first-rfi-exhibit-cybersecurity-overview.docx

1032-00004 · Client 1032 · Review & Investigation Responses

first-rfi-exhibit-cybersecurity-overview.docx DOCUMENT M&A / Corporate

74 / 79 ← → ✕

CONFIDENTIAL TREATMENT REQUESTED — CONTAINS CONFIDENTIAL BUSINESS INFORMATION EXEMPT FROM PUBLIC DISCLOSURE UNDER 50 U.S.C. § 4565(c)

SUPPLEMENTAL EXHIBIT TO FIRST RFI RESPONSE

HALCYON SEMICONDUCTOR AG ENTERPRISE CYBERSECURITY PROGRAM OVERVIEW

CFIUS Case No. CFIUS-023-07-3841

August 18, 2023

Submitted by:

Calderwood & Harkness LLP 1750 K Street NW, Suite 800 Washington, DC 20006

On behalf of Halcyon Semiconductor Aktiengesellschaft ("HSAG")

Prepared for:

Committee on Foreign Investment in the United States U.S. Department of the Treasury Office of Investment Security 1500 Pennsylvania Avenue NW Washington, DC 20220

Counsel of Record:

Margaret "Peggy" Ashworth, Of Counsel — National Security & CFIUS Practice

Lt. Col. (Ret.) David Caruso, Senior Counsel — Government Contracts & Export Controls Practice

Priya Venkataraman, Associate — International Trade & Sanctions Practice

Designation: This document contains Confidential Business Information within the meaning of 50 U.S.C. § 4565(c) and the regulations promulgated thereunder at 31 C.F.R. Part 800. This document is submitted solely for use by the Committee on Foreign Investment in the United States and its member agencies in connection with their review of the referenced transaction. This document is exempt from public disclosure and may not be released, in whole or in part, without the prior written consent of the parties to the transaction.

Right-click to update Table of Contents

I. INTRODUCTION AND PURPOSE

This Supplemental Exhibit is submitted on behalf of Halcyon Semiconductor Aktiengesellschaft ("HSAG") in response to the Committee on Foreign Investment in the United States ("CFIUS" or the "Committee") first Request for Information ("RFI") dated August 4, 2023, received by counsel for HSAG on August 7, 2023, in connection with the Committee's review of CFIUS Case No. CFIUS-023-07-3841. HSAG submits this Supplemental Exhibit through its counsel of record, Calderwood & Harkness LLP, in a good-faith effort to provide the Committee with comprehensive, transparent, and detailed information responsive to the RFI's inquiries.

Specifically, this Supplemental Exhibit addresses the questions and information requests set forth in the First RFI concerning: (a) HSAG's enterprise cybersecurity practices and governance structure; (b) HSAG's information security governance and organizational framework; (c) HSAG's data protection and privacy compliance framework, including cross-border data transfer mechanisms; and (d) the planned measures HSAG will implement to maintain the security and integrity of Marlowe Asset Management Photonics Inc. ("VPI") information technology systems and data following the closing of the proposed acquisition (the "Transaction").

Background on HSAG. Halcyon Semiconductor Aktiengesellschaft is a semiconductor design and manufacturing company headquartered at Industriestraße 44, 01099 Dresden, Saxony, Federal Republic of Germany. HSAG is publicly traded on the Frankfurt Stock Exchange under the ticker symbol XETRA: HLC. As of June 1, 2023, HSAG's market capitalization was approximately €14.8 billion. HSAG reported revenues of approximately €6.12 billion for fiscal year 2022. HSAG's operations span multiple countries, including Germany, the broader European Union, the United Kingdom, Japan, South Korea, Taiwan, and the United States, where HSAG operates through its existing wholly owned subsidiary, Halcyon US Inc., located at 11501 Alterra Parkway, Suite 300, Austin, TX 78758. HSAG specializes in advanced compound semiconductor design and fabrication, with particular expertise in silicon carbide (SiC) and gallium nitride (GaN) power and radio-frequency devices for automotive, industrial, telecommunications, and defense end markets.

The Transaction. On June 10, 2023, HSAG entered into a Stock Purchase Agreement (the "SPA") to acquire 100% of the outstanding equity interests of Marlowe Asset Management Photonics Inc. ("VPI"), a Delaware corporation headquartered at 7400 Ridgeline Parkway, Colorado Springs, CO 80919, with a secondary fabrication facility located at 9200 Innovation Boulevard, Albuquerque, NM 87113. The aggregate purchase price for the Transaction is $1.42 billion, subject to customary working capital and other adjustments as set forth in the SPA. The acquisition will be consummated through Halcyon US Holdings Inc., a Delaware C-corporation formed on June 5, 2023, for the specific purpose of serving as the acquisition vehicle (EIN: 93-2841067; registered agent: National Registered Agents of Delaware, 160 Greentree Drive, Suite 101, Dover, DE 19904).

VPI's National Security Profile. VPI is a U.S. defense contractor that designs and manufactures advanced photonic integrated circuits, high-power laser diode arrays, and related optoelectronic components for U.S. government customers, including the Department of Defense and the intelligence community. VPI holds a Facility Security Clearance ("FCL") at the SECRET level, assigned CAGE Code 7VK92, under the oversight of the Defense Counterintelligence and Security Agency ("DCSA"). VPI maintains significant quantities of technical data controlled under the International Traffic in Arms Regulations ("ITAR," 22 C.F.R. Parts 120–130) and the Export Administration Regulations ("EAR," 15 C.F.R. Parts 730–774). Of VPI's total workforce of 486 employees, 212 employees hold active U.S. government security clearances at various levels, including SECRET and TOP SECRET/SCI. VPI's classified programs are performed at its Albuquerque fabrication facility within accredited secure compartmented areas.

Purpose of This Exhibit. In light of VPI's national security significance and the sensitivity of the information and systems maintained by VPI, this Supplemental Exhibit provides the Committee with a comprehensive overview of HSAG's existing enterprise cybersecurity program, including its governance structure, certifications, technical controls, data protection and privacy compliance framework, incident response capabilities, and personnel security practices. Of equal importance, this Exhibit details the planned post-closing IT system segregation measures that HSAG commits to implementing — and maintaining on an ongoing basis — to ensure the complete protection of VPI's classified information, ITAR/EAR-controlled technical data, Controlled Unclassified Information ("CUI"), and other sensitive unclassified information from unauthorized access by HSAG personnel, particularly non-U.S. persons. These segregation measures are designed to be consistent with and supportive of the anticipated National Security Agreement ("NSA") between the parties and the U.S. government.

HSAG respectfully submits that the information set forth in this Exhibit demonstrates both the maturity of HSAG's own cybersecurity program and the robustness of the segregation measures planned for VPI, and that these measures, taken together, adequately address the cybersecurity-related concerns identified in the Committee's First RFI.

II. HSAG ENTERPRISE CYBERSECURITY GOVERNANCE STRUCTURE

A. Board and Executive Oversight

HSAG recognizes that effective cybersecurity begins with governance at the highest levels of the organization. Accordingly, HSAG has established a multi-tiered governance framework that ensures cybersecurity risk is treated as a strategic enterprise risk, subject to direct oversight by HSAG's most senior leaders.

The HSAG Vorstand (Management Board), the executive management body of the company under German corporate law, maintains direct and active oversight of the company's cybersecurity posture through a dedicated Information Security Steering Committee (the "Steering Committee"). The Steering Committee was established in 2016 and meets on a quarterly basis, or more frequently as circumstances require. The Steering Committee's mandate includes reviewing and approving the company's information security strategy, evaluating cybersecurity risk assessments, reviewing significant incident reports, approving annual cybersecurity investment budgets, and ensuring alignment between the company's cybersecurity program and its overall business strategy and regulatory obligations. The Steering Committee is chaired by the Chief Information Security Officer and includes representatives from legal, compliance, operations, research and development, and finance.

Dr. Maximilian Ehrhardt, Chief Executive Officer and Chairman of the Vorstand, and Katarina Brückner, Chief Financial Officer and member of the Vorstand, receive formal quarterly cybersecurity risk briefings prepared by the Chief Information Security Officer. These briefings cover the current threat landscape as it pertains to HSAG's operations and the semiconductor industry generally, the status of key cybersecurity initiatives and investments, metrics related to vulnerability management, incident response, and security operations, and any material changes to HSAG's cybersecurity risk profile. In addition to these quarterly briefings, the CISO has a standing directive to brief the CEO and CFO immediately upon the identification of any cybersecurity incident classified as "Critical" or "High" severity under HSAG's incident classification framework.

Stefan Lohse, General Counsel of HSAG (LL.M., Georgetown University Law Center, 2003; admitted to practice in the State of New York and as Rechtsanwalt in the Federal Republic of Germany), oversees all legal compliance aspects of HSAG's cybersecurity program. Mr. Lohse's responsibilities in this regard include ensuring compliance with the European Union General Data Protection Regulation ("GDPR," Regulation (EU) 2016/679), the German Federal Data Protection Act (Bundesdatenschutzgesetz, "BDSG"), the German IT Security Act (IT-Sicherheitsgesetz 2.0), and all applicable cross-border data transfer obligations. Mr. Lohse also coordinates with outside counsel, including Calderwood & Harkness LLP, on cybersecurity-related legal matters arising in connection with HSAG's international operations and transactions, including the Transaction that is the subject of this CFIUS review.

At the supervisory level, the HSAG Aufsichtsrat (Supervisory Board) receives a comprehensive annual cybersecurity posture report, which is presented by the CISO in conjunction with the CEO. This report provides the Aufsichtsrat with a high-level overview of the company's cybersecurity program, including key risk indicators, the results of internal and external audits, notable incidents and their resolution, regulatory developments, and the adequacy of cybersecurity investments relative to the company's risk profile. The Aufsichtsrat's Audit Committee also reviews cybersecurity-related matters as part of its broader enterprise risk oversight mandate.

B. Chief Information Security Officer (CISO)

HSAG employs a dedicated Chief Information Security Officer who serves as the company's most senior executive responsible for the management and continuous improvement of the enterprise cybersecurity program. The CISO reports directly to the Vorstand, ensuring that cybersecurity leadership has unimpeded access to the company's most senior decision-makers and is not subordinated within the IT organization in a manner that could compromise the independence of the security function.

The CISO leads the global Information Security Division, which is responsible for all aspects of HSAG's cybersecurity program, including security architecture, security operations, incident response, vulnerability management, identity and access management, security awareness and training, third-party risk management, and cybersecurity compliance. The Information Security Division employs approximately 85 full-time cybersecurity professionals deployed across HSAG's global operations. These professionals are located at the following principal sites:

• HSAG Headquarters, Dresden, Germany: Approximately 45 cybersecurity professionals, including the CISO, the Security Operations Center (SOC) team, incident response team, security architecture, and governance, risk, and compliance (GRC) functions.

• European R&D and Manufacturing Facilities (Munich, Stuttgart, Grenoble, and Eindhoven): Approximately 18 cybersecurity professionals providing local security operations support and serving as regional information security liaisons.

• Asia-Pacific Operations (Tokyo, Seoul, and Hsinchu): Approximately 8 cybersecurity professionals supporting HSAG's Asia-Pacific design centers and supply chain operations.

• Halcyon US Inc., Austin, TX (11501 Alterra Parkway, Suite 300, Austin, TX 78758): Approximately 14 cybersecurity professionals supporting HSAG's existing U.S. design center operations.

A detailed organizational chart of the Information Security Division, depicting reporting lines, functional teams, and geographic distribution, is provided as Sub-Exhibit 4 to this Supplemental Exhibit. The organizational chart identifies key personnel by title and function but, in the interest of security, does not include the names of individual contributors below the director level.

C. Information Security Policies and Standards

HSAG maintains a comprehensive and formally documented Information Security Management System ("ISMS") that is aligned with internationally recognized information security standards and frameworks. The ISMS serves as the foundational framework for HSAG's cybersecurity program and provides the structure within which the company's information security policies, procedures, and controls are developed, implemented, maintained, and continuously improved.

The ISMS is governed by a suite of key policy documents that collectively define HSAG's information security requirements and expectations for all employees, contractors, and third parties with access to HSAG information assets. The principal policy documents include the following:

1. Information Security Policy: The overarching policy document that establishes HSAG's commitment to information security, defines the scope and objectives of the ISMS, and assigns roles and responsibilities for information security across the organization.

2. Acceptable Use Policy: Defines the permissible and prohibited uses of HSAG's information technology resources, including computing equipment, networks, email, internet access, and removable media.

3. Data Classification Policy: Establishes the framework for classifying information assets based on their sensitivity and the level of protection required. HSAG's current classification framework comprises four tiers: Public, Internal, Confidential, and Strictly Confidential.

4. Access Control Policy: Defines the requirements for controlling access to HSAG information systems and data, including authentication requirements, authorization principles, role-based access control, and the principles of least privilege and need-to-know.

5. Incident Response Policy: Establishes the framework for detecting, reporting, assessing, responding to, and recovering from cybersecurity incidents, and defines the roles and responsibilities of the Incident Response Team.

6. Business Continuity and Disaster Recovery Policy: Defines the requirements for maintaining business continuity and recovering critical IT systems and data in the event of a disruption, including natural disasters, cyberattacks, and infrastructure failures.

7. Third-Party Risk Management Policy: Establishes the requirements for assessing, managing, and monitoring the cybersecurity risks associated with third-party vendors, suppliers, and service providers that have access to HSAG information systems or data.

8. Cryptographic Standards Policy: Defines the approved cryptographic algorithms, key lengths, and key management practices for the protection of HSAG data at rest and in transit.

All policies within the ISMS are subject to a formal annual review and update cycle. The review process is led by the Information Security Division's Governance, Risk, and Compliance (GRC) team, with input from relevant stakeholders across the organization, including IT operations, legal, compliance, human resources, and business unit leadership. All policy revisions are approved by the CISO and the Information Security Steering Committee prior to promulgation. Material policy changes are reported to the Vorstand as part of the quarterly cybersecurity briefing.

III. ISO 27001 CERTIFICATION

A. Scope and Certification History

HSAG's commitment to information security is independently validated through its certification to ISO/IEC 27001:2013, the internationally recognized standard for Information Security Management Systems. HSAG first achieved ISO 27001 certification in 2017, following a comprehensive implementation effort that began in 2015. Since initial certification, HSAG has maintained continuous ISO 27001 certification without lapse.

The scope of HSAG's ISO 27001 certification encompasses the following operations and facilities:

• HSAG corporate headquarters and primary operations, Industriestraße 44, 01099 Dresden, Saxony, Germany;

• All European research and development facilities, including locations in Munich, Stuttgart, Grenoble, and Eindhoven;

• All European manufacturing facilities, including the high-volume SiC fabrication facility in Dresden and the GaN epitaxy facility in Stuttgart;

• The Halcyon US Inc. design center at 11501 Alterra Parkway, Suite 300, Austin, TX 78758.

The current ISO 27001 certificate was issued following the most recent triennial re-certification audit, which was conducted in the fourth quarter of 2022. The certifying body is Quill Tanaka CPAs LLP, an independent, internationally accredited certification body headquartered in Munich, Germany, and accredited by the Deutsche Akkreditierungsstelle (DAkkS). A copy of the current ISO 27001 certificate is provided as Sub-Exhibit 1 to this Supplemental Exhibit.

HSAG is actively engaged in transition planning for the revised ISO/IEC 27001:2022 standard, which was published in October 2022. HSAG's transition plan calls for gap analysis completion by the end of Q4 2023, implementation of required changes to the ISMS throughout the first half of 2024, and formal transition audit by Aoki Reyes CPAs LLP in Q3 2024, well in advance of the October 2025 transition deadline established by the International Accreditation Forum (IAF).

B. Continuous Improvement and Surveillance Audits

In accordance with the ISO 27001 certification lifecycle, HSAG undergoes annual surveillance audits conducted by Aoki Reyes CPAs LLP. These surveillance audits verify the ongoing effectiveness and conformity of HSAG's ISMS with the requirements of the standard and assess whether the ISMS continues to be adequately maintained and improved over time.

In addition to external surveillance audits, HSAG conducts semi-annual internal audits of the ISMS through its Internal Audit function, which operates with functional independence from the Information Security Division. The internal audit program is designed to provide reasonable assurance that the ISMS controls are operating effectively and that policies and procedures are being followed consistently across all HSAG operations within the certification scope.

The most recent external surveillance audit was completed in March 2023. The audit results were favorable: no major nonconformities were identified. A limited number of minor observations were noted, relating to documentation updates for two specific operational procedures and enhanced logging for a subset of privileged access activities. All minor observations were addressed within the prescribed remediation timelines, and corrective actions were verified by the internal audit team. HSAG maintains a formal corrective action and continuous improvement process, documented in the ISMS procedures, which ensures that all audit findings — whether from external, internal, or self-assessment activities — are tracked, remediated, validated, and incorporated into the ISMS as lessons learned.

C. Integration with Other Frameworks

HSAG's ISMS is not implemented in isolation but is deliberately designed to integrate with and cross-reference multiple complementary information security frameworks. This cross-mapping approach enables HSAG to maintain a unified and comprehensive control environment that addresses the requirements of multiple standards and regulatory frameworks simultaneously, thereby reducing duplication of effort and ensuring comprehensive coverage. Specifically, HSAG's ISMS is cross-mapped to the following frameworks:

• ISO/IEC 27002:2022 — Provides detailed guidance on the implementation of information security controls referenced in Annex A of ISO 27001;

• ISO/IEC 27017:2015 — Provides guidance on information security controls applicable to the provision and use of cloud services;

• ISO/IEC 27018:2019 — Establishes controls for the protection of personally identifiable information (PII) in public cloud computing environments;

• BSI IT-Grundschutz Compendium — The comprehensive information security framework published by the German Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, "BSI"), which is widely adopted in Germany as a baseline for information security management, particularly for organizations operating critical infrastructure.

HSAG acknowledges that VPI's cybersecurity requirements under the anticipated National Security Agreement will need to align with the National Institute of Standards and Technology Special Publication 800-171 ("NIST SP 800-171"), which establishes security requirements for protecting Controlled Unclassified Information (CUI) in nonfederal systems and networks. While HSAG's existing ISO 27001 framework provides a strong baseline that overlaps significantly with many NIST SP 800-171 control families — including access control, awareness and training, audit and accountability, identification and authentication, incident response, and system and communications protection — HSAG recognizes that the ISO 27001 framework is not a direct substitute for NIST SP 800-171 compliance, and that certain NIST-specific controls, particularly those related to CUI marking, dissemination controls, and U.S. government-specific incident reporting requirements, will require supplementation within VPI's post-closing cybersecurity compliance framework. The planned approach to VPI's NIST SP 800-171 compliance is addressed in Section VII.E of this Exhibit.

IV. TECHNICAL CYBERSECURITY CONTROLS

A. Network Security Architecture

HSAG has implemented a multi-layered, defense-in-depth network security architecture across all of its global facilities. This architecture is designed to provide multiple, overlapping layers of protection so that the compromise of any single control does not result in a complete security failure. The defense-in-depth approach reflects industry best practices and is consistent with the security architecture principles set forth in ISO 27001, the BSI IT-Grundschutz Compendium, and NIST SP 800-53.

The principal components of HSAG's network security architecture include the following:

Network Segmentation. HSAG's enterprise network is segmented into distinct security zones using virtual local area networks (VLANs), next-generation firewalls, and access control lists (ACLs) applied at the network switching and routing layers. Network segmentation is implemented based on the sensitivity of the data processed within each zone and the trust level of the users and systems within the zone. Critical zones — including R&D networks, manufacturing control systems, and financial systems — are isolated from general-purpose corporate network segments and from guest or visitor networks. Inter-zone traffic is controlled by firewall policies that enforce the principle of least privilege, permitting only those communications that are specifically authorized and necessary for business operations.

Intrusion Detection and Prevention Systems (IDS/IPS). HSAG deploys network-based intrusion detection and prevention systems at key network boundaries and within critical network segments. These systems are configured to detect and, where appropriate, automatically block known attack signatures, anomalous network behavior, and indicators of compromise. IDS/IPS signatures and rulesets are updated continuously and are supplemented by threat intelligence feeds from commercial providers and industry information-sharing organizations, including the Semiconductor Industry Cybersecurity Consortium (SICC).

Demilitarized Zones (DMZs). All external-facing services, including web servers, application interfaces, and email gateways, are deployed within architecturally defined DMZs that are separated from the internal corporate network by multiple layers of firewalls. This architecture ensures that a compromise of an external-facing service does not provide an attacker with direct access to internal networks or sensitive data stores.

Encrypted Inter-Site Communications. All communications between HSAG facilities — including connections between HSAG headquarters in Dresden and remote facilities in Europe, Asia, and the United States — are encrypted using site-to-site VPN tunnels employing IPsec with AES-256 encryption. HSAG does not transmit sensitive data between facilities over unencrypted channels.

Security Operations Center (SOC). HSAG operates a dedicated Security Operations Center from its headquarters in Dresden, Germany. The SOC operates on a 24/7/365 basis and is staffed by trained security analysts who continuously monitor HSAG's global network infrastructure for security events, anomalies, and potential threats. The SOC utilizes a Security Information and Event Management (SIEM) platform that aggregates and correlates log data from across the enterprise, enabling rapid detection and investigation of potential security incidents. The SOC serves as the primary coordination point for all security monitoring, threat detection, and initial incident response activities.

B. Endpoint and Device Security

HSAG recognizes that endpoints — including workstations, laptops, mobile devices, and servers — represent a significant attack surface and a common vector for initial compromise. Accordingly, HSAG has implemented a comprehensive endpoint security program that encompasses the following controls:

Endpoint Detection and Response (EDR). HSAG has deployed a centralized EDR solution across all HSAG-managed devices globally. The EDR platform provides real-time monitoring of endpoint activity, automated detection of suspicious behaviors and known malware signatures, containment capabilities to isolate compromised endpoints, and forensic investigation tools to support incident analysis. The EDR solution is managed centrally by the SOC team in Dresden and is configured to generate alerts that are triaged by SOC analysts in real time.

Mobile Device Management (MDM). All corporate mobile devices, including smartphones and tablets issued to HSAG employees, are enrolled in HSAG's MDM platform. The MDM solution enforces security policies on mobile devices, including mandatory device encryption, passcode requirements, remote wipe capabilities, application whitelisting, and restrictions on the installation of unapproved applications. Personally owned devices that are used to access HSAG enterprise resources are subject to a Bring Your Own Device (BYOD) policy that requires enrollment in the MDM platform and compliance with baseline security requirements.

Hardware Inventory and Asset Management. HSAG maintains a comprehensive hardware asset inventory that tracks all computing devices across the enterprise. The inventory is maintained through an automated asset discovery and management system that continuously scans the network to identify connected devices, assess their configuration compliance, and flag unauthorized or unmanaged devices. This system provides the Information Security Division with real-time visibility into the device landscape and enables rapid identification of devices that fall out of compliance with HSAG's security baselines.

Secure Configuration Baselines. HSAG maintains documented secure configuration baselines for all device types deployed within its environment, including Windows workstations, Linux servers, macOS devices, network equipment, and mobile devices. These baselines are derived from industry-recognized hardening guides, including the Center for Internet Security (CIS) Benchmarks, and are customized to reflect HSAG's specific risk profile and operational requirements. Compliance with secure configuration baselines is monitored continuously through automated scanning, and deviations are flagged for remediation.

C. Identity and Access Management (IAM)

Effective identity and access management is fundamental to HSAG's cybersecurity strategy. HSAG has implemented an enterprise-wide IAM program that ensures that access to information systems and data is granted only to authorized individuals, based on their verified identity and their demonstrated need to access specific resources in the course of their job responsibilities.

Enterprise IAM Platform. HSAG operates a centralized IAM platform that serves as the authoritative source for user identity management, authentication, and authorization across the enterprise. The IAM platform integrates with HSAG's Active Directory environment, enterprise applications, cloud services, and physical access control systems to provide a unified view of user identities and access rights.

Multi-Factor Authentication (MFA). Multi-factor authentication is required for all users accessing HSAG enterprise systems, without exception. MFA is enforced for all authentication scenarios, including local workstation login, VPN access, email access, access to enterprise applications, and access to cloud-hosted services. HSAG's MFA implementation supports multiple second-factor mechanisms, including hardware security keys (FIDO2-compliant), time-based one-time passwords (TOTP), and push-based authentication through a corporate authentication application. SMS-based one-time passwords are not permitted as a second factor due to known vulnerabilities in the SMS channel.

Role-Based Access Control (RBAC). Access to enterprise applications and systems is governed by a role-based access control model. Access rights are assigned to defined roles rather than to individual users, and users are granted roles based on their job function and organizational position. The RBAC model is designed to enforce the principles of least privilege and separation of duties, ensuring that users have access only to the specific systems and data necessary to perform their assigned responsibilities and that no single user has the ability to perform conflicting or high-risk actions without appropriate oversight.

Privileged Access Management (PAM). HSAG deploys a dedicated privileged access management solution for all administrative and elevated-privilege accounts. The PAM solution provides secure vaulting of administrative credentials, just-in-time (JIT) access provisioning for privileged sessions (ensuring that administrative access is granted only for the duration necessary to perform a specific task), mandatory session recording for all privileged sessions, and real-time monitoring and alerting on privileged account activity. PAM controls are applied to all categories of privileged accounts, including domain administrator accounts, database administrator accounts, network device administrator accounts, and application-level service accounts with elevated permissions.

Quarterly Access Reviews. HSAG conducts formal quarterly access reviews and certifications for all critical systems and applications. During these reviews, system owners and managers are required to review and certify the access rights of all users with access to their systems, confirm that access rights remain appropriate and consistent with job responsibilities, and identify and remediate any instances of excessive, inappropriate, or orphaned access. The results of quarterly access reviews are documented and reported to the Information Security Steering Committee.

D. Data Protection and Encryption

HSAG employs robust technical controls to protect the confidentiality and integrity of sensitive data throughout its lifecycle, including data at rest, data in transit, and data in use.

Data-at-Rest Encryption. All sensitive data stores within HSAG's environment are protected by encryption at rest using the Advanced Encryption Standard with 256-bit keys (AES-256). This encryption is applied to databases, file servers, backup media, and endpoint storage volumes (full-disk encryption). Encryption key management is performed in accordance with HSAG's Cryptographic Standards Policy, which mandates secure key generation, storage, rotation, and destruction procedures.

Data-in-Transit Encryption. All internal and external communications carrying sensitive data are encrypted in transit using Transport Layer Security version 1.3 (TLS 1.3) or, for site-to-site VPN connections, IPsec with AES-256 encryption. Older and deprecated cryptographic protocols, including SSL, TLS 1.0, and TLS 1.1, are disabled across the HSAG environment.

Data Loss Prevention (DLP). HSAG deploys DLP solutions at both network boundaries and on individual endpoints to detect and prevent the unauthorized transmission or exfiltration of sensitive data. DLP policies are configured to identify and block the transmission of data classified as "Confidential" or "Strictly Confidential" through unauthorized channels, including personal email, unapproved cloud storage services, removable media (where not specifically authorized), and file-sharing applications. DLP events are logged, reviewed by the SOC, and escalated as potential security incidents when appropriate.

Data Classification Framework. HSAG operates a formal data classification framework with four tiers:

• Public: Information that is intended for public dissemination and presents no risk to HSAG if disclosed.

• Internal: Information that is intended for use within HSAG and is not authorized for public release, but whose disclosure would not cause material harm to the company.

• Confidential: Information whose unauthorized disclosure could cause material harm to HSAG, its employees, its customers, or its business partners.

• Strictly Confidential: Information of the highest sensitivity, whose unauthorized disclosure could cause severe harm to HSAG or its stakeholders, including trade secrets, strategic plans, and information subject to legal privilege.

HSAG acknowledges that its existing data classification framework does not currently encompass U.S. government classification markings, including Controlled Unclassified Information (CUI) markings under 32 C.F.R. Part 2002 or national security classification markings (e.g., CONFIDENTIAL, SECRET, TOP SECRET) under Executive Order 13526. This is appropriate because HSAG's existing systems do not process U.S. government classified or CUI-marked information. The post-closing VPI IT segregation plan described in Section VII of this Exhibit ensures that VPI will continue to manage U.S. government classified and CUI data within its own independent systems, utilizing its own classification and marking procedures consistent with NISPOM, NIST SP 800-171, and applicable contract requirements.

E. Vulnerability Management

HSAG maintains a rigorous vulnerability management program designed to identify, assess, prioritize, and remediate security vulnerabilities across the enterprise in a timely manner.

Continuous Vulnerability Scanning. HSAG conducts continuous vulnerability scanning of all internal and external-facing systems using commercial vulnerability scanning platforms. Scans are performed on a continuous, automated basis for the enterprise perimeter and on a weekly basis for internal systems. Newly identified vulnerabilities are automatically correlated with HSAG's asset inventory to determine the scope of exposure and are assigned risk scores based on the Common Vulnerability Scoring System (CVSS) and contextual factors specific to HSAG's environment.

Patch Management. HSAG operates a formal patch management process that is integrated with its vulnerability management program. Patches are prioritized based on risk, and defined service level agreements (SLAs) govern the maximum acceptable time to remediate vulnerabilities of each severity level:

• Critical vulnerabilities (CVSS 9.0–10.0): Patched within 48 hours of patch availability.

• High vulnerabilities (CVSS 7.0–8.9): Patched within 7 calendar days of patch availability.

• Medium vulnerabilities (CVSS 4.0–6.9): Patched within 30 calendar days of patch availability.

• Low vulnerabilities (CVSS 0.1–3.9): Patched within 30 calendar days of patch availability, or accepted as residual risk with documented risk acceptance by the appropriate system owner.

Patch compliance is monitored through automated reporting, and exceptions to the patch SLAs require documented risk acceptance approved by the CISO or a designated delegate.

Third-Party Penetration Testing. HSAG engages independent, third-party security firms to conduct annual penetration testing of its enterprise systems and network infrastructure. Penetration testing engagements include both external testing (simulating an attacker attempting to breach HSAG's perimeter defenses) and internal testing (simulating an insider threat or a compromised internal account). Penetration testing reports are reviewed by the CISO, and remediation of identified findings is tracked through the corrective action process.

Bug Bounty Program. HSAG operates a managed bug bounty program for its external-facing web applications and services. The program invites qualified, vetted external security researchers to identify and responsibly disclose vulnerabilities in HSAG's public-facing digital assets. Valid vulnerability submissions are rewarded financially based on severity, and identified vulnerabilities are remediated through the standard vulnerability management process.

F. Cloud Security

HSAG utilizes cloud infrastructure for certain enterprise functions, including collaboration tools, human resources management, and select enterprise resource planning (ERP) modules. All cloud infrastructure utilized by HSAG is hosted within European Union-based data centers, consistent with HSAG's data residency requirements and its obligations under the GDPR.

HSAG has deployed cloud security posture management (CSPM) tools to continuously monitor the configuration and security posture of its cloud environments. CSPM tools are configured to detect misconfigurations, overly permissive access controls, unencrypted data stores, and other security gaps that could expose HSAG data to unauthorized access or disclosure.

All cloud deployments within HSAG's environment are subject to the HSAG Cloud Security Policy, which establishes mandatory requirements for encryption of data at rest and in transit within cloud environments, access controls and identity management for cloud services, data residency restrictions prohibiting the storage of HSAG data outside approved geographic regions, logging and monitoring of cloud service activity, and vendor security assessments prior to the adoption of new cloud services.

Note regarding VPI: Following the closing of the Transaction, VPI's information technology systems and data will NOT be migrated to, hosted on, or integrated with any HSAG cloud infrastructure, tenancies, or subscriptions. This commitment is a foundational element of the post-closing IT segregation plan described in Section VII of this Exhibit.

V. DATA PROTECTION AND PRIVACY COMPLIANCE

A. EU General Data Protection Regulation (GDPR)

As a company headquartered in the European Union and conducting substantial business operations within the EU and the European Economic Area (EEA), HSAG is subject to, and maintains full compliance with, the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR"). HSAG treats data protection and privacy as fundamental components of its overall information security program, and its data protection compliance framework is closely integrated with the ISMS described in Sections II and III above.

HSAG has designated a Data Protection Officer ("DPO") in accordance with Article 37 of the GDPR. The DPO is registered with the Sächsischer Datenschutzbeauftragter (Saxon Data Protection Authority), which serves as HSAG's lead supervisory authority under the GDPR's one-stop-shop mechanism. The DPO operates with functional independence from the business units whose processing activities the DPO oversees, reports directly to the Vorstand on data protection matters, and has access to all information necessary to fulfill the DPO's responsibilities under the GDPR.

HSAG maintains comprehensive Records of Processing Activities in accordance with Article 30 of the GDPR. These records document the purposes of processing, the categories of personal data processed, the categories of data subjects, the recipients of personal data (including any transfers to third countries), the applicable legal bases for processing, and the applicable data retention periods for each category of processing activity.

Data Protection Impact Assessments ("DPIAs") are conducted in accordance with Article 35 of the GDPR for all processing activities that are likely to result in a high risk to the rights and freedoms of natural persons. DPIAs are conducted prior to the commencement of high-risk processing and are reviewed and updated as processing activities evolve. DPIAs are reviewed by the DPO before processing begins.

For transfers of personal data outside the EEA, HSAG relies on the Standard Contractual Clauses ("SCCs") adopted by the European Commission (Commission Implementing Decision (EU) 2021/914 of 4 June 2021) as the primary legal mechanism for ensuring adequate protection of personal data in the recipient country. HSAG conducts Transfer Impact Assessments in accordance with the guidance of the European Data Protection Board to evaluate the legal framework of the recipient country and to determine whether supplementary measures are necessary to ensure the effectiveness of the SCCs.

B. German Federal Data Protection Act (BDSG)

In addition to GDPR compliance, HSAG maintains supplemental compliance with the Bundesdatenschutzgesetz ("BDSG"), the German Federal Data Protection Act, as applicable to HSAG's operations within the Federal Republic of Germany. The BDSG supplements and, in certain areas, particularizes the requirements of the GDPR as permitted by the GDPR's opening clauses.

Of particular relevance, HSAG has established comprehensive employee data protection protocols that comply with Section 26 of the BDSG, which governs the processing of employees' personal data in the employment context. HSAG has also entered into formal agreements with its works councils (Betriebsräte) at applicable German facilities regarding the use of information technology for employee monitoring purposes, consistent with the requirements of the Betriebsverfassungsgesetz (Works Constitution Act). These works council agreements define the scope and limitations of IT-based employee monitoring activities, including email monitoring, internet usage logging, and workplace surveillance, and establish safeguards to protect employee privacy while permitting HSAG to maintain effective cybersecurity controls.

C. U.S. Data Protection Considerations

HSAG's existing U.S. subsidiary, Halcyon US Inc. (Austin, TX), complies with all applicable U.S. federal and state data protection and privacy laws, including the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), and other state privacy laws applicable to the company's operations.

Following the closing of the Transaction, VPI will maintain its own independent data protection practices consistent with applicable U.S. federal and state requirements, including protections for employee personally identifiable information ("PII"), customer data, and information subject to government contract data protection requirements (e.g., DFARS 252.204-7012). VPI's data protection practices will not be subordinated to or integrated with HSAG's GDPR-based data protection framework, and VPI will not be treated as a "processor" or "sub-processor" of HSAG under the GDPR.

Critically, no transfer of VPI employee PII or customer data to HSAG systems in Germany or elsewhere outside the United States will occur without an appropriate legal basis under applicable U.S. law and, where required by the anticipated National Security Agreement or applicable export control regulations, prior authorization from the U.S. government. HSAG recognizes that certain categories of VPI data, including data relating to cleared employees, classified programs, and ITAR/EAR-controlled technical data, are subject to absolute restrictions on transfer outside the United States, and HSAG commits to complying fully with these restrictions.

VI. INCIDENT RESPONSE AND BUSINESS CONTINUITY

A. Cybersecurity Incident Response Plan (CSIRP)

HSAG maintains a formal Cybersecurity Incident Response Plan ("CSIRP") that defines the processes, procedures, roles, responsibilities, escalation pathways, and communication protocols for responding to cybersecurity incidents across the enterprise. The CSIRP is designed to enable HSAG to detect, contain, eradicate, and recover from cybersecurity incidents in a timely and effective manner while minimizing the impact on HSAG's operations, customers, and stakeholders. A summary version of the CSIRP is provided as Sub-Exhibit 3 to this Supplemental Exhibit (certain operational details have been redacted to protect the security of HSAG's incident response capabilities).

Incident Severity Classification. HSAG classifies cybersecurity incidents into four severity tiers, each with defined response requirements:

• Critical: Incidents that involve or are likely to involve a confirmed breach of highly sensitive data (e.g., Strictly Confidential data, trade secrets, or personal data on a large scale), a confirmed compromise of critical infrastructure or manufacturing control systems, or a significant and ongoing threat to the availability of essential business services. Critical incidents require immediate activation of the full Incident Response Team and notification of the Vorstand.

• High: Incidents that involve a confirmed compromise of enterprise systems with potential for significant data exposure or operational impact, but that do not meet the threshold for Critical classification. High incidents require activation of the IRT and notification of the CISO within one hour.

• Medium: Incidents involving localized compromise or security events with limited scope and contained impact, such as isolated malware infections on individual endpoints that are detected and contained by automated controls.

• Low: Security events that are suspicious but do not involve a confirmed compromise, such as unsuccessful phishing attempts, blocked intrusion attempts, or policy violations with no security impact.

Incident Response Team (IRT). The IRT is a cross-functional team that is activated in response to incidents classified as Critical or High severity. The IRT is composed of the CISO (serving as the IRT lead), SOC leadership and senior analysts, IT operations representatives, General Counsel and legal team, corporate communications, and relevant business unit representatives. For incidents affecting specific facilities or regions, local IT and security personnel are integrated into the IRT as needed.

Response Time Targets. HSAG has established the following response time targets for its incident response activities:

• Mean Time to Detect (MTTD): Less than 4 hours for Critical-severity incidents, measured from the time the initial indicator of compromise is generated to the time the SOC confirms the incident.

• Mean Time to Respond (MTTR): Less than 1 hour for Critical-severity incidents after detection, measured from the time the incident is confirmed to the time the initial containment actions are initiated.

HSAG monitors and reports on actual MTTD and MTTR metrics as part of its quarterly cybersecurity briefings to the Vorstand, and continuously works to improve these metrics through process refinement, automation, and investment in advanced detection capabilities.

Exercises and Testing. HSAG conducts semi-annual tabletop exercises involving the IRT and senior leadership, during which participants walk through realistic incident scenarios to test decision-making, communication, and escalation processes. In addition, HSAG conducts a full simulation exercise annually, which tests the end-to-end incident response process, including detection, containment, eradication, recovery, and post-incident review, in a realistic environment using simulated threats. These exercises are planned and facilitated by the Information Security Division's GRC team, and the results are documented and used to inform improvements to the CSIRP.

Post-Incident Review. Following the resolution of all incidents classified as High or Critical severity, HSAG conducts a formal post-incident review and lessons-learned process. The post-incident review documents the timeline of the incident, the effectiveness of detection and response actions, root cause analysis, the impact of the incident, and recommendations for process, technology, or personnel improvements to prevent recurrence. Lessons learned are incorporated into the CSIRP and communicated to relevant stakeholders across the organization.

B. Incident Reporting

Internal Reporting. All HSAG employees are trained to recognize and report suspected cybersecurity incidents immediately through dedicated reporting channels. These channels include a 24/7 security hotline operated by the SOC, a dedicated email address for security incident reports, and an integrated reporting button within the corporate email client for reporting suspected phishing emails. Security awareness training, which is mandatory for all employees upon hiring and annually thereafter, includes instruction on incident recognition and reporting procedures.

External Reporting. HSAG reports cybersecurity incidents to relevant governmental authorities as required by applicable law and regulation. In particular, HSAG is subject to incident reporting obligations under the German IT Security Act (IT-Sicherheitsgesetz 2.0), which requires operators of critical infrastructure to report significant cybersecurity incidents to the BSI (Bundesamt für Sicherheit in der Informationstechnik, German Federal Office for Information Security) without undue delay and in any event within 24 hours of detection. HSAG is also subject to the GDPR's data breach notification requirements under Article 33 (notification to the supervisory authority within 72 hours) and Article 34 (communication to affected data subjects where the breach is likely to result in a high risk to their rights and freedoms).

Post-Closing VPI Incident Reporting. Following the closing of the Transaction, cybersecurity incidents affecting VPI systems will be reported in accordance with VPI's own incident response procedures, which will be maintained independently of HSAG's CSIRP. Consistent with the anticipated NSA requirements and DFARS 252.204-7012, VPI will report cybersecurity incidents to DCSA within 72 hours of detection. VPI's incident reporting obligations to DCSA and other U.S. government agencies will be managed by VPI's own cybersecurity and security personnel under the oversight of the Facility Security Officer, and HSAG will not interfere with, delay, or otherwise impede VPI's compliance with these reporting obligations. The details of VPI's post-closing incident response framework are further addressed in Section VII.E of this Exhibit.

C. Business Continuity and Disaster Recovery (BC/DR)

HSAG maintains comprehensive Business Continuity Plans ("BCPs") for all critical business functions, including manufacturing operations, research and development, supply chain management, customer support, and corporate services. The BCPs define the processes and procedures for maintaining or rapidly restoring critical business functions in the event of a disruption, whether caused by natural disaster, cyberattack, infrastructure failure, pandemic, or other unforeseen event.

HSAG also maintains Disaster Recovery Plans ("DRPs") for critical IT systems and infrastructure. The DRPs define the following recovery objectives for each critical system:

• Recovery Time Objectives (RTOs): The maximum acceptable duration of time that a critical system may be unavailable before the impact on business operations becomes unacceptable. RTOs range from 4 hours for the most critical systems (e.g., manufacturing execution systems, SOC infrastructure) to 24 hours for less time-sensitive systems.

• Recovery Point Objectives (RPOs): The maximum acceptable amount of data loss measured in time, representing the point in time to which data must be recoverable. RPOs range from near-zero (for systems with real-time replication) to 4 hours for systems with regular backup intervals.

HSAG maintains geographically distributed backup and recovery infrastructure within Germany, including a primary backup data center in Leipzig and secondary backup capabilities at the Stuttgart facility. Backup data is encrypted and replicated between these locations in accordance with HSAG's data protection and encryption standards.

Annual BCP/DRP Testing and Validation. HSAG conducts annual testing of its BCPs and DRPs to validate their effectiveness and to identify areas for improvement. Testing includes tabletop exercises, partial failover tests for critical IT systems, and, on a rotating basis, full failover simulations for selected critical systems. Test results are documented, and identified deficiencies are remediated through the corrective action process.

VII. PLANNED POST-CLOSING VPI IT SYSTEM SEGREGATION

A. Segregation Principles and Objectives

HSAG recognizes that the protection of VPI's classified information, Controlled Unclassified Information (CUI), ITAR/EAR-controlled technical data, and other sensitive unclassified information is of paramount importance to the U.S. government and is essential to the successful completion and ongoing implementation of the anticipated National Security Agreement. Accordingly, HSAG commits to maintaining complete physical and logical separation of VPI's information technology systems from the HSAG global network and enterprise IT infrastructure following the closing of the Transaction. This commitment is unconditional and will be maintained for so long as VPI remains under HSAG ownership or as otherwise required by the NSA.

The specific objectives of the post-closing IT segregation are as follows:

1. Protect classified and Controlled Unclassified Information (CUI) within VPI systems from unauthorized access, disclosure, or exfiltration, consistent with the requirements of the National Industrial Security Program Operating Manual ("NISPOM," 32 C.F.R. Part 117), NIST SP 800-171, and applicable contract security requirements;

2. Prevent unauthorized access by non-U.S. persons — including HSAG personnel located in Germany, other European countries, Asia, or any non-U.S. location — to ITAR-controlled technical data (22 C.F.R. Parts 120–130) and EAR-controlled technical data (15 C.F.R. Parts 730–774) maintained within VPI systems, consistent with U.S. export control requirements;

3. Comply with all requirements of the anticipated National Security Agreement, including provisions related to IT segregation, a Technology Control Plan ("TCP"), Government Security Committee oversight, and NIST SP 800-171 compliance; and

4. Maintain VPI's Facility Security Clearance at the SECRET level (CAGE Code: 7VK92) under the oversight of the Defense Counterintelligence and Security Agency (DCSA), and ensure that VPI's classified processing capabilities at the Albuquerque facility remain fully operational and compliant with NISPOM requirements.

The segregation measures described in this Section VII apply to all VPI locations, including:

• VPI corporate headquarters at 7400 Ridgeline Parkway, Colorado Springs, CO 80919; and

• VPI fabrication facility at 9200 Innovation Boulevard, Albuquerque, NM 87113.

B. Network Segregation

VPI will maintain its own independent and entirely separate network infrastructure following the closing of the Transaction. Specifically:

• VPI will maintain its own dedicated internet service connections, procured from U.S.-based internet service providers, at both its Colorado Springs headquarters and its Albuquerque fabrication facility. These internet connections will be entirely separate from any HSAG internet connections, including those used by Halcyon US Inc. in Austin, Texas.

• VPI will operate its own firewalls, routers, switches, and wireless access points, which will be managed exclusively by VPI IT personnel. No HSAG-owned or HSAG-managed network equipment will be deployed at VPI facilities.

• No network interconnection of any kind will exist between VPI IT systems and the HSAG global network, including the Halcyon US Inc. network in Austin, TX. This prohibition encompasses, without limitation, direct network connections, shared VPN tunnels, MPLS circuits, SD-WAN connections, peering arrangements, and any other form of network interconnection that would permit data to flow between VPI systems and HSAG systems.

• VPI will operate its own independent email system, collaboration tools, and file storage systems. VPI employees will not be granted access to HSAG email, collaboration platforms (e.g., Northgate Data Systems, Aldermere Systems), or file storage systems, and HSAG employees will not be granted access to VPI's equivalent systems.

• Any future business communication between VPI unclassified business functions and HSAG that is necessary for legitimate parent-company oversight purposes (e.g., financial reporting, strategic planning at a high level) will occur through approved, monitored communication channels that are specifically designed to prevent the transfer of controlled technical data. These channels will be defined in the Technology Control Plan and will be subject to Government Security Committee oversight. Approved channels may include, for example, a limited number of designated email accounts used exclusively for non-controlled business communications, with DLP controls configured to detect and block the transmission of controlled technical data.

C. No Shared Cloud Infrastructure

The prohibition on integration between VPI and HSAG IT systems extends fully to cloud infrastructure:

• VPI will not use any HSAG cloud tenancies, subscriptions, accounts, or cloud-hosted services, whether provided by HSAG directly or procured by HSAG from third-party cloud service providers.

• VPI will maintain its own cloud infrastructure, to the extent VPI utilizes cloud services, hosted exclusively within U.S.-based data centers operated by U.S.-based cloud service providers. No VPI data will be replicated to, backed up to, or otherwise stored in any data center located outside the United States.

• HSAG enterprise cloud services — including HSAG's ERP system, human resources information system (HRIS), and other enterprise-wide platforms — will not be extended to VPI without prior review and approval by the Government Security Committee ("GSC"). As of the date of this Exhibit, HSAG does not plan to extend any enterprise cloud services to VPI, and any future proposal to do so would be subject to the GSC's review to ensure that the proposed extension does not create unaut

CONFIDENTIAL TREATMENT REQUESTED — CONTAINS CONFIDENTIAL BUSINESS INFORMATION EXEMPT FROM PUBLIC DISCLOSURE UNDER 50 U.S.C. § 4565(c)
SUPPLEMENTAL EXHIBIT TO FIRST RFI RESPONSE
HALCYON SEMICONDUCTOR AG ENTERPRISE CYBERSECURITY PROGRAM OVERVIEW
CFIUS Case No. CFIUS-023-07-3841
August 18, 2023
Submitted by:
Calderwood & Harkness LLP 1750 K Street NW, Suite 800 Washington, DC 20006
On behalf of Halcyon Semiconductor Aktiengesellschaft ("HSAG")
Prepared for:
Committee on Foreign Investment in the United States U.S. Department of the Treasury Office of Investment Security 1500 Pennsylvania Avenue NW Washington, DC 20220
Counsel of Record:
Margaret "Peggy" Ashworth, Of Counsel — National Security & CFIUS Practice
Lt. Col. (Ret.) David Caruso, Senior Counsel — Government Contracts & Export Controls Practice
Priya Venkataraman, Associate — International Trade & Sanctions Practice
Designation: This document contains Confidential Business Information within the meaning of 50 U.S.C. § 4565(c) and the regulations promulgated thereunder at 31 C.F.R. Part 800. This document is submitted solely for use by the Committee on Foreign Investment in the United States and its member agencies in connection with their review of the referenced transaction. This document is exempt from public disclosure and may not be released, in whole or in part, without the prior written consent of the parties to the transaction.
Right-click to update Table of Contents
I. INTRODUCTION AND PURPOSE
This Supplemental Exhibit is submitted on behalf of Halcyon Semiconductor Aktiengesellschaft ("HSAG") in response to the Committee on Foreign Investment in the United States ("CFIUS" or the "Committee") first Request for Information ("RFI") dated August 4, 2023, received by counsel for HSAG on August 7, 2023, in connection with the Committee's review of CFIUS Case No. CFIUS-023-07-3841. HSAG submits this Supplemental Exhibit through its counsel of record, Calderwood & Harkness LLP, in a good-faith effort to provide the Committee with comprehensive, transparent, and detailed information responsive to the RFI's inquiries.
Specifically, this Supplemental Exhibit addresses the questions and information requests set forth in the First RFI concerning: (a) HSAG's enterprise cybersecurity practices and governance structure; (b) HSAG's information security governance and organizational framework; (c) HSAG's data protection and privacy compliance framework, including cross-border data transfer mechanisms; and (d) the planned measures HSAG will implement to maintain the security and integrity of Marlowe Asset Management Photonics Inc. ("VPI") information technology systems and data following the closing of the proposed acquisition (the "Transaction").
Background on HSAG. Halcyon Semiconductor Aktiengesellschaft is a semiconductor design and manufacturing company headquartered at Industriestraße 44, 01099 Dresden, Saxony, Federal Republic of Germany. HSAG is publicly traded on the Frankfurt Stock Exchange under the ticker symbol XETRA: HLC. As of June 1, 2023, HSAG's market capitalization was approximately €14.8 billion. HSAG reported revenues of approximately €6.12 billion for fiscal year 2022. HSAG's operations span multiple countries, including Germany, the broader European Union, the United Kingdom, Japan, South Korea, Taiwan, and the United States, where HSAG operates through its existing wholly owned subsidiary, Halcyon US Inc., located at 11501 Alterra Parkway, Suite 300, Austin, TX 78758. HSAG specializes in advanced compound semiconductor design and fabrication, with particular expertise in silicon carbide (SiC) and gallium nitride (GaN) power and radio-frequency devices for automotive, industrial, telecommunications, and defense end markets.
The Transaction. On June 10, 2023, HSAG entered into a Stock Purchase Agreement (the "SPA") to acquire 100% of the outstanding equity interests of Marlowe Asset Management Photonics Inc. ("VPI"), a Delaware corporation headquartered at 7400 Ridgeline Parkway, Colorado Springs, CO 80919, with a secondary fabrication facility located at 9200 Innovation Boulevard, Albuquerque, NM 87113. The aggregate purchase price for the Transaction is $1.42 billion, subject to customary working capital and other adjustments as set forth in the SPA. The acquisition will be consummated through Halcyon US Holdings Inc., a Delaware C-corporation formed on June 5, 2023, for the specific purpose of serving as the acquisition vehicle (EIN: 93-2841067; registered agent: National Registered Agents of Delaware, 160 Greentree Drive, Suite 101, Dover, DE 19904).
VPI's National Security Profile. VPI is a U.S. defense contractor that designs and manufactures advanced photonic integrated circuits, high-power laser diode arrays, and related optoelectronic components for U.S. government customers, including the Department of Defense and the intelligence community. VPI holds a Facility Security Clearance ("FCL") at the SECRET level, assigned CAGE Code 7VK92, under the oversight of the Defense Counterintelligence and Security Agency ("DCSA"). VPI maintains significant quantities of technical data controlled under the International Traffic in Arms Regulations ("ITAR," 22 C.F.R. Parts 120–130) and the Export Administration Regulations ("EAR," 15 C.F.R. Parts 730–774). Of VPI's total workforce of 486 employees, 212 employees hold active U.S. government security clearances at various levels, including SECRET and TOP SECRET/SCI. VPI's classified programs are performed at its Albuquerque fabrication facility within accredited secure compartmented areas.
Purpose of This Exhibit. In light of VPI's national security significance and the sensitivity of the information and systems maintained by VPI, this Supplemental Exhibit provides the Committee with a comprehensive overview of HSAG's existing enterprise cybersecurity program, including its governance structure, certifications, technical controls, data protection and privacy compliance framework, incident response capabilities, and personnel security practices. Of equal importance, this Exhibit details the planned post-closing IT system segregation measures that HSAG commits to implementing — and maintaining on an ongoing basis — to ensure the complete protection of VPI's classified information, ITAR/EAR-controlled technical data, Controlled Unclassified Information ("CUI"), and other sensitive unclassified information from unauthorized access by HSAG personnel, particularly non-U.S. persons. These segregation measures are designed to be consistent with and supportive of the anticipated National Security Agreement ("NSA") between the parties and the U.S. government.
HSAG respectfully submits that the information set forth in this Exhibit demonstrates both the maturity of HSAG's own cybersecurity program and the robustness of the segregation measures planned for VPI, and that these measures, taken together, adequately address the cybersecurity-related concerns identified in the Committee's First RFI.
II. HSAG ENTERPRISE CYBERSECURITY GOVERNANCE STRUCTURE
A. Board and Executive Oversight
HSAG recognizes that effective cybersecurity begins with governance at the highest levels of the organization. Accordingly, HSAG has established a multi-tiered governance framework that ensures cybersecurity risk is treated as a strategic enterprise risk, subject to direct oversight by HSAG's most senior leaders.
The HSAG Vorstand (Management Board), the executive management body of the company under German corporate law, maintains direct and active oversight of the company's cybersecurity posture through a dedicated Information Security Steering Committee (the "Steering Committee"). The Steering Committee was established in 2016 and meets on a quarterly basis, or more frequently as circumstances require. The Steering Committee's mandate includes reviewing and approving the company's information security strategy, evaluating cybersecurity risk assessments, reviewing significant incident reports, approving annual cybersecurity investment budgets, and ensuring alignment between the company's cybersecurity program and its overall business strategy and regulatory obligations. The Steering Committee is chaired by the Chief Information Security Officer and includes representatives from legal, compliance, operations, research and development, and finance.
Dr. Maximilian Ehrhardt, Chief Executive Officer and Chairman of the Vorstand, and Katarina Brückner, Chief Financial Officer and member of the Vorstand, receive formal quarterly cybersecurity risk briefings prepared by the Chief Information Security Officer. These briefings cover the current threat landscape as it pertains to HSAG's operations and the semiconductor industry generally, the status of key cybersecurity initiatives and investments, metrics related to vulnerability management, incident response, and security operations, and any material changes to HSAG's cybersecurity risk profile. In addition to these quarterly briefings, the CISO has a standing directive to brief the CEO and CFO immediately upon the identification of any cybersecurity incident classified as "Critical" or "High" severity under HSAG's incident classification framework.
Stefan Lohse, General Counsel of HSAG (LL.M., Georgetown University Law Center, 2003; admitted to practice in the State of New York and as Rechtsanwalt in the Federal Republic of Germany), oversees all legal compliance aspects of HSAG's cybersecurity program. Mr. Lohse's responsibilities in this regard include ensuring compliance with the European Union General Data Protection Regulation ("GDPR," Regulation (EU) 2016/679), the German Federal Data Protection Act (Bundesdatenschutzgesetz, "BDSG"), the German IT Security Act (IT-Sicherheitsgesetz 2.0), and all applicable cross-border data transfer obligations. Mr. Lohse also coordinates with outside counsel, including Calderwood & Harkness LLP, on cybersecurity-related legal matters arising in connection with HSAG's international operations and transactions, including the Transaction that is the subject of this CFIUS review.
At the supervisory level, the HSAG Aufsichtsrat (Supervisory Board) receives a comprehensive annual cybersecurity posture report, which is presented by the CISO in conjunction with the CEO. This report provides the Aufsichtsrat with a high-level overview of the company's cybersecurity program, including key risk indicators, the results of internal and external audits, notable incidents and their resolution, regulatory developments, and the adequacy of cybersecurity investments relative to the company's risk profile. The Aufsichtsrat's Audit Committee also reviews cybersecurity-related matters as part of its broader enterprise risk oversight mandate.
B. Chief Information Security Officer (CISO)
HSAG employs a dedicated Chief Information Security Officer who serves as the company's most senior executive responsible for the management and continuous improvement of the enterprise cybersecurity program. The CISO reports directly to the Vorstand, ensuring that cybersecurity leadership has unimpeded access to the company's most senior decision-makers and is not subordinated within the IT organization in a manner that could compromise the independence of the security function.
The CISO leads the global Information Security Division, which is responsible for all aspects of HSAG's cybersecurity program, including security architecture, security operations, incident response, vulnerability management, identity and access management, security awareness and training, third-party risk management, and cybersecurity compliance. The Information Security Division employs approximately 85 full-time cybersecurity professionals deployed across HSAG's global operations. These professionals are located at the following principal sites:
• HSAG Headquarters, Dresden, Germany: Approximately 45 cybersecurity professionals, including the CISO, the Security Operations Center (SOC) team, incident response team, security architecture, and governance, risk, and compliance (GRC) functions.
• European R&D and Manufacturing Facilities (Munich, Stuttgart, Grenoble, and Eindhoven): Approximately 18 cybersecurity professionals providing local security operations support and serving as regional information security liaisons.
• Asia-Pacific Operations (Tokyo, Seoul, and Hsinchu): Approximately 8 cybersecurity professionals supporting HSAG's Asia-Pacific design centers and supply chain operations.
• Halcyon US Inc., Austin, TX (11501 Alterra Parkway, Suite 300, Austin, TX 78758): Approximately 14 cybersecurity professionals supporting HSAG's existing U.S. design center operations.
A detailed organizational chart of the Information Security Division, depicting reporting lines, functional teams, and geographic distribution, is provided as Sub-Exhibit 4 to this Supplemental Exhibit. The organizational chart identifies key personnel by title and function but, in the interest of security, does not include the names of individual contributors below the director level.
C. Information Security Policies and Standards
HSAG maintains a comprehensive and formally documented Information Security Management System ("ISMS") that is aligned with internationally recognized information security standards and frameworks. The ISMS serves as the foundational framework for HSAG's cybersecurity program and provides the structure within which the company's information security policies, procedures, and controls are developed, implemented, maintained, and continuously improved.
The ISMS is governed by a suite of key policy documents that collectively define HSAG's information security requirements and expectations for all employees, contractors, and third parties with access to HSAG information assets. The principal policy documents include the following:
1. Information Security Policy: The overarching policy document that establishes HSAG's commitment to information security, defines the scope and objectives of the ISMS, and assigns roles and responsibilities for information security across the organization.
2. Acceptable Use Policy: Defines the permissible and prohibited uses of HSAG's information technology resources, including computing equipment, networks, email, internet access, and removable media.
3. Data Classification Policy: Establishes the framework for classifying information assets based on their sensitivity and the level of protection required. HSAG's current classification framework comprises four tiers: Public, Internal, Confidential, and Strictly Confidential.
4. Access Control Policy: Defines the requirements for controlling access to HSAG information systems and data, including authentication requirements, authorization principles, role-based access control, and the principles of least privilege and need-to-know.
5. Incident Response Policy: Establishes the framework for detecting, reporting, assessing, responding to, and recovering from cybersecurity incidents, and defines the roles and responsibilities of the Incident Response Team.
6. Business Continuity and Disaster Recovery Policy: Defines the requirements for maintaining business continuity and recovering critical IT systems and data in the event of a disruption, including natural disasters, cyberattacks, and infrastructure failures.
7. Third-Party Risk Management Policy: Establishes the requirements for assessing, managing, and monitoring the cybersecurity risks associated with third-party vendors, suppliers, and service providers that have access to HSAG information systems or data.
8. Cryptographic Standards Policy: Defines the approved cryptographic algorithms, key lengths, and key management practices for the protection of HSAG data at rest and in transit.
All policies within the ISMS are subject to a formal annual review and update cycle. The review process is led by the Information Security Division's Governance, Risk, and Compliance (GRC) team, with input from relevant stakeholders across the organization, including IT operations, legal, compliance, human resources, and business unit leadership. All policy revisions are approved by the CISO and the Information Security Steering Committee prior to promulgation. Material policy changes are reported to the Vorstand as part of the quarterly cybersecurity briefing.
III. ISO 27001 CERTIFICATION
A. Scope and Certification History
HSAG's commitment to information security is independently validated through its certification to ISO/IEC 27001:2013, the internationally recognized standard for Information Security Management Systems. HSAG first achieved ISO 27001 certification in 2017, following a comprehensive implementation effort that began in 2015. Since initial certification, HSAG has maintained continuous ISO 27001 certification without lapse.
The scope of HSAG's ISO 27001 certification encompasses the following operations and facilities:
• HSAG corporate headquarters and primary operations, Industriestraße 44, 01099 Dresden, Saxony, Germany;
• All European research and development facilities, including locations in Munich, Stuttgart, Grenoble, and Eindhoven;
• All European manufacturing facilities, including the high-volume SiC fabrication facility in Dresden and the GaN epitaxy facility in Stuttgart;
• The Halcyon US Inc. design center at 11501 Alterra Parkway, Suite 300, Austin, TX 78758.
The current ISO 27001 certificate was issued following the most recent triennial re-certification audit, which was conducted in the fourth quarter of 2022. The certifying body is Quill Tanaka CPAs LLP, an independent, internationally accredited certification body headquartered in Munich, Germany, and accredited by the Deutsche Akkreditierungsstelle (DAkkS). A copy of the current ISO 27001 certificate is provided as Sub-Exhibit 1 to this Supplemental Exhibit.
HSAG is actively engaged in transition planning for the revised ISO/IEC 27001:2022 standard, which was published in October 2022. HSAG's transition plan calls for gap analysis completion by the end of Q4 2023, implementation of required changes to the ISMS throughout the first half of 2024, and formal transition audit by Aoki Reyes CPAs LLP in Q3 2024, well in advance of the October 2025 transition deadline established by the International Accreditation Forum (IAF).
B. Continuous Improvement and Surveillance Audits
In accordance with the ISO 27001 certification lifecycle, HSAG undergoes annual surveillance audits conducted by Aoki Reyes CPAs LLP. These surveillance audits verify the ongoing effectiveness and conformity of HSAG's ISMS with the requirements of the standard and assess whether the ISMS continues to be adequately maintained and improved over time.
In addition to external surveillance audits, HSAG conducts semi-annual internal audits of the ISMS through its Internal Audit function, which operates with functional independence from the Information Security Division. The internal audit program is designed to provide reasonable assurance that the ISMS controls are operating effectively and that policies and procedures are being followed consistently across all HSAG operations within the certification scope.
The most recent external surveillance audit was completed in March 2023. The audit results were favorable: no major nonconformities were identified. A limited number of minor observations were noted, relating to documentation updates for two specific operational procedures and enhanced logging for a subset of privileged access activities. All minor observations were addressed within the prescribed remediation timelines, and corrective actions were verified by the internal audit team. HSAG maintains a formal corrective action and continuous improvement process, documented in the ISMS procedures, which ensures that all audit findings — whether from external, internal, or self-assessment activities — are tracked, remediated, validated, and incorporated into the ISMS as lessons learned.
C. Integration with Other Frameworks
HSAG's ISMS is not implemented in isolation but is deliberately designed to integrate with and cross-reference multiple complementary information security frameworks. This cross-mapping approach enables HSAG to maintain a unified and comprehensive control environment that addresses the requirements of multiple standards and regulatory frameworks simultaneously, thereby reducing duplication of effort and ensuring comprehensive coverage. Specifically, HSAG's ISMS is cross-mapped to the following frameworks:
• ISO/IEC 27002:2022 — Provides detailed guidance on the implementation of information security controls referenced in Annex A of ISO 27001;
• ISO/IEC 27017:2015 — Provides guidance on information security controls applicable to the provision and use of cloud services;
• ISO/IEC 27018:2019 — Establishes controls for the protection of personally identifiable information (PII) in public cloud computing environments;
• BSI IT-Grundschutz Compendium — The comprehensive information security framework published by the German Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, "BSI"), which is widely adopted in Germany as a baseline for information security management, particularly for organizations operating critical infrastructure.
HSAG acknowledges that VPI's cybersecurity requirements under the anticipated National Security Agreement will need to align with the National Institute of Standards and Technology Special Publication 800-171 ("NIST SP 800-171"), which establishes security requirements for protecting Controlled Unclassified Information (CUI) in nonfederal systems and networks. While HSAG's existing ISO 27001 framework provides a strong baseline that overlaps significantly with many NIST SP 800-171 control families — including access control, awareness and training, audit and accountability, identification and authentication, incident response, and system and communications protection — HSAG recognizes that the ISO 27001 framework is not a direct substitute for NIST SP 800-171 compliance, and that certain NIST-specific controls, particularly those related to CUI marking, dissemination controls, and U.S. government-specific incident reporting requirements, will require supplementation within VPI's post-closing cybersecurity compliance framework. The planned approach to VPI's NIST SP 800-171 compliance is addressed in Section VII.E of this Exhibit.
IV. TECHNICAL CYBERSECURITY CONTROLS
A. Network Security Architecture
HSAG has implemented a multi-layered, defense-in-depth network security architecture across all of its global facilities. This architecture is designed to provide multiple, overlapping layers of protection so that the compromise of any single control does not result in a complete security failure. The defense-in-depth approach reflects industry best practices and is consistent with the security architecture principles set forth in ISO 27001, the BSI IT-Grundschutz Compendium, and NIST SP 800-53.
The principal components of HSAG's network security architecture include the following:
Network Segmentation. HSAG's enterprise network is segmented into distinct security zones using virtual local area networks (VLANs), next-generation firewalls, and access control lists (ACLs) applied at the network switching and routing layers. Network segmentation is implemented based on the sensitivity of the data processed within each zone and the trust level of the users and systems within the zone. Critical zones — including R&D networks, manufacturing control systems, and financial systems — are isolated from general-purpose corporate network segments and from guest or visitor networks. Inter-zone traffic is controlled by firewall policies that enforce the principle of least privilege, permitting only those communications that are specifically authorized and necessary for business operations.
Intrusion Detection and Prevention Systems (IDS/IPS). HSAG deploys network-based intrusion detection and prevention systems at key network boundaries and within critical network segments. These systems are configured to detect and, where appropriate, automatically block known attack signatures, anomalous network behavior, and indicators of compromise. IDS/IPS signatures and rulesets are updated continuously and are supplemented by threat intelligence feeds from commercial providers and industry information-sharing organizations, including the Semiconductor Industry Cybersecurity Consortium (SICC).
Demilitarized Zones (DMZs). All external-facing services, including web servers, application interfaces, and email gateways, are deployed within architecturally defined DMZs that are separated from the internal corporate network by multiple layers of firewalls. This architecture ensures that a compromise of an external-facing service does not provide an attacker with direct access to internal networks or sensitive data stores.
Encrypted Inter-Site Communications. All communications between HSAG facilities — including connections between HSAG headquarters in Dresden and remote facilities in Europe, Asia, and the United States — are encrypted using site-to-site VPN tunnels employing IPsec with AES-256 encryption. HSAG does not transmit sensitive data between facilities over unencrypted channels.
Security Operations Center (SOC). HSAG operates a dedicated Security Operations Center from its headquarters in Dresden, Germany. The SOC operates on a 24/7/365 basis and is staffed by trained security analysts who continuously monitor HSAG's global network infrastructure for security events, anomalies, and potential threats. The SOC utilizes a Security Information and Event Management (SIEM) platform that aggregates and correlates log data from across the enterprise, enabling rapid detection and investigation of potential security incidents. The SOC serves as the primary coordination point for all security monitoring, threat detection, and initial incident response activities.
B. Endpoint and Device Security
HSAG recognizes that endpoints — including workstations, laptops, mobile devices, and servers — represent a significant attack surface and a common vector for initial compromise. Accordingly, HSAG has implemented a comprehensive endpoint security program that encompasses the following controls:
Endpoint Detection and Response (EDR). HSAG has deployed a centralized EDR solution across all HSAG-managed devices globally. The EDR platform provides real-time monitoring of endpoint activity, automated detection of suspicious behaviors and known malware signatures, containment capabilities to isolate compromised endpoints, and forensic investigation tools to support incident analysis. The EDR solution is managed centrally by the SOC team in Dresden and is configured to generate alerts that are triaged by SOC analysts in real time.
Mobile Device Management (MDM). All corporate mobile devices, including smartphones and tablets issued to HSAG employees, are enrolled in HSAG's MDM platform. The MDM solution enforces security policies on mobile devices, including mandatory device encryption, passcode requirements, remote wipe capabilities, application whitelisting, and restrictions on the installation of unapproved applications. Personally owned devices that are used to access HSAG enterprise resources are subject to a Bring Your Own Device (BYOD) policy that requires enrollment in the MDM platform and compliance with baseline security requirements.
Hardware Inventory and Asset Management. HSAG maintains a comprehensive hardware asset inventory that tracks all computing devices across the enterprise. The inventory is maintained through an automated asset discovery and management system that continuously scans the network to identify connected devices, assess their configuration compliance, and flag unauthorized or unmanaged devices. This system provides the Information Security Division with real-time visibility into the device landscape and enables rapid identification of devices that fall out of compliance with HSAG's security baselines.
Secure Configuration Baselines. HSAG maintains documented secure configuration baselines for all device types deployed within its environment, including Windows workstations, Linux servers, macOS devices, network equipment, and mobile devices. These baselines are derived from industry-recognized hardening guides, including the Center for Internet Security (CIS) Benchmarks, and are customized to reflect HSAG's specific risk profile and operational requirements. Compliance with secure configuration baselines is monitored continuously through automated scanning, and deviations are flagged for remediation.
C. Identity and Access Management (IAM)
Effective identity and access management is fundamental to HSAG's cybersecurity strategy. HSAG has implemented an enterprise-wide IAM program that ensures that access to information systems and data is granted only to authorized individuals, based on their verified identity and their demonstrated need to access specific resources in the course of their job responsibilities.
Enterprise IAM Platform. HSAG operates a centralized IAM platform that serves as the authoritative source for user identity management, authentication, and authorization across the enterprise. The IAM platform integrates with HSAG's Active Directory environment, enterprise applications, cloud services, and physical access control systems to provide a unified view of user identities and access rights.
Multi-Factor Authentication (MFA). Multi-factor authentication is required for all users accessing HSAG enterprise systems, without exception. MFA is enforced for all authentication scenarios, including local workstation login, VPN access, email access, access to enterprise applications, and access to cloud-hosted services. HSAG's MFA implementation supports multiple second-factor mechanisms, including hardware security keys (FIDO2-compliant), time-based one-time passwords (TOTP), and push-based authentication through a corporate authentication application. SMS-based one-time passwords are not permitted as a second factor due to known vulnerabilities in the SMS channel.
Role-Based Access Control (RBAC). Access to enterprise applications and systems is governed by a role-based access control model. Access rights are assigned to defined roles rather than to individual users, and users are granted roles based on their job function and organizational position. The RBAC model is designed to enforce the principles of least privilege and separation of duties, ensuring that users have access only to the specific systems and data necessary to perform their assigned responsibilities and that no single user has the ability to perform conflicting or high-risk actions without appropriate oversight.
Privileged Access Management (PAM). HSAG deploys a dedicated privileged access management solution for all administrative and elevated-privilege accounts. The PAM solution provides secure vaulting of administrative credentials, just-in-time (JIT) access provisioning for privileged sessions (ensuring that administrative access is granted only for the duration necessary to perform a specific task), mandatory session recording for all privileged sessions, and real-time monitoring and alerting on privileged account activity. PAM controls are applied to all categories of privileged accounts, including domain administrator accounts, database administrator accounts, network device administrator accounts, and application-level service accounts with elevated permissions.
Quarterly Access Reviews. HSAG conducts formal quarterly access reviews and certifications for all critical systems and applications. During these reviews, system owners and managers are required to review and certify the access rights of all users with access to their systems, confirm that access rights remain appropriate and consistent with job responsibilities, and identify and remediate any instances of excessive, inappropriate, or orphaned access. The results of quarterly access reviews are documented and reported to the Information Security Steering Committee.
D. Data Protection and Encryption
HSAG employs robust technical controls to protect the confidentiality and integrity of sensitive data throughout its lifecycle, including data at rest, data in transit, and data in use.
Data-at-Rest Encryption. All sensitive data stores within HSAG's environment are protected by encryption at rest using the Advanced Encryption Standard with 256-bit keys (AES-256). This encryption is applied to databases, file servers, backup media, and endpoint storage volumes (full-disk encryption). Encryption key management is performed in accordance with HSAG's Cryptographic Standards Policy, which mandates secure key generation, storage, rotation, and destruction procedures.
Data-in-Transit Encryption. All internal and external communications carrying sensitive data are encrypted in transit using Transport Layer Security version 1.3 (TLS 1.3) or, for site-to-site VPN connections, IPsec with AES-256 encryption. Older and deprecated cryptographic protocols, including SSL, TLS 1.0, and TLS 1.1, are disabled across the HSAG environment.
Data Loss Prevention (DLP). HSAG deploys DLP solutions at both network boundaries and on individual endpoints to detect and prevent the unauthorized transmission or exfiltration of sensitive data. DLP policies are configured to identify and block the transmission of data classified as "Confidential" or "Strictly Confidential" through unauthorized channels, including personal email, unapproved cloud storage services, removable media (where not specifically authorized), and file-sharing applications. DLP events are logged, reviewed by the SOC, and escalated as potential security incidents when appropriate.
Data Classification Framework. HSAG operates a formal data classification framework with four tiers:
• Public: Information that is intended for public dissemination and presents no risk to HSAG if disclosed.
• Internal: Information that is intended for use within HSAG and is not authorized for public release, but whose disclosure would not cause material harm to the company.
• Confidential: Information whose unauthorized disclosure could cause material harm to HSAG, its employees, its customers, or its business partners.
• Strictly Confidential: Information of the highest sensitivity, whose unauthorized disclosure could cause severe harm to HSAG or its stakeholders, including trade secrets, strategic plans, and information subject to legal privilege.
HSAG acknowledges that its existing data classification framework does not currently encompass U.S. government classification markings, including Controlled Unclassified Information (CUI) markings under 32 C.F.R. Part 2002 or national security classification markings (e.g., CONFIDENTIAL, SECRET, TOP SECRET) under Executive Order 13526. This is appropriate because HSAG's existing systems do not process U.S. government classified or CUI-marked information. The post-closing VPI IT segregation plan described in Section VII of this Exhibit ensures that VPI will continue to manage U.S. government classified and CUI data within its own independent systems, utilizing its own classification and marking procedures consistent with NISPOM, NIST SP 800-171, and applicable contract requirements.
E. Vulnerability Management
HSAG maintains a rigorous vulnerability management program designed to identify, assess, prioritize, and remediate security vulnerabilities across the enterprise in a timely manner.
Continuous Vulnerability Scanning. HSAG conducts continuous vulnerability scanning of all internal and external-facing systems using commercial vulnerability scanning platforms. Scans are performed on a continuous, automated basis for the enterprise perimeter and on a weekly basis for internal systems. Newly identified vulnerabilities are automatically correlated with HSAG's asset inventory to determine the scope of exposure and are assigned risk scores based on the Common Vulnerability Scoring System (CVSS) and contextual factors specific to HSAG's environment.
Patch Management. HSAG operates a formal patch management process that is integrated with its vulnerability management program. Patches are prioritized based on risk, and defined service level agreements (SLAs) govern the maximum acceptable time to remediate vulnerabilities of each severity level:
• Critical vulnerabilities (CVSS 9.0–10.0): Patched within 48 hours of patch availability.
• High vulnerabilities (CVSS 7.0–8.9): Patched within 7 calendar days of patch availability.
• Medium vulnerabilities (CVSS 4.0–6.9): Patched within 30 calendar days of patch availability.
• Low vulnerabilities (CVSS 0.1–3.9): Patched within 30 calendar days of patch availability, or accepted as residual risk with documented risk acceptance by the appropriate system owner.
Patch compliance is monitored through automated reporting, and exceptions to the patch SLAs require documented risk acceptance approved by the CISO or a designated delegate.
Third-Party Penetration Testing. HSAG engages independent, third-party security firms to conduct annual penetration testing of its enterprise systems and network infrastructure. Penetration testing engagements include both external testing (simulating an attacker attempting to breach HSAG's perimeter defenses) and internal testing (simulating an insider threat or a compromised internal account). Penetration testing reports are reviewed by the CISO, and remediation of identified findings is tracked through the corrective action process.
Bug Bounty Program. HSAG operates a managed bug bounty program for its external-facing web applications and services. The program invites qualified, vetted external security researchers to identify and responsibly disclose vulnerabilities in HSAG's public-facing digital assets. Valid vulnerability submissions are rewarded financially based on severity, and identified vulnerabilities are remediated through the standard vulnerability management process.
F. Cloud Security
HSAG utilizes cloud infrastructure for certain enterprise functions, including collaboration tools, human resources management, and select enterprise resource planning (ERP) modules. All cloud infrastructure utilized by HSAG is hosted within European Union-based data centers, consistent with HSAG's data residency requirements and its obligations under the GDPR.
HSAG has deployed cloud security posture management (CSPM) tools to continuously monitor the configuration and security posture of its cloud environments. CSPM tools are configured to detect misconfigurations, overly permissive access controls, unencrypted data stores, and other security gaps that could expose HSAG data to unauthorized access or disclosure.
All cloud deployments within HSAG's environment are subject to the HSAG Cloud Security Policy, which establishes mandatory requirements for encryption of data at rest and in transit within cloud environments, access controls and identity management for cloud services, data residency restrictions prohibiting the storage of HSAG data outside approved geographic regions, logging and monitoring of cloud service activity, and vendor security assessments prior to the adoption of new cloud services.
Note regarding VPI: Following the closing of the Transaction, VPI's information technology systems and data will NOT be migrated to, hosted on, or integrated with any HSAG cloud infrastructure, tenancies, or subscriptions. This commitment is a foundational element of the post-closing IT segregation plan described in Section VII of this Exhibit.
V. DATA PROTECTION AND PRIVACY COMPLIANCE
A. EU General Data Protection Regulation (GDPR)
As a company headquartered in the European Union and conducting substantial business operations within the EU and the European Economic Area (EEA), HSAG is subject to, and maintains full compliance with, the EU General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR"). HSAG treats data protection and privacy as fundamental components of its overall information security program, and its data protection compliance framework is closely integrated with the ISMS described in Sections II and III above.
HSAG has designated a Data Protection Officer ("DPO") in accordance with Article 37 of the GDPR. The DPO is registered with the Sächsischer Datenschutzbeauftragter (Saxon Data Protection Authority), which serves as HSAG's lead supervisory authority under the GDPR's one-stop-shop mechanism. The DPO operates with functional independence from the business units whose processing activities the DPO oversees, reports directly to the Vorstand on data protection matters, and has access to all information necessary to fulfill the DPO's responsibilities under the GDPR.
HSAG maintains comprehensive Records of Processing Activities in accordance with Article 30 of the GDPR. These records document the purposes of processing, the categories of personal data processed, the categories of data subjects, the recipients of personal data (including any transfers to third countries), the applicable legal bases for processing, and the applicable data retention periods for each category of processing activity.
Data Protection Impact Assessments ("DPIAs") are conducted in accordance with Article 35 of the GDPR for all processing activities that are likely to result in a high risk to the rights and freedoms of natural persons. DPIAs are conducted prior to the commencement of high-risk processing and are reviewed and updated as processing activities evolve. DPIAs are reviewed by the DPO before processing begins.
For transfers of personal data outside the EEA, HSAG relies on the Standard Contractual Clauses ("SCCs") adopted by the European Commission (Commission Implementing Decision (EU) 2021/914 of 4 June 2021) as the primary legal mechanism for ensuring adequate protection of personal data in the recipient country. HSAG conducts Transfer Impact Assessments in accordance with the guidance of the European Data Protection Board to evaluate the legal framework of the recipient country and to determine whether supplementary measures are necessary to ensure the effectiveness of the SCCs.
B. German Federal Data Protection Act (BDSG)
In addition to GDPR compliance, HSAG maintains supplemental compliance with the Bundesdatenschutzgesetz ("BDSG"), the German Federal Data Protection Act, as applicable to HSAG's operations within the Federal Republic of Germany. The BDSG supplements and, in certain areas, particularizes the requirements of the GDPR as permitted by the GDPR's opening clauses.
Of particular relevance, HSAG has established comprehensive employee data protection protocols that comply with Section 26 of the BDSG, which governs the processing of employees' personal data in the employment context. HSAG has also entered into formal agreements with its works councils (Betriebsräte) at applicable German facilities regarding the use of information technology for employee monitoring purposes, consistent with the requirements of the Betriebsverfassungsgesetz (Works Constitution Act). These works council agreements define the scope and limitations of IT-based employee monitoring activities, including email monitoring, internet usage logging, and workplace surveillance, and establish safeguards to protect employee privacy while permitting HSAG to maintain effective cybersecurity controls.
C. U.S. Data Protection Considerations
HSAG's existing U.S. subsidiary, Halcyon US Inc. (Austin, TX), complies with all applicable U.S. federal and state data protection and privacy laws, including the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), and other state privacy laws applicable to the company's operations.
Following the closing of the Transaction, VPI will maintain its own independent data protection practices consistent with applicable U.S. federal and state requirements, including protections for employee personally identifiable information ("PII"), customer data, and information subject to government contract data protection requirements (e.g., DFARS 252.204-7012). VPI's data protection practices will not be subordinated to or integrated with HSAG's GDPR-based data protection framework, and VPI will not be treated as a "processor" or "sub-processor" of HSAG under the GDPR.
Critically, no transfer of VPI employee PII or customer data to HSAG systems in Germany or elsewhere outside the United States will occur without an appropriate legal basis under applicable U.S. law and, where required by the anticipated National Security Agreement or applicable export control regulations, prior authorization from the U.S. government. HSAG recognizes that certain categories of VPI data, including data relating to cleared employees, classified programs, and ITAR/EAR-controlled technical data, are subject to absolute restrictions on transfer outside the United States, and HSAG commits to complying fully with these restrictions.
VI. INCIDENT RESPONSE AND BUSINESS CONTINUITY
A. Cybersecurity Incident Response Plan (CSIRP)
HSAG maintains a formal Cybersecurity Incident Response Plan ("CSIRP") that defines the processes, procedures, roles, responsibilities, escalation pathways, and communication protocols for responding to cybersecurity incidents across the enterprise. The CSIRP is designed to enable HSAG to detect, contain, eradicate, and recover from cybersecurity incidents in a timely and effective manner while minimizing the impact on HSAG's operations, customers, and stakeholders. A summary version of the CSIRP is provided as Sub-Exhibit 3 to this Supplemental Exhibit (certain operational details have been redacted to protect the security of HSAG's incident response capabilities).
Incident Severity Classification. HSAG classifies cybersecurity incidents into four severity tiers, each with defined response requirements:
• Critical: Incidents that involve or are likely to involve a confirmed breach of highly sensitive data (e.g., Strictly Confidential data, trade secrets, or personal data on a large scale), a confirmed compromise of critical infrastructure or manufacturing control systems, or a significant and ongoing threat to the availability of essential business services. Critical incidents require immediate activation of the full Incident Response Team and notification of the Vorstand.
• High: Incidents that involve a confirmed compromise of enterprise systems with potential for significant data exposure or operational impact, but that do not meet the threshold for Critical classification. High incidents require activation of the IRT and notification of the CISO within one hour.
• Medium: Incidents involving localized compromise or security events with limited scope and contained impact, such as isolated malware infections on individual endpoints that are detected and contained by automated controls.
• Low: Security events that are suspicious but do not involve a confirmed compromise, such as unsuccessful phishing attempts, blocked intrusion attempts, or policy violations with no security impact.
Incident Response Team (IRT). The IRT is a cross-functional team that is activated in response to incidents classified as Critical or High severity. The IRT is composed of the CISO (serving as the IRT lead), SOC leadership and senior analysts, IT operations representatives, General Counsel and legal team, corporate communications, and relevant business unit representatives. For incidents affecting specific facilities or regions, local IT and security personnel are integrated into the IRT as needed.
Response Time Targets. HSAG has established the following response time targets for its incident response activities:
• Mean Time to Detect (MTTD): Less than 4 hours for Critical-severity incidents, measured from the time the initial indicator of compromise is generated to the time the SOC confirms the incident.
• Mean Time to Respond (MTTR): Less than 1 hour for Critical-severity incidents after detection, measured from the time the incident is confirmed to the time the initial containment actions are initiated.
HSAG monitors and reports on actual MTTD and MTTR metrics as part of its quarterly cybersecurity briefings to the Vorstand, and continuously works to improve these metrics through process refinement, automation, and investment in advanced detection capabilities.
Exercises and Testing. HSAG conducts semi-annual tabletop exercises involving the IRT and senior leadership, during which participants walk through realistic incident scenarios to test decision-making, communication, and escalation processes. In addition, HSAG conducts a full simulation exercise annually, which tests the end-to-end incident response process, including detection, containment, eradication, recovery, and post-incident review, in a realistic environment using simulated threats. These exercises are planned and facilitated by the Information Security Division's GRC team, and the results are documented and used to inform improvements to the CSIRP.
Post-Incident Review. Following the resolution of all incidents classified as High or Critical severity, HSAG conducts a formal post-incident review and lessons-learned process. The post-incident review documents the timeline of the incident, the effectiveness of detection and response actions, root cause analysis, the impact of the incident, and recommendations for process, technology, or personnel improvements to prevent recurrence. Lessons learned are incorporated into the CSIRP and communicated to relevant stakeholders across the organization.
B. Incident Reporting
Internal Reporting. All HSAG employees are trained to recognize and report suspected cybersecurity incidents immediately through dedicated reporting channels. These channels include a 24/7 security hotline operated by the SOC, a dedicated email address for security incident reports, and an integrated reporting button within the corporate email client for reporting suspected phishing emails. Security awareness training, which is mandatory for all employees upon hiring and annually thereafter, includes instruction on incident recognition and reporting procedures.
External Reporting. HSAG reports cybersecurity incidents to relevant governmental authorities as required by applicable law and regulation. In particular, HSAG is subject to incident reporting obligations under the German IT Security Act (IT-Sicherheitsgesetz 2.0), which requires operators of critical infrastructure to report significant cybersecurity incidents to the BSI (Bundesamt für Sicherheit in der Informationstechnik, German Federal Office for Information Security) without undue delay and in any event within 24 hours of detection. HSAG is also subject to the GDPR's data breach notification requirements under Article 33 (notification to the supervisory authority within 72 hours) and Article 34 (communication to affected data subjects where the breach is likely to result in a high risk to their rights and freedoms).
Post-Closing VPI Incident Reporting. Following the closing of the Transaction, cybersecurity incidents affecting VPI systems will be reported in accordance with VPI's own incident response procedures, which will be maintained independently of HSAG's CSIRP. Consistent with the anticipated NSA requirements and DFARS 252.204-7012, VPI will report cybersecurity incidents to DCSA within 72 hours of detection. VPI's incident reporting obligations to DCSA and other U.S. government agencies will be managed by VPI's own cybersecurity and security personnel under the oversight of the Facility Security Officer, and HSAG will not interfere with, delay, or otherwise impede VPI's compliance with these reporting obligations. The details of VPI's post-closing incident response framework are further addressed in Section VII.E of this Exhibit.
C. Business Continuity and Disaster Recovery (BC/DR)
HSAG maintains comprehensive Business Continuity Plans ("BCPs") for all critical business functions, including manufacturing operations, research and development, supply chain management, customer support, and corporate services. The BCPs define the processes and procedures for maintaining or rapidly restoring critical business functions in the event of a disruption, whether caused by natural disaster, cyberattack, infrastructure failure, pandemic, or other unforeseen event.
HSAG also maintains Disaster Recovery Plans ("DRPs") for critical IT systems and infrastructure. The DRPs define the following recovery objectives for each critical system:
• Recovery Time Objectives (RTOs): The maximum acceptable duration of time that a critical system may be unavailable before the impact on business operations becomes unacceptable. RTOs range from 4 hours for the most critical systems (e.g., manufacturing execution systems, SOC infrastructure) to 24 hours for less time-sensitive systems.
• Recovery Point Objectives (RPOs): The maximum acceptable amount of data loss measured in time, representing the point in time to which data must be recoverable. RPOs range from near-zero (for systems with real-time replication) to 4 hours for systems with regular backup intervals.
HSAG maintains geographically distributed backup and recovery infrastructure within Germany, including a primary backup data center in Leipzig and secondary backup capabilities at the Stuttgart facility. Backup data is encrypted and replicated between these locations in accordance with HSAG's data protection and encryption standards.
Annual BCP/DRP Testing and Validation. HSAG conducts annual testing of its BCPs and DRPs to validate their effectiveness and to identify areas for improvement. Testing includes tabletop exercises, partial failover tests for critical IT systems, and, on a rotating basis, full failover simulations for selected critical systems. Test results are documented, and identified deficiencies are remediated through the corrective action process.
VII. PLANNED POST-CLOSING VPI IT SYSTEM SEGREGATION
A. Segregation Principles and Objectives
HSAG recognizes that the protection of VPI's classified information, Controlled Unclassified Information (CUI), ITAR/EAR-controlled technical data, and other sensitive unclassified information is of paramount importance to the U.S. government and is essential to the successful completion and ongoing implementation of the anticipated National Security Agreement. Accordingly, HSAG commits to maintaining complete physical and logical separation of VPI's information technology systems from the HSAG global network and enterprise IT infrastructure following the closing of the Transaction. This commitment is unconditional and will be maintained for so long as VPI remains under HSAG ownership or as otherwise required by the NSA.
The specific objectives of the post-closing IT segregation are as follows:
1. Protect classified and Controlled Unclassified Information (CUI) within VPI systems from unauthorized access, disclosure, or exfiltration, consistent with the requirements of the National Industrial Security Program Operating Manual ("NISPOM," 32 C.F.R. Part 117), NIST SP 800-171, and applicable contract security requirements;
2. Prevent unauthorized access by non-U.S. persons — including HSAG personnel located in Germany, other European countries, Asia, or any non-U.S. location — to ITAR-controlled technical data (22 C.F.R. Parts 120–130) and EAR-controlled technical data (15 C.F.R. Parts 730–774) maintained within VPI systems, consistent with U.S. export control requirements;
3. Comply with all requirements of the anticipated National Security Agreement, including provisions related to IT segregation, a Technology Control Plan ("TCP"), Government Security Committee oversight, and NIST SP 800-171 compliance; and
4. Maintain VPI's Facility Security Clearance at the SECRET level (CAGE Code: 7VK92) under the oversight of the Defense Counterintelligence and Security Agency (DCSA), and ensure that VPI's classified processing capabilities at the Albuquerque facility remain fully operational and compliant with NISPOM requirements.
The segregation measures described in this Section VII apply to all VPI locations, including:
• VPI corporate headquarters at 7400 Ridgeline Parkway, Colorado Springs, CO 80919; and
• VPI fabrication facility at 9200 Innovation Boulevard, Albuquerque, NM 87113.
B. Network Segregation
VPI will maintain its own independent and entirely separate network infrastructure following the closing of the Transaction. Specifically:
• VPI will maintain its own dedicated internet service connections, procured from U.S.-based internet service providers, at both its Colorado Springs headquarters and its Albuquerque fabrication facility. These internet connections will be entirely separate from any HSAG internet connections, including those used by Halcyon US Inc. in Austin, Texas.
• VPI will operate its own firewalls, routers, switches, and wireless access points, which will be managed exclusively by VPI IT personnel. No HSAG-owned or HSAG-managed network equipment will be deployed at VPI facilities.
• No network interconnection of any kind will exist between VPI IT systems and the HSAG global network, including the Halcyon US Inc. network in Austin, TX. This prohibition encompasses, without limitation, direct network connections, shared VPN tunnels, MPLS circuits, SD-WAN connections, peering arrangements, and any other form of network interconnection that would permit data to flow between VPI systems and HSAG systems.
• VPI will operate its own independent email system, collaboration tools, and file storage systems. VPI employees will not be granted access to HSAG email, collaboration platforms (e.g., Northgate Data Systems, Aldermere Systems), or file storage systems, and HSAG employees will not be granted access to VPI's equivalent systems.
• Any future business communication between VPI unclassified business functions and HSAG that is necessary for legitimate parent-company oversight purposes (e.g., financial reporting, strategic planning at a high level) will occur through approved, monitored communication channels that are specifically designed to prevent the transfer of controlled technical data. These channels will be defined in the Technology Control Plan and will be subject to Government Security Committee oversight. Approved channels may include, for example, a limited number of designated email accounts used exclusively for non-controlled business communications, with DLP controls configured to detect and block the transmission of controlled technical data.
C. No Shared Cloud Infrastructure
The prohibition on integration between VPI and HSAG IT systems extends fully to cloud infrastructure:
• VPI will not use any HSAG cloud tenancies, subscriptions, accounts, or cloud-hosted services, whether provided by HSAG directly or procured by HSAG from third-party cloud service providers.
• VPI will maintain its own cloud infrastructure, to the extent VPI utilizes cloud services, hosted exclusively within U.S.-based data centers operated by U.S.-based cloud service providers. No VPI data will be replicated to, backed up to, or otherwise stored in any data center located outside the United States.
• HSAG enterprise cloud services — including HSAG's ERP system, human resources information system (HRIS), and other enterprise-wide platforms — will not be extended to VPI without prior review and approval by the Government Security Committee ("GSC"). As of the date of this Exhibit, HSAG does not plan to extend any enterprise cloud services to VPI, and any future proposal to do so would be subject to the GSC's review to ensure that the proposed extension does not create unaut

SUPPLEMENTAL EXHIBIT TO FIRST RFI RESPONSE

HALCYON SEMICONDUCTOR AG ENTERPRISE CYBERSECURITY PROGRAM OVERVIEW

I. INTRODUCTION AND PURPOSE

II. HSAG ENTERPRISE CYBERSECURITY GOVERNANCE STRUCTURE

III. ISO 27001 CERTIFICATION

IV. TECHNICAL CYBERSECURITY CONTROLS

V. DATA PROTECTION AND PRIVACY COMPLIANCE

VI. INCIDENT RESPONSE AND BUSINESS CONTINUITY

VII. PLANNED POST-CLOSING VPI IT SYSTEM SEGREGATION

Record

Parties

Dates

Amounts