On August 26, 2026, the President declared a national emergency to secure America’s bulk-power system. Executive Order 14420 doesn’t just restrict future purchases of foreign grid equipment — it puts already-installed equipment in scope, and it gives the Department of Energy 120 days to publish the rules.
If you operate grid-scale battery storage (BESS), utility-scale solar, or wind connected to the bulk power system, this post explains what the order covers, where your real exposure is, and a practical way to comply in weeks.
What does EO 14420 actually cover?
The order’s definition of “bulk-power system electric equipment” lists:
- Battery energy storage systems (BESS), including the battery management systems (BMS) and energy management systems (EMS) that control them
- Utility-scale and grid-connected inverters (solar PCS, storage PCS)
- Substation transformers, generators, and backup generators
- Protective relays, RTUs, PLCs, IEDs, and distributed control systems
And the big one – the door by which all of the above are potentially compromised:
- The “associated software, firmware, remote access capabilities, and lifecycle maintenance” behind all of it.
DOE must publish implementing rules within 120 days. And the Secretary of Energy may impose conditions on current equipment, explicitly including “isolation, disconnection, replacement, or removal.” This is also important – isolation is often the only viable option.
Note: local distribution (residential and C&I solar) is excluded. This order is about the bulk grid.
Why battery storage is exposure #1
Ask any grid team where the foreign-equipment risk concentrates, and the answer is grid-scale batteries:
- The cells are often Chinese. CATL, BYD, EVE Energy, REPT, and Gotion supplied the large majority of grid-scale battery cells installed in the U.S., including systems integrated by Western vendors.
- The controllers are a massive cyber risk. Every BESS ships with a BMS running vendor firmware, an EMS or site controller, and (usually) a standing connection back to the OEM or integrator for monitoring, warranty analytics, and remote support.
- A battery fleet is a grid-stability weapon. Storage is always grid-synchronized, always network-connected, and increasingly provides frequency response. A coordinated trip or oscillation across a fleet is not a data breach — it’s a blackout mechanism.
In fact, it’s already happened.
- A public example is Duke Energy disconnected and removed CATL batteries at Marine Corps Base Camp Lejeune over exactly these concerns.
- Researchers found undocumented cellular radios inside some Chinese-made inverters and batteries.
Right behind BESS: installed utility-scale solar inverters (Sungrow and other foreign fleets stay in the ground for 20+ years and the OEM remote-access channel itself, which is a risk on every fleet regardless of whose name is on the hardware.
Why can’t we just replace the Chinese equipment?
Because the replacements don’t exist yet and the grid needs to stay online. Domestic and allied battery-cell and inverter manufacturing is scaling, but it is years away from covering the installed base, but the grid needs that storage online. Ripping out working gigawatts during an energy-demand boom is an outage.
That’s why the EO’s own language points to the practical answer: isolation. If the equipment can’t be reached (not from the internet, not from the vendor’s cloud, not laterally from the site LAN) then its firmware, its backdoors, and its unpatched CVEs have no path to exploit.
What does “isolation” look like in practice?
Not air-gapping. A BESS still must receive dispatch signals from the ISO/RTO and send telemetry to its operator. The goal is identity-defined reachability: every remaining connection is an explicitly authorized, outbound-initiated, encrypted, audited conduit. An unauthorized user or machine sees nothing – there is not network path.
With microsegmentation done the NetFoundry way:
- Each BESS container becomes an enclave. Deny-all inbound to the BMS, EMS, and PCS. No listening ports. No lateral path between containers, even on the same flat site LAN.
- Standing vendor VPNs are retired. OEM remote support becomes just-in-time, identity-verified, scoped to a single named system, and fully audited. This is the “remote access and lifecycle maintenance” channel the EO names.
- Telemetry and dispatch ride egress-only conduits to named services — the ISO’s dispatch endpoint, the OEM’s ingest API. Nothing else.
- You get evidence, not assertions. Scan the site: nothing answers. Every session is tagged with the identity and policy that allowed it. That’s a compensating-control record you can hand to DOE, your NERC CIP auditor, and your insurer.
No firewall changes. No VLAN redesign. No maintenance-window roulette. Software connectors deploy on existing compute, run in passive mode first so you see every flow before enforcing, and protect the first site in days.
One caveat: rogue radios need an RF survey and physical removal.
The 120-day plan, aligned to the DOE rulemaking clock:
| Phase | Days | What happens |
| Discover | 0–15 | Inventory covered equipment; deploy in passive mode; see every flow |
| Isolate | 15–45 | Enclave BESS containers and inverter blocks; deny-all inbound; retire standing VPNs |
| Broker | 45–90 | Egress-only conduits for dispatch and telemetry; JIT audited vendor access; RF survey |
| Prove | 90–120 | Fleet-wide rollout; scan-verified evidence mapped to the DOE rules as they land |
FAQ
Does EO 14420 apply to equipment I already own?
Yes. The Secretary of Energy may impose conditions on the continued use, operation, maintenance, and servicing of equipment acquired before the order, including isolation or disconnection. The installed base is explicitly in scope.
Are CATL, BYD, EVE, REPT, or Gotion named in the executive order?
No vendors or countries are named. The order defines “covered foreign entities” by reference to arms embargoes, sanctions regimes, and Secretary of Energy determinations. The implementing rules (due within 120 days) will identify at-risk equipment. But Chinese battery and inverter suppliers are the widely understood focus, given events like the Camp Lejeune CATL removal and the discovery of undocumented radios in Chinese-made inverters and batteries.
Is microsegmentation an accepted compensating control?
Segmentation and isolation are long-established compensating controls under frameworks like NERC CIP, PCI DSS, and IEC 62443. This EO explicitly lists “isolation” among the conditions DOE may impose. The strength of the control depends on being able to prove it: identity-based policy plus external scan verification produces evidence a tester can independently confirm.
Does this replace my firewalls or my Purdue model?
No. Zones, firewalls, and existing OT protections stay exactly where they are. The overlay adds identity-defined conduits on top. This means the zone remains; the conduit becomes identity- and service-defined.
What about the potential hidden cellular radios in Chinese inverters and batteries?
That requires an RF survey and physical removal. What isolation does: the compromised device can no longer reach anything else on your network, and every sanctioned path is authenticated and audited, so the rogue channel is contained to the device itself.
