maximilian Ehrhardt, Vorstandsvorsitzender (CEO) Katarina Brückner, Finanzvorstand (CFO) Stefan Lohse, Chefjustitiar (General Counsel) — Halcyon Semiconductor Aktiengesellschaft
From:
Beatrice Holloway, Responsible Partner Margaret "Peggy" Ashworth, Of Counsel, National Security & CFIUS Lt. Col. (Ret.) David Caruso, Senior Counsel, Government Contracts & Export Controls — Calderwood & Harkness LLP
Re:
Summary of National Security Agreement (NSA-2024-0019) — Obligations, Compliance Deadlines, and Implementation Steps — Acquisition of Marlowe Asset Management Photonics Inc. (CFIUS Case No. CFIUS-023-07-3841)
cc:
Priya Venkataraman, Kenneth Morales (Calderwood & Harkness LLP)
Right-click to update Table of Contents
I. Executive Summary
This memorandum provides a plain-language summary of the executed National Security Agreement, designated NSA-2024-0019 (the "NSA"), dated January 19, 2024, entered into by and among Halcyon Semiconductor Aktiengesellschaft ("HSAG"), Halcyon US Holdings Inc. ("Halcyon US Holdings"), Marlowe Asset Management Photonics Inc. ("VPI"), and the United States of America, acting through the U.S. Department of the Treasury, the Department of Defense, and the Department of Energy (collectively, the "Government Parties").
The NSA was a mandatory condition precedent to the Committee on Foreign Investment in the United States ("CFIUS") clearance of the proposed acquisition by Halcyon US Holdings Inc. — a Delaware C-corporation and wholly owned subsidiary of HSAG — of 100% of the outstanding equity interests of VPI for a total consideration of $1.42 billion in cash (the "Transaction"). CFIUS issued its safe-harbor letter on January 26, 2024, pursuant to 50 U.S.C. § 4565(b)(1)(D), confirming that the Transaction, as mitigated by the NSA, does not present unresolved national security concerns. Closing of the Transaction is targeted for February 9, 2024.
It is critical that HSAG management understand that the NSA creates binding, ongoing compliance obligations on HSAG, Halcyon US Holdings, and VPI that will survive the closing of the Transaction indefinitely. The NSA does not contain a sunset clause or a fixed expiration date. The obligations imposed by the NSA remain in effect unless and until the NSA is amended or terminated by agreement of all parties, including the U.S. Government. Non-compliance with any provision of the NSA may result in severe consequences, including civil monetary penalties of up to $250,000 per violation per day, injunctive relief, or, in extreme cases, a mandated divestiture of VPI.
This memorandum is organized by obligation category to facilitate management review and internal implementation planning. Section XII provides a consolidated compliance calendar identifying all key deadlines and recurring obligations. Section XIII summarizes the estimated annual costs of compliance. Section XIV sets forth our recommendations for the internal compliance infrastructure HSAG should establish prior to or promptly after closing.
The NSA itself is a detailed instrument of 47 pages, supplemented by 6 annexes (Annexes A through F). This memorandum is intended to summarize the NSA's principal obligations for management convenience. It does not replace the NSA itself, and HSAG management should refer to the full agreement and annexes for precise contractual language. In the event of any discrepancy between this memorandum and the NSA, the terms of the NSA control.
II. Overview of the NSA Structure
Parties
The NSA was executed by the following parties:
• Halcyon Semiconductor Aktiengesellschaft ("HSAG"), Industriestraße 44, 01099 Dresden, Saxony, Germany — the ultimate parent entity and acquiror.
• Halcyon US Holdings Inc. ("Halcyon US Holdings"), 160 Greentree Drive, Suite 101, Dover, DE 19904 — the direct acquiror, a Delaware C-corporation and wholly owned subsidiary of HSAG formed for the purpose of holding the equity of VPI.
• Marlowe Asset Management Photonics Inc. ("VPI"), 7400 Ridgeline Parkway, Colorado Springs, CO 80919 — the acquired U.S. business.
• United States of America, acting through: (i) the U.S. Department of the Treasury (CFIUS Chair); (ii) the U.S. Department of Defense; and (iii) the U.S. Department of Energy (collectively, the "Government Parties").
Case References
Monitoring Agency
The Defense Counterintelligence and Security Agency ("DCSA") has been designated as the monitoring agency responsible for ongoing oversight of compliance with the NSA. DCSA is a component of the Department of Defense and is responsible for, among other things, oversight of the National Industrial Security Program under the National Industrial Security Program Operating Manual ("NISPOM"), 32 C.F.R. Part 117. DCSA's role under the NSA includes receiving periodic reports and notifications, conducting compliance reviews, and coordinating with the third-party compliance monitor.
Third-Party Compliance Monitor
CFIUS has required the appointment of a third-party compliance monitor (the "Monitor") to provide independent oversight of HSAG's and VPI's compliance with the NSA. The approved Monitor is:
Whitmore Compliance Group LLC 1300 Crystal Drive, Suite 710 Arlington, VA 22202
Principal: Gerald Whitmore Former FBI Counterintelligence Division; holds active TS/SCI security clearance
The Monitor was approved by CFIUS on December 8, 2023, following a vetting process conducted by the Government Parties. The engagement agreement between HSAG and Whitmore Compliance Group LLC was executed concurrently with the NSA. The Monitor's role, scope, costs, and reporting obligations are described in detail in Section VIII of this memorandum.
Structure of Annexes
The NSA is supplemented by six annexes, each of which is incorporated by reference into the NSA and has the same binding force and effect as the body of the agreement:
HSAG management should ensure that copies of all annexes are maintained by the General Counsel's office and are readily accessible to the individuals responsible for compliance implementation.
III. Board Governance Obligations
The governance provisions of the NSA are among the most significant and far-reaching obligations imposed on HSAG and VPI. They fundamentally restructure VPI's board of directors and establish a Government Security Committee with exclusive authority over classified, ITAR-controlled, and security-related matters. HSAG's ability to exercise control over VPI is expressly limited in these areas, and strict adherence to the governance provisions is essential to maintaining CFIUS clearance and avoiding enforcement action.
III.A. Reconstitution of VPI Board of Directors
Pursuant to NSA §§ 3.1 through 3.4, VPI's board of directors must be reconstituted as a five-member board effective as of the closing of the Transaction (targeted for February 9, 2024). The composition requirements are as follows:
Security Board Members (3 seats):
Three members of the board must be "Security Board Members" as defined in the NSA and Annex A. Each Security Board Member must satisfy the following requirements:
(a) Must be a United States citizen;
(b) Must hold, or be eligible to hold, a personnel security clearance at the TOP SECRET/SCI (TS/SCI) level;
(c) Must not be subject to any foreign ownership, control, or influence ("FOCI") that would disqualify such person from holding a security clearance under the NISPOM; and
(d) One of the three Security Board Members must serve as an "Independent Security Director" — that is, an individual who is not an employee, officer, or director of HSAG, VPI, or any affiliate of HSAG, and who is independent of HSAG within the meaning of the NSA.
The proposed Security Board Members, as submitted to and accepted by CFIUS via correspondence dated December 2023, are:
1. Col. (Ret.) Bryce Hendrickson — Currently Vice President, Government Programs and Facility Security Officer (FSO) of VPI. Col. Hendrickson holds an active TS/SCI security clearance. He will continue in his current operational role at VPI in addition to serving on the board.
2. Adrienne Delacroix — Currently an independent director on VPI's existing board of directors. Ms. Delacroix holds an active SECRET-level security clearance. She has served on VPI's board since 2019 and brings continuity and familiarity with VPI's government programs.
3. Independent Security Director — To be identified and submitted for approval by CFIUS and DCSA prior to or promptly after closing. As of the date of this memorandum, the candidate for this position has not been finalized. We recommend that HSAG prioritize the identification and submission of a qualified candidate, as the appointment of the Independent Security Director is a condition to full compliance with the NSA's governance provisions.
HSAG Designees (2 seats):
Two members of the board will be "HSAG Designees" — directors appointed by HSAG to represent HSAG's interests as the indirect parent company and sole equity holder of VPI. HSAG Designees:
(a) May be employees, officers, or directors of HSAG or its affiliates;
(b) Are not required to hold security clearances;
(c) May not hold or access classified information or classified material of any kind;
(d) May not access ITAR-controlled technical data or export-controlled information unless specifically authorized under an applicable export license or exemption; and
(e) Are subject to the restrictions on GSC participation described in Section III.B below.
HSAG has not yet formally designated its two board appointees. The identities of the HSAG Designees should be communicated to Calderwood & Harkness promptly so that we may confirm compliance with the NSA's requirements and coordinate any necessary notifications to DCSA.
Replacement of Security Board Members: Any replacement of a Security Board Member — whether due to resignation, removal, death, or incapacity — requires the prior written approval of both DCSA and the Government Security Committee. HSAG may not unilaterally replace a Security Board Member without such approvals.
III.B. Government Security Committee (GSC)
Pursuant to NSA §§ 4.1 through 4.9 and Annex C (the GSC Charter), a Government Security Committee ("GSC") must be established, composed exclusively of the three Security Board Members. The GSC exercises exclusive authority over the following matters:
(a) All classified programs and classified information held by or accessible to VPI;
(b) All ITAR-controlled programs and related technical data (including USML Category XI(a)(3) defense articles);
(c) Personnel security matters, including security clearance applications, sponsorships, renewals, and adverse personnel security actions;
(d) Facility Security Clearance (FCL) matters, including the maintenance, modification, and defense of VPI's existing FCL at the SECRET level (CAGE Code 7VK92) at VPI's Albuquerque, New Mexico fabrication facility;
(e) Oversight and enforcement of the Technology Control Plan (Annex B);
(f) Oversight and enforcement of the Cybersecurity Requirements (Annex D); and
(g) Oversight and enforcement of the Facility Access Procedures (Annex F).
The following matters require approval exclusively by the GSC, and the full VPI board (including HSAG Designees) is excluded from participation in these decisions:
(a) Decisions regarding the performance of classified contracts, including the acceptance, modification, or termination of classified government contracts or subcontracts;
(b) Decisions regarding access to, storage, handling, or disposition of classified or export-controlled technical data;
(c) Appointment, evaluation, or removal of VPI's Facility Security Officer;
(d) Responses to DCSA inquiries, inspections, or adverse findings related to VPI's facility clearance;
(e) Determinations regarding whether information proposed for sharing with HSAG or HSAG affiliates is unclassified and not export-controlled; and
(f) Any other matter designated by the GSC as within its exclusive jurisdiction under the GSC Charter.
HSAG Designees may not attend GSC sessions, receive GSC meeting agendas, minutes, or materials, or otherwise participate in or observe GSC deliberations, unless the GSC affirmatively determines that specific information to be discussed at a GSC session is (i) unclassified and (ii) not export-controlled, and the GSC provides express written authorization for HSAG Designee attendance at that specific session. Such authorization is discretionary and may be revoked at any time.
The GSC Charter (Annex C) sets forth additional procedural requirements, including quorum rules, meeting frequency (at least quarterly), recordkeeping, and reporting obligations. The GSC must maintain minutes of all meetings, which must be available for review by the Monitor and DCSA upon request.
III.C. Practical Implementation Steps — Governance
In light of the foregoing governance obligations, we recommend the following implementation steps be completed at or immediately following closing:
1. Execute VPI Post-Closing Board Resolutions. VPI's new five-member board must adopt resolutions formally (a) reconstituting the board in accordance with the NSA, (b) establishing the GSC, (c) adopting the GSC Charter (Annex C), (d) adopting the Technology Control Plan (Annex B), and (e) adopting the Cybersecurity Requirements (Annex D). Draft resolutions have been prepared by Calderwood & Harkness and are being circulated for review.
2. File DCSA Notification of Board Reconstitution. VPI, through its FSO (Col. Hendrickson), must notify DCSA of the reconstitution of its board of directors within five business days of closing. A draft notification letter has been prepared.
3. Identify and Submit Candidate for Independent Security Director. If a candidate for Independent Security Director has not been finalized prior to closing, HSAG must promptly identify a qualified candidate and submit the candidate's name, qualifications, and security clearance status to CFIUS and DCSA for approval. We emphasize that this position must be filled as soon as practicable.
4. Establish Internal Protocols for HSAG Designees. HSAG's corporate governance team should develop and implement written internal protocols to ensure that HSAG Designees do not inadvertently access classified or ITAR-controlled information. These protocols should address, at minimum, the handling of VPI board materials, the segregation of GSC materials from general board materials, and the procedures for routing information requests from HSAG Designees through the GSC for classification/export-control screening.
IV. Personnel Continuity Obligations
NSA §§ 5.1 through 5.5 impose personnel continuity requirements designed to ensure that VPI retains key leadership personnel with institutional knowledge of its government programs, classified operations, and security infrastructure during the post-acquisition transition period. These provisions reflect CFIUS's concern that the departure of critical personnel shortly after acquisition could undermine the national security protections established by the NSA.
The following three individuals are designated as "Key Personnel" under the NSA and must remain employed by VPI for a minimum of twenty-four (24) months following the closing of the Transaction (i.e., through approximately February 2026):
1. Dr. Nathan Trevorrow — Founder and Chief Executive Officer of VPI. Dr. Trevorrow possesses deep technical expertise in gallium nitride-on-silicon carbide (GaN-on-SiC) photonic device fabrication and is the architect of VPI's core intellectual property portfolio.
2. Marissa Sung-Avila — President and Chief Operating Officer of VPI. Ms. Sung-Avila oversees VPI's day-to-day operations, including production scheduling, supply chain management, and customer relations for both commercial and government customers.
3. Col. (Ret.) Bryce Hendrickson — Vice President, Government Programs and Facility Security Officer. Col. Hendrickson manages VPI's classified and unclassified government contracts, serves as the Facility Security Officer responsible for VPI's FCL, and is a designated Security Board Member and GSC member.
If any of these Key Personnel departs VPI — whether voluntarily or involuntarily — before the expiration of the 24-month period, the following requirements apply:
(a) The proposed replacement must be approved by both the GSC and DCSA prior to appointment;
(b) The replacement must be a United States citizen;
(c) The replacement must hold, or be eligible to hold, an appropriate security clearance consistent with the responsibilities of the position;
(d) HSAG must notify the CFIUS monitoring agencies (DCSA, Treasury, DoD, DOE) of the departure of the Key Person within five (5) business days of the departure; and
(e) The notification must include a description of the circumstances of the departure, the identity of the proposed replacement (if known), and the anticipated timeline for appointing a replacement.
Practical Implementation Steps:
• HSAG should confirm that employment agreements or retention arrangements are in place with each Key Person that provide appropriate incentives for continued employment through at least the 24-month retention period. We understand that retention arrangements are being negotiated in connection with the Transaction; HSAG should ensure that these arrangements are finalized prior to closing.
• HSAG's human resources department should establish an internal protocol that flags any departure (or anticipated departure) of a Key Person and triggers the five-business-day CFIUS notification requirement. This protocol should include an escalation path to HSAG's General Counsel and to Calderwood & Harkness for coordination of the required notifications and replacement approval process.
• To the extent practicable, VPI should identify potential successors for each Key Person in advance, so that in the event of an unanticipated departure, the replacement approval process can be initiated promptly.
V. Technology Control Plan (TCP) Obligations
The Technology Control Plan, set forth in NSA Annex B and referenced throughout the body of the NSA (particularly §§ 6.1 through 6.14), is the central mechanism by which the NSA protects against the unauthorized transfer of controlled technology from VPI to HSAG, HSAG affiliates, or other non-U.S. persons. VPI is a manufacturer of advanced GaN-on-SiC photonic devices used in defense and intelligence applications, and its technical data includes items controlled under both the International Traffic in Arms Regulations ("ITAR") and the Export Administration Regulations ("EAR"). The TCP is designed to ensure that these controls are rigorously maintained notwithstanding the change in ownership to a German parent company.
Core Prohibition
The central prohibition of the TCP is as follows: No transfer of VPI technical data that is ITAR-controlled (United States Munitions List Category XI(a)(3) defense articles) or EAR-controlled (Export Control Classification Numbers 3A001, 3A991, and 3E001) may be made to any non-U.S. person without prior United States government authorization. Such authorization must take the form of a valid license issued by the Directorate of Defense Trade Controls ("DDTC") (for ITAR-controlled items) or the Bureau of Industry and Security ("BIS") (for EAR-controlled items), or a clearly applicable exemption or exception under the relevant regulations.
The term "non-U.S. person" is defined broadly in the NSA and Annex A, and expressly includes:
(a) HSAG employees located in Dresden, Germany, or elsewhere outside the United States;
(b) Employees of HSAG's other international subsidiaries, wherever located;
(c) Employees of HSAG's China subsidiary, Halcyon Semiconductor (Shanghai) Co., Ltd.; and
(d) Any other individual who is not a U.S. citizen, U.S. lawful permanent resident, or a "protected person" within the meaning of 8 U.S.C. § 1324b(a)(3).
We wish to emphasize the inclusion of Halcyon Semiconductor (Shanghai) Co., Ltd. in the definition of "non-U.S. person." The NSA specifically identifies this entity, reflecting the heightened sensitivity of the CFIUS monitoring agencies to any potential pathway for transfer of VPI technology to the People's Republic of China. Any inadvertent transfer of controlled technical data to the Shanghai subsidiary — even through an HSAG intermediary — would constitute a serious violation of the NSA and could trigger immediate enforcement action, including potential referral for criminal investigation under the Arms Export Control Act or the Export Control Reform Act.
Permitted Information Sharing
The NSA does recognize that HSAG, as VPI's indirect parent company, has legitimate business needs to receive certain information from VPI for purposes of financial consolidation, strategic planning, and operational oversight. Accordingly, the TCP permits the sharing of information between VPI and HSAG that meets all of the following criteria:
(a) The information is unclassified;
(b) The information is not subject to export controls under the ITAR or EAR (i.e., it is not "technical data" under ITAR § 120.33 or "technology" under EAR § 772.1);
(c) The information is limited to business and financial information, such as financial statements, revenue projections, budget data, headcount information, and similar commercial information; and
(d) The sharing of the information has been reviewed and approved by the TCP Review Committee (described below) or the GSC.
Any proposed sharing of information that does not satisfy all of the foregoing criteria — including any sharing of controlled technical data — requires specific prior U.S. government authorization in the form of an export license or applicable exemption. HSAG and VPI personnel should be trained to default to the assumption that information is controlled unless affirmatively cleared by the TCP Review Committee.
Export Control Registration and Licensing Obligations
The NSA requires VPI to maintain its existing registration with the Directorate of Defense Trade Controls. VPI's current DDTC Registration Number is M-24817. This registration must remain active and current at all times.
In addition, the following export control actions must be completed in connection with the Transaction:
(a) DDTC Change-of-Ownership Notification. VPI must file a notification with DDTC of the change in ownership pursuant to ITAR § 122.4(a). This notification must be filed within sixty (60) days of closing. Calderwood & Harkness is preparing the draft notification for VPI's review.
(b) DSP-5 License Amendments. VPI currently holds three (3) active DSP-5 export licenses authorizing deliveries to NATO allies in the United Kingdom and Australia. These licenses must be amended to reflect the change in VPI's ownership. Calderwood & Harkness will coordinate with VPI's export control personnel to prepare and file the amendment applications promptly after closing.
TCP Review Committee
The TCP requires VPI to establish a TCP Review Committee, which operates as a subset of the GSC. The TCP Review Committee is responsible for pre-screening any proposed information exchange between VPI and HSAG or HSAG affiliates. The TCP Review Committee must:
(a) Review each proposed information transfer to determine whether the information is classified, export-controlled, or otherwise restricted under the NSA;
(b) Document each review in a written determination that is maintained in VPI's records and available for inspection by the Monitor and DCSA;
(c) Approve only those transfers that comply with the TCP and applicable U.S. law; and
(d) Refer to the GSC any proposed transfer that the TCP Review Committee determines may involve controlled technical data or raises questions of interpretation.
Physical and Administrative Controls
The TCP requires VPI to implement and maintain the following physical and administrative controls:
(a) Separation of Controlled Technical Data. All controlled technical data (both ITAR and EAR) must be stored in systems and locations that are physically and logically separated from any systems or locations accessible to HSAG or HSAG personnel.
(b) Signage. Appropriate signage must be posted at all VPI facilities identifying areas where controlled technical data is stored, processed, or discussed, and warning that access by unauthorized persons (including non-U.S. persons) is prohibited.
(c) Document Markings. All documents containing controlled technical data must be marked with appropriate classification or export-control markings (e.g., "ITAR Controlled — U.S. Persons Only," "Export Controlled — ECCN 3E001"), in accordance with VPI's existing marking procedures and the requirements of Annex B.
(d) Access Controls. Physical and electronic access to controlled technical data must be restricted to authorized U.S. persons with a need-to-know. Access control logs must be maintained and available for review by the Monitor and DCSA.
Training
All VPI personnel and all HSAG personnel who have any access to VPI information (including unclassified business information) must receive annual TCP training. The training must cover, at minimum:
(a) The existence and purpose of the NSA and TCP;
(b) The types of information that are controlled and the restrictions on their transfer;
(c) The procedures for requesting TCP Review Committee approval of proposed information transfers;
(d) The consequences of non-compliance, including potential personal criminal liability under the ITAR and EAR; and
(e) The reporting obligations for suspected violations.
The first annual TCP training session must be scheduled within thirty (30) days of closing.
Practical Implementation Steps
1. Appoint TCP Review Committee. The GSC should establish the TCP Review Committee at closing, designating its members and adopting written procedures for the review and approval process.
2. Implement Document Classification/Marking System. VPI should review and, if necessary, update its existing document marking protocols to ensure consistency with the TCP requirements in Annex B.
3. File DDTC Change-of-Ownership Notification. Calderwood & Harkness will prepare and file the ITAR § 122.4(a) notification within sixty days of closing.
4. Initiate DSP-5 License Amendment Applications. Calderwood & Harkness will coordinate with VPI's export control team to prepare and file the three DSP-5 license amendment applications.
5. Schedule First Annual TCP Training. VPI's compliance team should schedule the first TCP training session for all VPI and relevant HSAG personnel within thirty days of closing.
6. Brief HSAG Personnel. All HSAG employees who may interact with VPI — including HSAG Designees on the VPI board, HSAG finance and treasury personnel, HSAG IT personnel, and HSAG management — must be briefed on the TCP restrictions and the prohibition on receiving controlled technical data without prior government authorization.
VI. Facility Security Clearance (FCL) and Facility Access Obligations
VI.A. FCL Maintenance
VPI currently holds a Facility Security Clearance ("FCL") at the SECRET level for its fabrication facility located at 9200 Innovation Boulevard, Albuquerque, New Mexico 87113 (CAGE Code 7VK92). This facility houses a 45,000 square-foot gallium nitride-on-silicon carbide (GaN-on-SiC) fabrication line and associated clean room and testing areas, including classified processing areas (Sections C-7 through C-12). The FCL enables VPI to perform classified government contracts and to receive, store, process, and safeguard classified national security information.
Under the NSA, the NSA itself functions as the equivalent of a Special Security Agreement ("SSA") for purposes of mitigating foreign ownership, control, or influence ("FOCI") under the NISPOM. Accordingly, VPI is not required to enter into a separate FOCI mitigation instrument (such as a standalone SSA, Board Resolution, Proxy Agreement, or Voting Trust Agreement) with DCSA beyond the NSA. The NSA's governance provisions (Sections III.A and III.B above) — including the reconstitution of VPI's board, the establishment of the GSC, and the restrictions on HSAG's access to classified information — satisfy the FOCI mitigation requirements of 32 C.F.R. § 117.11.
Col. (Ret.) Bryce Hendrickson will continue to serve as VPI's Facility Security Officer. His continued service in this role is a core element of the NSA's personnel continuity requirements (Section IV above) and the FOCI mitigation framework.
DCSA must be notified of the completed change in ownership promptly after closing. A post-closing DCSA notification letter has been prepared by Calderwood & Harkness and is ready for execution and submission by Col. Hendrickson within five business days of closing.
HSAG is expressly prohibited from taking any action that would jeopardize VPI's FCL. This prohibition includes, but is not limited to, any unauthorized exercise of foreign ownership, control, or influence over VPI's cleared operations; any action that would cause DCSA to downgrade, suspend, or revoke VPI's FCL; and any failure to maintain the governance and security structures required by the NSA.
VI.B. Facility Access Restrictions (Annex F)
NSA Annex F establishes detailed facility access procedures governing the circumstances under which HSAG personnel may visit or access VPI facilities. These restrictions are tiered based on the sensitivity of the area in question:
Classified Areas (Albuquerque Fab — Sections C-7 through C-12):
HSAG personnel may not access the classified areas of the Albuquerque fabrication facility (clean room Sections C-7 through C-12) without prior written approval from both DCSA and the GSC. No standing access authorization is granted under the NSA. Each proposed visit must be individually reviewed and approved. Approval requests must be submitted at least ten (10) business days in advance and must specify the purpose of the visit, the identity and citizenship of each proposed visitor, and the areas to be accessed. In practice, we expect that approval for HSAG personnel to access these classified areas would be granted only in exceptional circumstances, if at all.
Unclassified Areas — VPI Colorado Springs Headquarters (7400 Ridgeline Parkway):
HSAG personnel may visit VPI's Colorado Springs headquarters with advance notice to VPI's designated facility access coordinator. All visits must be escorted by a designated VPI escort, and a visitor log must be completed for each visit. The visitor log must record the name, organization, citizenship, date and time of arrival and departure, and purpose of visit for each HSAG visitor. Advance notice of at least two (2) business days is required unless the GSC approves a shorter notice period.
Unclassified Areas — Albuquerque Facility (Outside Sections C-7 through C-12):
HSAG personnel may visit the unclassified areas of the Albuquerque fabrication facility with advance notice, escort, and GSC approval. A prohibited items list, set forth in Annex F, applies to all visitors. Prohibited items include, among other things, personal electronic devices with recording or transmission capabilities (unless specifically authorized by the GSC), cameras, USB storage devices, and any documents or materials containing HSAG proprietary or controlled technical data that have not been pre-cleared by the TCP Review Committee.
Visitor Logging and Recordkeeping:
All visits by HSAG personnel to any VPI facility must be logged in a visitor log system. Records must be retained for a minimum of five (5) years and must be made available to the Monitor and DCSA upon request. The visitor log system must be capable of producing reports by visitor name, date, facility, and purpose of visit.
Practical Implementation Steps:
1. Develop HSAG Internal Visitor Request and Approval Workflow. HSAG should establish a formal internal process for requesting and approving visits to VPI facilities. This process should include a review by the HSAG General Counsel's office (or the designated CFIUS/NSA Compliance Officer) to ensure compliance with the NSA's facility access restrictions and to route requests for classified-area access to DCSA and the GSC with appropriate lead time.
2. Designate VPI Escort Personnel. VPI should designate a pool of appropriately cleared employees to serve as escorts for HSAG visitors at each facility. Escort personnel should be trained on the Annex F requirements, including the prohibited items list and the scope of areas accessible to visitors.
3. Implement Visitor Log System. VPI should implement a visitor log system compliant with the Annex F requirements, including electronic recordkeeping, five-year retention, and reporting capabilities.
VII. Data Segregation and Cybersecurity Obligations
VII.A. Data Segregation (IT Systems)
NSA §§ 7.1 through 7.6 and the TCP (Annex B) impose strict requirements for the segregation of VPI's information technology systems from HSAG's global network. These requirements are designed to prevent the unauthorized electronic transfer of controlled technical data from VPI to HSAG, HSAG affiliates, or other non-U.S. persons. The data segregation requirements are as follows:
(a) Physical and Logical Separation. VPI's IT systems must be physically and logically separated from the HSAG global network. This means that VPI must maintain its own independent network infrastructure, and there must be no direct or indirect network connection between VPI systems and HSAG systems.
(b) No Shared Cloud Infrastructure. VPI and HSAG may not share any cloud computing infrastructure, including cloud storage, cloud-based applications, or cloud-based development environments. VPI must maintain its own independent cloud accounts (if applicable) that are not accessible to HSAG personnel.
(c) No Interconnection of Enterprise Systems. VPI and HSAG may not interconnect their respective email systems, file-sharing platforms, enterprise resource planning (ERP) systems, or other enterprise applications without (i) specific GSC approval and (ii) a determination by the TCP Review Committee that the proposed interconnection complies with the TCP and does not create a pathway for unauthorized transfer of controlled technical data.
(d) Independent Infrastructure. VPI must maintain its own independent domain controllers, email servers, file servers, and data storage systems. VPI's IT infrastructure must be administered by VPI IT personnel (who must be U.S. persons with appropriate security clearances where required).
Practical Implementation Steps:
• HSAG IT integration teams must be instructed — in writing, prior to closing — that VPI's IT systems are entirely out of scope for any global IT integration project, platform migration, or network consolidation initiative undertaken by HSAG. This instruction should be issued by the HSAG Chief Information Officer (or equivalent) and acknowledged by the relevant IT integration personnel.
• VPI must retain its own IT administrator(s) with appropriate security clearances. HSAG IT personnel may not have administrative access to VPI's systems.
• If HSAG desires to receive financial or other unclassified, non-export-controlled information from VPI for consolidation or reporting purposes, the mechanism for such information transfer must be reviewed and approved by the TCP Review Committee and the GSC. Acceptable mechanisms may include manual data transfers (e.g., encrypted email of pre-approved reports) rather than automated system-to-system connections.
VII.B. Cybersecurity Requirements (Annex D)
NSA Annex D establishes cybersecurity requirements for VPI's IT systems and networks. These requirements are designed to protect Controlled Unclassified Information ("CUI"), classified information, and export-controlled technical data against unauthorized access, exfiltration, and compromise. The principal requirements are as follows:
(a) NIST SP 800-171 Compliance. VPI must maintain compliance with the National Institute of Standards and Technology Special Publication 800-171 (Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations). NIST SP 800-171 establishes 110 security controls across 14 control families (Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity). VPI's compliance with NIST SP 800-171 must be documented in a System Security Plan ("SSP") and a Plan of Action and Milestones ("POA&M") addressing any identified gaps.
(b) Annual Third-Party Penetration Testing. VPI must engage a qualified third-party cybersecurity firm to conduct annual penetration testing of VPI's systems and networks. The penetration testing vendor must be U.S.-based and must be approved by the GSC. The results of each annual penetration test must be reported to DCSA and the Monitor within thirty (30) days of completion of the test.
(c) Cybersecurity Incident Reporting. VPI must report any cybersecurity incident involving VPI's systems or data to DCSA within seventy-two (72) hours of discovery of the incident. The term "cybersecurity incident" is broadly defined in Annex D and includes, among other things, unauthorized access to VPI systems, exfiltration or suspected exfiltration of data, malware infections, ransomware attacks, phishing compromises, and denial-of-service attacks that materially affect VPI's operations or the integrity of controlled data.
(d) Incident Response Plan. VPI must maintain a written incident response plan that has been reviewed and approved by the GSC. The incident response plan must address, at minimum, detection and identification, containment, eradication, recovery, post-incident analysis, and reporting obligations (including the 72-hour DCSA notification requirement). The incident response plan must be tested at least annually through a tabletop exercise or simulation.
Practical Implementation Steps:
1. Confirm NIST SP 800-171 Compliance Status. VPI should conduct an assessment of its current compliance with NIST SP 800-171 within thirty (30) days of closing. Any identified gaps should be documented in a POA&M and remediated on an expedited basis. Calderwood & Harkness can recommend qualified assessment firms if needed.
2. Engage Annual Penetration Testing Vendor. VPI should identify and engage a U.S.-based penetration testing vendor, subject to GSC approval. The first annual penetration test should be scheduled within twelve months of closing (i.e., by approximately February 2025).
3. Establish 72-Hour Incident Reporting Protocol. VPI should establish a written protocol for the 72-hour cybersecurity incident reporting obligation, including designated points of contact at DCSA and the Monitor. The protocol should include an internal escalation procedure that ensures VPI's IT security team notifies the FSO, the GSC, and external counsel promptly upon discovery of any incident.
4. Brief HSAG IT Security Leadership. HSAG's Chief Information Security Officer (or equivalent) and relevant IT security personnel should be briefed on the 72-hour reporting obligation and the chain of communication. Although the reporting obligation runs to VPI and DCSA, HSAG should be aware that cybersecurity incidents at VPI may trigger NSA compliance implications and may require coordination with Calderwood & Harkness.
VIII. Third-Party Compliance Monitor
VIII.A. Monitor Identity and Engagement
As noted in Section II above, CFIUS has required the appointment of a third-party compliance monitor to provide independent oversight of compliance with the NSA. The approved Monitor is Whitmore Compliance Group LLC, located at 1300 Crystal Drive, Suite 710, Arlington, VA 22202. The Monitor's principal is Gerald Whitmore, a former senior official of the Federal Bureau of Investigation's Counterintelligence Division who holds an active TOP SECRET/SCI security clearance.
The Monitor was approved by CFIUS on December 8, 2023, following a process in which multiple candidate firms were submitted by HSAG and evaluated by the Government Parties. The engagement agreement between HSAG and Whitmore Compliance Group LLC was executed concurrently with the NSA on January 19, 2024. The engagement agreement establishes the Monitor's independence from HSAG and confirms that the Monitor reports directly to the CFIUS monitoring agencies, not to HSAG.
VIII.B. Scope of Monitoring
The Monitor's scope of authority is comprehensive and extends to all obligations imposed by the NSA. Specifically, the Monitor is authorized and directed to conduct:
(a) Annual Comprehensive Compliance Audits. The Monitor will conduct a comprehensive compliance audit on an annual basis, covering all categories of NSA obligations, including: board governance and GSC functioning, TCP adherence, cybersecurity compliance, facility access controls, data segregation, personnel continuity, and pre-notification compliance. The audit will follow the template set forth in Annex E.