EO 14421 Implementation: What It Will Take to Verify Grid Equipment at Scale

Two battery energy storage controllers can arrive at the same substation yard with identical paperwork—a completed supply chain questionnaire, a supplier SBOM, a firmware image whose signature validates, and a country-of-origin representation. One of them might also carry cellular support in its firmware that, once enabled, would give someone outside the utility a path around the plant firewall. Nothing in the paperwork tells the two apart.

Executive Order 14421 asks three questions of every covered device on the bulk-power system: who built it, what's inside it, and what it can reach. Our analysis of the order covered what those questions mean for asset owners, and our guide to bulk-power system supply chain assurance works through the program in depth. The harder problem is EO 14421 implementation, which means answering those questions for every consequential device on the grid, based on evidence drawn from the equipment itself.

Finite State's response to DOE's request for information makes five recommendations toward that system:

1. Require deep supply-chain and product security assessment.
2. Turn findings into verified protections for installed equipment.
3. Scale verification through standards and qualified providers.
4. Make manufacturer evidence support trusted procurement.
5. Phase implementation and support utilities.

Taken together, they make substantive firmware assessment the common baseline for covered equipment, require independent verification where the consequences demand it, and keep the resulting evidence current and reusable across every utility that runs the same build.

We built them around two outcomes DOE has to deliver at once, protecting equipment already operating on the grid and letting utilities buy new equipment with confidence without stalling deployment. Both depend on the same evidence.

1. Firmware Is Where the Common Baseline Has to Start

Most of the assurance layers the sector relies on today, from questionnaires and certifications to CIP-013 plans, rest on what suppliers say about themselves, and none of them check those claims against the contents of the firmware as delivered. Our first recommendation is that DOE require substantive firmware assessment as the floor every covered product clears, and that floor should sit high. The assessment examines delivered firmware for privileges, listening services, remote access, update paths, and both known and previously unknown weaknesses. It reaches across supplier tiers into proprietary code and the firmware inside embedded modules, and it traces who controls build, signing, and updates. Our firmware binary analysis guide walks through how that works, no source code required.

Where firmware can't settle a question, DOE should define triggers for hands-on hardware, dynamic, or destructive testing in advance. Software analysis has limits too. Binary signals can show what libraries and suppliers code came from, while legal ownership and foreign control remain corporate-research and national-security questions, and DOE retains those determinations. This recommendation builds on NIST SP 800-161 and the Secure Software Development Framework (SP 800-218).

2. Installed Equipment Needs Verified Protections First

Section 2(b) of the order lets DOE impose conditions on foreign-made or -operated equipment already in service, on a spectrum that runs from identify and isolate through disconnect, remove, and replace. Our second recommendation treats the installed base as a parallel pathway. Firmware findings can be reused across every installation running the same build, so a utility doesn't have to pull every unit; what changes from site to site is the local network and the controls an operator relies on. Once analysis shows cellular support in that storage controller, the next question is whether the path is enabled at a given site.

The principle we'd most like the sector to adopt is planning for bounded compromise, because a compromised component cannot contain itself. For consequential equipment, that means defining the critical function, the independent protections around it, its safe state, and its path to trusted recovery, then testing all four.

3. CyTRICS Can Scale Through Standards and Qualified Testers

DOE already runs real firmware analysis through Cyber Testing for Resilient Industrial Control Systems (CyTRICS), run with the national laboratories. The program was built to examine selected products in depth, and the order needs that depth at a scale no laboratory program can staff on its own.

Our third recommendation extends CyTRICS concepts into a national framework. DOE sets equipment profiles and escalation criteria, suppliers provide evidence at every tier, and DOE qualifies independent testing bodies for defined scopes, requiring independent verification for designated high-consequence equipment. No such CyTRICS certification program exists today, so DOE would need to build one. Independence and testing depth stay separate decisions, and evidence-backed self-attestation fits only defined lower-risk profiles, subject to audit and escalation. The EU Cyber Resilience Act's conformity assessment model offers a precedent for private assessment capacity under public oversight, and ISASecure shows a similar pattern in industrial automation.

4. Manufacturer Evidence Should Outlive a Single Procurement

If you build grid equipment, our fourth recommendation is the one that most changes your work. Firmware, architecture, test results, and vulnerability dispositions should be tied to the specific build and hardware revision they describe, so one body of evidence supports many procurements and moves between authorized assessors. The order's concern with foreign control is legitimate, and domestic assembly alone (which puts equipment outside the definition of “foreign-produced”) doesn't eliminate the possibility of foreign control; the durable answer comes from the firmware.

Assessors also need continuing access to firmware, and commercial terms shouldn't be able to suppress a material finding. Security fixes should ship promptly and, where technically feasible, separately from feature changes, a principle the CRA writes into its vulnerability-handling requirements. Utilities keep control of installation.

5. Smaller Utilities Shouldn't Carry This Alone

A national program will succeed or fail at the cooperatives and public power systems that own bulk-power equipment without a dedicated product security team. Our fifth recommendation phases the work by consequence, publishes assessment profiles, and reuses findings whenever hardware, firmware, and operating assumptions match, so an assessment paid for once serves every owner of that build. Smaller utilities also need usable evidence and engineering support for procurement, mitigation, and updates. As the program grows, DOE should track assessment quality, coverage, missed findings in reference cases, time to an accepted decision, protections verified, operator effort, and cost.

Seven Fields Every Evidence Record Should Hold

Every recommendation depends on a common record that suppliers, assessors, utilities, and DOE can all read and reuse. Our response proposed a minimum version with seven fields.

Inventories should use SPDX or CycloneDX, with VEX documenting which findings don't apply and why. It's the same discipline we apply to verifying supplier SBOMs against the binary. Completed fields alone don't establish acceptability; acceptance depends on adequate coverage and conclusions the evidence supports.

EO 14421 Implementation Can Start Before the Rules

DOE's rules are due on or about December 24, 2026, and the evidence record is worth building under any version of them.

If you manufacture grid equipment, start keeping build-specific evidence for your highest-consequence product lines. If you own grid equipment, ask suppliers for it by build, and mark each device class you can't yet check as attested, not independently verified. Our Grid Supply Chain Assurance brief and Energy & Utilities page show how that record comes together.

Finite State has a commercial stake in this. We build firmware analysis software and provide expert assessment services. We told DOE we favor multiple qualified providers, because a national program that depends on any single vendor won't reach the scale the grid needs. Our platform builds a ground truth software inventory from delivered firmware, reconciles it against supplier SBOMs, and enumerates the interfaces and update paths each device exposes, with platform-generated threat assessments validated by our experts.

Every determination under the order will rest on evidence, and that evidence can start accumulating long before December.

Bring us firmware from one of your highest-consequence device classes, and we'll show you the evidence record it produces. Request a demo.