이해관계자들은 외국산 전력망 부품에 대한 트럼프 행정부의 금지 조치가 지향하는 목적에는 동의했으나, 기능과 역량이 아닌 지역(국가) 기반 규제는 본질을 벗어나며 실효성과 비용 측면에서 우려가 있다고 Utility Dive가 보도했다.

President Donald Trump's recent executive order seeking to protect the bulk power system from foreign threats correctly identifies the risk of U.S. reliance on outside suppliers. But stakeholders told Utility Dive that mitigating those risks without stalling the grid's buildout or saddling ratepayers with even more costs will be tricky.

Executive Order 14421, issued Aug. 26, gives Secretary of Energy Chris Wright the power to block the installation of foreign-produced equipment "or any critical component, software, firmware, digital service, maintenance service, or remote-access capability associated with such equipment" that poses an "undue risk" to national security, either through intentional sabotage or supply chain disruption. The secretary also has the authority to order the removal and replacement of previously installed equipment.

The Department of Energy (DOE) has until Dec. 24 to publish rules and regulations implementing the order. In September, DOE asked industry and other stakeholders to weigh in.

Their responses show broad support for the order's intent but concern about how it will be implemented. Several respondents pointed out that security standards, especially for software that enables remote access, can matter more than country of origin, since flaws in any system can be exploited by anyone, anywhere.

The vast majority of stakeholder responses that took a position on the "function over origin" question favored DOE emphasizing functional controls over a software product's origin, according to data compiled by industry analyst Brendon Shank. Many respondents also asked DOE to take a phased approach to new compliance rules and to allow some vendors to "prequalify" as trustworthy. Utilities are projected to spend more than a trillion dollars on grid upgrades through 2030 and are racing to secure equipment contracts amid rising manufacturer backlogs.

"Supply chains are already approaching a breaking point for many categories of electrical industry products," said the National Electrical Manufacturers Association (NEMA), which represents more than 300 electrical equipment manufacturers.

"[W]e strongly encourage the DOE to consider the time, money and resources it takes to evaluate, redesign, develop and produce equipment that is made for the electrical system," it said. "At a time of high demand and longer lead times than during periods of more stable electricity growth, that is only further complicated by balancing timeliness with retooling or restructuring of production lines to meet new changes."

Until DOE releases its determinations, the industry faces considerable uncertainty and big open questions, said Alice Wu, a manager of federal policy at the clean energy nonprofit RMI.

Although the order instructs DOE to focus on transmission-related equipment and components rated 69 kV or higher, rather than the distribution system, it also puts distribution components linked to the bulk system with questionably sourced software under scrutiny, Wu said.

"It is not feasible for generation, transmission and distribution providers to rip-and-replace every piece of equipment and for DOE to check it," Wu told Utility Dive. "What is the secure proxy for that? … And what will the potential cost impacts to ratepayers be?"

## U.S. imports billions of dollars in grid components every year

The U.S. has imported more than $22 billion in bulk-power equipment since 2025, particularly from China, which would likely be the country most affected by the order, according to a recent Wood Mackenzie (WoodMac) analysis.

Transformers and substations are already in an estimated market shortage of 15% and 8%, respectively, in 2026, and "restrictions on the use of Chinese built units is going to further exacerbate the supply chain challenges," WoodMac said.

The market for 100 MVA power transformers is particularly exposed, it said, adding that the market for power transformers greater than 10 MVA has grown nearly 300% since 2020.

A separate analysis by RMI and BloombergNEF put the value of grid imports in 2025 at more than $30 billion. Mexico, Southeast Asia and the European Union together accounted for more than half of that, while China accounted for $3.5 billion and "other" countries for $7.4 billion.

## Cybersecurity a key vulnerability

NEMA and other stakeholders and experts applauded the order's emphasis on software, maintenance support and other services that introduce remote-access capabilities. They also pointed to existing security standards DOE could apply, from the North American Electric Reliability Corp., the National Institute of Standards and Technology, the Institute of Electrical and Electronics Engineers and others.

"Overall, this executive order focuses on the right security areas because it makes those who deploy critical infrastructure accountable for their software," said Aaron Rose, a security architect manager at Check Point Software Technologies, which assesses security for utilities and other companies.

Check Point sees an average of about 3,000 cyberattacks per large organization per week, Rose said in an interview with Utility Dive.

He added that DOE's software determinations will be complicated because "almost everything on the power system is software defined, controlled and driven."

DOE could ask for a software's source, who maintains it, who has remote access to it and where updates originate, Rose said. However, updates for most firmware, cloud control systems, substation systems and customer-owned devices come from open-source libraries or code already written for other uses, making their countries of origin difficult to identify. Eliminating all software of uncertain origin is impractical, he said.

Power system software may also be subcontracted to a third party, Rose continued. Hardware manufacturers may or may not have documentation on the software's developer or on who has remote access for updates, or be able to trace them, even with AI tools.

To avoid complicated decompiling by security teams while still meeting critical needs, DOE could require future updates and remote access to come from secure sources, he said.

Rose said it is unclear whether the costs of such measures would fall on software vendors, infrastructure owners or their customers.

An analysis of the order by the Rainey Center, a policy think tank, also questioned restrictions based on geography rather than capability and function.

"The risks the order names travel through code, connections, and control, and they work the same whether a device is built abroad or at home," it said. "A ban governs geography; a standard governs the risk, on every device."

The report recommended that DOE define risk through "a verifiable, technology-neutral standard" built on existing controls, along with a system for vendors to prequalify through independent U.S. testing.

## Protecting investments in growth

The order's flexibilities, such as phased compliance, can allow determinations that avoid negative economic impacts, said Danielle Russo, executive director of SAFE, a nonprofit advocacy group focused on U.S. national and economic security.

DOE can give power system manufacturers and developers the clarity they need by publishing lists of specific supply chain equipment and components that are secure, Russo said. That would avoid slowing the manufacturing investment and project development needed to meet load growth, she added.

In today's complex investment environment, uncertainties ranging from tariffs to changing political leadership can threaten investors with stranded assets, Russo said. "It is hard to blame them for being challenged by that."

DOE's security restrictions should be balanced with legislated incentives that provide long-term certainty, she said.