EEI pushes for Energy Dept. transparency on implementing Trump order securing bulk power systems

“The electric power industry is the backbone of the American economy and a critical component of the national security of the United States. As such, implementation of the Executive Order must recognize the operational realities of the electric sector, including the profound transformation currently underway across the nation's electric infrastructure,” EEI writes in an Oct. 9 filing to DOE.

DOE issued a Sept. 9 request for information to gather feedback on implementing President Trump’s Aug. 26 executive order to prohibit certain transactions with foreign nationals that pose a risk to national security for U.S. bulk power systems.

The filing says, “Electric companies are developing and constructing transmission lines and facilities, generation resources, substations, control centers, energy storage systems, and other critical assets needed to serve the unprecedented load growth driven by data centers, Super Intelligence, advanced manufacturing, and defense-related industries.” “Policies affecting equipment procurement and supply chains have broader implications that extend beyond security considerations and can impact the ability of the sector to meet growing customer requirements,” according to EEI. EEI suggests specific actions for DOE “to provide sufficient clarity and notice of prohibited or conditioned transactions” including: Publish and maintain a definitive list of “Covered Foreign Entities” for purposes of the Executive Order; Establish a process for updating such lists, including an annual review of current Covered Foreign Entities with input from industry on the impacts of any changes; Provide sufficient implementation timelines following additions to the list; Create safe harbors for reliance on supplier certifications and representations; and Establish provisions when information is unavailable despite good-faith efforts. Cybersecurity comes up in the context of the North American Electric Reliability Corporation’s Critical Infrastructure Protection Reliability Standards, which EEI argues “already establish a defense-in-depth framework for mitigating many of the risks addressed by the Executive Order.” The filing says, “In particular, CIP-013 requires applicable entities to develop and implement supply chain cybersecurity risk management plans for the planning and procurement of applicable Bulk Electric System Cyber Systems, a category closely aligning with the Executive Order’s bulk-power system electric equipment.” “These plans address applicable risks including vendor remote access, disclosure of known vulnerabilities, verification of software integrity and authenticity, and coordination concerning vendor-identified incidents,” according to the filing.

EEI urges DOE to harmonize EO implementation with the existing reliability standards framework and to “avoid imposing parallel or conflicting requirements that address the same risks.” The filing says, “DOE’s approach should be tailored to addressing strategic risks associated with bulk-power system electric equipment or any critical component, software, firmware, digital service, maintenance service, or remote-access capability associated with such equipment developed or influenced by Covered Foreign Entities.” “Equipment, systems, and other activities already subject to CIP-013 and related CIP Reliability Standards should be exempt from potentially duplicative DOE requirements or should be considered pre-qualified,” according to the filing. EEI proposes, “If DOE identifies a material risk not adequately addressed by existing standards, it should clearly define the perceived gap and coordinate with industry on the potential concern before imposing additional obligations. This approach would allow DOE to focus on potential regulatory gaps and the highest-consequence national security risks while minimizing conflicting requirements, duplication of existing controls, unnecessary compliance burdens, and impacts to affordability and equipment availability.” Electric companies are also using standards from the National Institute of Standards and Technology and the Institute of Electrical and Electronics Engineers to bolster their security practices, the filing says, as well as “robust information sharing processes and programs.” The filing highlights work through the Electricity Information Sharing and Analysis Cetner, the Cybersecurity and Infrastructure Security Agency and the FBI.