The Grid Supply Chain Emergency Is Here. Start Your Inventory Before the Rule Lands.

On August 26, the President signed Executive Order 14421, "Declaring a National Emergency to Secure the United States Bulk-Power System." It was published in the Federal Register on August 31. The Department of Energy now has 120 days, roughly until the end of December, to write the rules that will tell utilities what compliance actually looks like.

That gap between "the prohibition exists" and "we know what it means" is the whole story for the next four months. Utilities that spend it building an evidence base will be negotiating with DOE in January. Utilities that spend it waiting will be reacting.

What the order actually does

EO 14421 declares a national emergency under IEEPA and the National Emergencies Act over foreign-produced bulk-power system equipment and prohibits the acquisition, importation, transfer or installation of that equipment where a "Covered Foreign Entity" holds an interest. The prohibition attaches to transactions initiated after the signing date. (You will see this cited as EO 14420 in some early commentary; the Federal Register assigned 14421.)

If this sounds familiar, it should. EO 13920 covered similar ground in 2020, was suspended in January 2021, and never fully implemented. The new order is a substantially wider net.

Three features deserve more attention than they are getting.

First, the scope is component-level and broad. The order reaches transmission rated at 69 kV or above, and its equipment definition covers items in substations, control rooms and generating plants: reactors, capacitors, substation transformers, utility-scale and other grid-connected inverters, battery energy storage systems and more. This is no longer a transformer conversation. If you have added BESS or utility-scale inverters in the last five years you are in scope in a way you were not under 13920.

Second, and this is the part I would flag hardest, the definition explicitly includes associated software, firmware, remote access capabilities and maintenance mechanisms. The order is not only about where the steel was fabricated. It is about who can reach into the device after it is energized. Vendor-managed remote support tunnels, over-the-air firmware update channels, embedded cellular modems in inverters and reclosers and the diagnostic backdoors that quietly ship inside OEM maintenance agreements are all squarely within the definition. NEMA has already said publicly that country-of-origin determination for software will be difficult, which is exactly right and exactly why you want your own answer before DOE asks for one.

Third, installed equipment is not grandfathered; it is conditioned. Section 2(b) does not ban gear you already own. It authorizes the Secretary to impose conditions on the continued use, operation, maintenance, servicing or updating of equipment acquired before the order, with explicit consideration of reliability, safety, availability of replacements and phased compliance. DOE is also directed to identify high-risk installed equipment and develop replacement strategies. Read that plainly: your existing fleet is in the conversation, your service agreements are in the conversation and the mitigations you can document today are the mitigations that will keep a replacement mandate off your capital plan tomorrow.

One scoping note: the White House fact sheet confirms the order does not apply to facilities used for local distribution. That helps, but the transmission/distribution line is not always clean in practice, and the same vendor firmware often runs on both sides of it.

What to do in the next ninety days

• Build a provenance inventory, not an asset list. Most utilities have an asset register. Far fewer can answer, per device, where it was manufactured, who owns the manufacturer, whose firmware is running and what the remote access path looks like. That last dimension is the one that matters most here and the one least likely to be in your CMMS today. Start with inverters, BESS and any recently commissioned substation automation.
• Mine your CIP-013 work; it is a real head start. If you are a registered entity with high or medium impact BES Cyber Systems, CIP-013-3 R1.2 already requires you to address vendor-initiated remote access controls and verification of software integrity and authenticity. That is not the same evidence DOE will want, but it is adjacent, documented and already approved by your CIP Senior Manager. Do not rebuild from zero.
• Get country-of-origin language into procurement now. Anything you specify this fall will be delivered into the post-rule world. Add representations covering ultimate parent ownership, firmware and software development location and disclosure of every remote access and update mechanism, with a right to disable them. Vendors will push back on that last one, and the pushback is itself useful information.
• Map, then segment, vendor access paths. Whatever DOE requires, the defensible position is a utility that terminates vendor connectivity into an architecture it controls and monitors (private LTE, private APNs with no internet route, brokered jump hosts, session recording) rather than a device with a carrier SIM and an OEM tunnel nobody in operations can see. If you have been trying to justify a private wireless program on operational grounds alone, this order just added a compliance argument to your business case.
• Pressure-test your lead times against the calendar. Large transformer and BESS lead times still run well past the DOE rulemaking window. Know now which pending orders would be exposed if a supplier lands on the covered list, and document transaction initiation dates relative to August 26; that date is the line between prohibited and merely conditioned. Section 2(e) also lets the Secretary publish pre-qualified vendor and equipment lists; getting your key suppliers thinking about that list is worth a phone call this month.
• Show up for the rulemaking. The DOE rule is where phased compliance timelines get set and where the software country-of-origin problem either gets a workable test or does not. Utilities that file comments with specific fleet data get a better rule than utilities that read about it in December.

What is still unknown and what is not

The uncertainty here is narrower than the commentary suggests. "Covered Foreign Entity" anchors on countries subject to U.S. arms embargo or sanctions under 22 C.F.R. § 126.1: China, Russia, Iran, North Korea and others on a list you can read today, plus whatever additional determinations the Secretary of Energy makes. That first prong is knowable now. Run it against your vendor list this week rather than waiting for DOE to run it for you.

It is also worth sizing the exposure honestly. IEA figures cited in trade coverage of the order put China at 80% or more of world production for several of the targeted categories, including lithium-ion cells. For inverters and storage, sourcing alternatives are not a procurement decision so much as a multi-year industrial one.

What is genuinely open is the second prong, the phased compliance schedule for installed equipment, and how DOE will test country-of-origin for software and firmware. Those arrive with the rule in December, followed by FAR revisions recommended by late February.

None of that is a reason to wait. Every action above is worth doing on cybersecurity and reliability grounds regardless of what DOE publishes. The order simply moved them up the priority list and gave you a much easier time getting them funded.