Clearly, more timely and flexible processes are needed to secure the power industry supply chain. Compliance with the existing mandatory reliability standards is important, but it is not sufficient to protect against the escalating and sophisticated threats we now face.

Recognizing this, Executive Order 13920, “Securing the United States Bulk Power System,” was issued on May 1, 2020.  It prohibited purchasing or installing certain bulk-power electric equipment that was developed, built, or supplied by companies that are subject to control or controlled by a foreign adversary.[2]  After several months of gathering information, in December DOE issued a “Prohibition Order Securing Critical Defense Facilities.”[3]  DOE also may issue a proposed a rule implementing the Executive Order.

Against this backdrop of enhanced urgency to secure the supply chain for the electric grid and other critical infrastructure, Protect Our Power launched a Supply Chain Collaborative, a series of meetings with representatives of multiple sectors of the electric power system, together with other experts.  The meetings were a joint effort between Protect Our Power and Ridge Global, an international security and risk management firm chaired by Gov. Tom Ridge, the first Secretary of the U.S. Department of Homeland Security, and the Collaborative’s efforts will continue in the coming months as the new Administration tackles these issues.

Based on input from Collaborative participants, Protect Our Power filed initial comments with DOE in December,[4] making recommendations in three areas:

• Establishing lists of approved or prohibited vendors/components;
• Establishing a system of testing and evaluation of equipment and software; and,
• Addressing implementation issues associated with any forthcoming order(s).

In the collective opinion of Protect Our Power and Collaborative participants, the most important attribute of implementing an effective supply chain framework is that it be developed in a collaborative manner.  While many asset owners and operators may use the same equipment, the risks to the grid and implementation challenges are not the same for each one. In order to protect the grid in a timely manner against the greatest risks, the development of any framework necessarily requires collaboration and cooperation across government (including intelligence agencies), asset owners and vendors.

Approved/Prohibited List

Protect Our Power did not recommend whether DOE should create approved or prohibited lists of vendors and/or equipment, but rather that if DOE does so, the lists should be based on input from assets owners and intelligence agencies who fully know and understand the risks to the electric power grid.  Of note, taking this collaborative approach is consistent with the recommendations of the Congressionally-appointed Cyberspace Solarium Commission[5] and other experts.[6]

Testing and Evaluation

DOE should establish a system of testing and evaluation of equipment and software and, together with asset owners and intelligence agencies, determine priorities for testing based on potential impact to the grid.  Given the myriad of equipment installed on the electric grid, it is urgent that a prioritization process is established. The industry, vendors, and the intelligence community, in coordination with U.S. government agencies need to determine which components constitute the greatest risk to the electric grid, as well as the type of expertise needed for testing.

Protect Our Power recommends creating a tiered system to determine not only the most critical equipment for testing, but also provide a list of qualified testers for different types of equipment.  For example, the National Laboratories have testing capabilities and access to intelligence information, but the ability of the National Laboratories to test all important equipment quickly is limited.[7]  Therefore, other qualified testing organizations should be utilized, based on their expertise.  Collaborative government-industry efforts are needed to jump-start the testing in an orderly manner.

Implementation Issues

DOE should consider the practical implications of any order, including whether any prohibitions would be retroactive, and ensure that utilities can recover costs incurred. Additionally, any determination that only certain equipment or software may be used on the electric grid must account for real-world practical considerations and risks to the system.  For example, limiting vendors of equipment or software may result in backlogs, which could delay the installation of equipment or software needed to maintain reliability.  This is even more important if prohibitions are made retroactive.[8]  As Protect Our Power noted in its comments to DOE, DOE’s Prohibition Order applied only for future transactions,[9] which will help support security objectives without creating undue strain on current operations.[10]

In addition, DOE needs to be sensitive to the need for asset owners to recover the costs of complying with requirements that limit equipment or software they may install on the electric grid. Cost recovery for grid investments depends on the regulator (FERC or a state commission); whether transmission rates are bundled with generation and distribution; and, whether or not an asset owner has a tariff under which it can recover increased costs.[11]  Finally, liability protections for the implementation of a testing and evaluation program need to be established.

Other Considerations

Implementing a supply chain program based on U.S. national security needs must consider the breadth of the international supply chain and the myriad challenges that presents.  For example, lower-level vendors of sub-components or software could change after testing is completed. Or, as seen with the hack of the SolarWinds software, a product that is approved on a particular day can be compromised the next day. As such, any process for implementing the May 1, 2020, Executive Order needs to consider how to deal with “moving targets.”

The importance of securing the U.S. power industry supply chain cannot be overstated – electricity is the lifeblood of our economy and powers every other sector of our critical infrastructure.  If the “blood” supply is tainted or compromised, the rest of the body will eventually cease to function.