President Donald Trump’s recent executive order seeking to protect the bulk power system from foreign threats correctly identifies the risk of U.S. reliance on outside suppliers, but mitigating those risks without stalling the grid’s buildout or saddling ratepayers with even more costs will be tricky, stakeholders told Utility Dive.
Executive Order 14421, issued Aug. 26, gives Secretary of Energy Chris Wright the power to block the installation of foreign-produced equipment – “or any critical component, software, firmware, digital service, maintenance service, or remote-access capability associated with such equipment” – that poses an “undue risk” to national security, either through intentional sabotage or supply chain disruption.
It also gave the secretary the authority to order the removal and replacement of previously installed equipment.
The Department of Energy has until Dec. 24 to publish rules and regulations implementing the order. In September, DOE asked industry and other stakeholders to weigh in.
Their responses to DOE’s request show broad support for the intent of the order, but concern over how it will be implemented. A number pointed out that security standards, especially for software that would enable remote access, can be more important than country of origin since flaws in any system can be exploited by anyone, anywhere.
The vast majority of stakeholder responses that took a position on the “function over origin” question favored DOE emphasizing functional controls as opposed to a software product’s origin, according to data compiled by industry analyst Brendon Shank.
Many respondents also said they wanted DOE to take a phased approach to introducing new compliance rules and allow some vendors to “prequalify” as trustworthy. Utilities are projected to spend more than a trillion dollars on grid upgrades through 2030 and are racing to secure contracts for equipment amid rising manufacturer backlogs.
“Supply chains are already approaching a breaking point for many categories of electrical industry products,” said the National Electrical Manufacturers Association, which represents more than 300 electrical equipment manufacturers.
“[W]e strongly encourage the DOE to consider the time, money and resources it takes to evaluate, redesign, develop and produce equipment that is made for the electrical system,” it said. “At a time of high demand and longer lead times than during periods of more stable electricity growth, that is only further complicated by balancing timeliness with retooling or restructuring of production lines to meet new changes.”
Until DOE releases its determinations, the industry faces a lot of uncertainty and big questions, said Alice Wu, a manager of federal policy at the clean energy nonprofit RMI.
Even though the order instructs DOE to focus on transmission-related equipment and components of 69 kV or higher — not on the distribution system — it also puts distribution system components linked to the bulk system with questionably sourced software under scrutiny, she said.
“It is not feasible for generation, transmission and distribution providers to rip-and-replace every piece of equipment and for DOE to check it,” Wu told Utility Dive in an interview. “What is the secure proxy for that? … And what will the potential cost impacts to ratepayers be?”
U.S. imports billions of dollars in grid components every year
The U.S. has imported more than $22 billion in bulk-power equipment since 2025, particularly from China, which would likely be the country most impacted by the order, according to a recent Wood Mackenzie analysis.
Transformers and substations are already in an estimated market shortage of 15% and 8%, respectively, in 2026, and “restrictions on the use of Chinese built units is going to further exacerbate the supply chain challenges,” WoodMac said.
The market for 100 MVA power transformers is particularly exposed, it said, adding that the market for power transformers greater than 10 MVA has expanded nearly 300% since 2020.
A different analysis by RMI and BloombergNEF said the value of grid imports in 2025 was more than $30 billion. Together, Mexico, Southeast Asia and the European Union made up more than half of that, while China accounted for $3.5 billion and “other” countries for $7.4 billion.
U.S. power system supply chain imports
Permission granted by RMI
Cybersecurity a key vulnerability
NEMA and other stakeholders and experts applauded the order’s emphasis on software, maintenance support and other services that introduce remote-access capabilities. They also pointed to existing security standards DOE could apply from the North American Electric Reliability Corp., the National Institute of Standards and Technology, the Institute of Electrical and Electronics Engineers and others.
“Overall, this executive order focuses on the right security areas because it makes those who deploy critical infrastructure accountable for their software,” said Aaron Rose, a security architect manager with Check Point Software Technologies, which assesses security for utilities and other companies.
Check Point sees an average of about 3,000 cyberattacks per large organization per week, he said in an interview with Utility Dive.
DOE software determinations will be complicated, because “almost everything on the power system is software defined, controlled and driven,” he added.
DOE could ask for a software’s source, who maintains it, who has remote access to it, and where updates originate, Rose said. But updates for most firmware, cloud control systems, substation systems and customer-owned devices are from open-source libraries or code already written for other uses, making their countries of origin difficult to identify, and eliminating all software of uncertain origin is impractical, he said.
Power system software may also be sub-contracted to a third-party, Rose continued. Hardware manufacturers may or may not have documentation on that software’s developer or on who has remote access for updates, or be able to trace them, even with AI tools.
To avoid a complicated decompiling by a security team and still ensure critical needs are met, DOE could require future updates and remote access to be from secure sources, he added.
Rose said it is unclear whether the costs for such measures will fall on software vendors, infrastructure owners or their consumers.
An analysis of the order by the Rainey Center, a policy think tank, also questioned the logic of restrictions based on geography rather than capability and function.
“The risks the order names travel through code, connections, and control, and they work the same whether a device is built abroad or at home,” it said. “A ban governs geography; a standard governs the risk, on every device.”
The report recommended DOE define risk by “a verifiable, technology-neutral standard” built on existing controls, as well as a system for vendors to prequalify through independent U.S. testing.
U.S. power system supply chain demand
Permission granted by WoodMac
Protecting investments in growth
The order’s flexibilities, like phased compliance, can allow determinations that avoid negative economic impacts, said Danielle Russo, executive director of SAFE, a nonprofit advocacy group focused on U.S. national and economic security.
DOE can provide power system manufacturers and developers the clarity they need with lists of the specific supply chain equipment and components that are secure, Russo said. That will avoid slowing manufacturing investment and project development needed to meet load growth, she added.
In today’s complex investment environment, uncertainties from tariffs to changing political leadership can threaten investors with stranded assets, Russo said, adding: “It is hard to blame them for being challenged by that.”
DOE’s security restrictions should be balanced with legislated incentives that provide long-term certainty, Russo said.
