Extract to table

The Security Board Members will include an independent Security Director who is not affiliated with either HSAG or VPI and who must be approved by CFIUS's lead monitoring agencies prior to appointment

The HSAG designees on the VPI board shall have no authority to override, direct, or interfere with any determination made by the GSC

Requests for such access must be submitted at least thirty (30) calendar days in advance, must identify the specific individuals seeking access and the purpose of the visit, and must be accompanied by a certification from the GSC that appropriate security measures will be in place during the visit

VPI must engage a qualified third-party cybersecurity firm to conduct annual penetration testing of VPI's IT systems, with the results reported to both the GSC and DCSA

In the event of any cybersecurity incident affecting VPI's systems — including any unauthorized access, data exfiltration, or malware intrusion — VPI must report the incident to DCSA within seventy-two (72) hours of detection

Critically, VPI's IT systems, including all servers, workstations, network infrastructure, email systems, and data storage, must be physically and logically separated from HSAG's global network