What Happened
On January 15, 2025, the Trump administration issued an executive order banning the acquisition and installation of foreign-made technology in bulk-power systems. This order targets equipment managing transmission lines rated at 69,000 volts or higher, including substations, control rooms, power generating stations, and associated software or firmware that could be remotely accessed or updated by foreign governments.
The White House labeled this equipment an "unusual and extraordinary threat" to national security, citing vulnerabilities that foreign actors could exploit through digital backdoors or supply-chain manipulation. The order tasks the Defense, Commerce, and Energy Departments with reviewing transactions involving bulk-power system equipment and requires federal agencies to create a pre-qualified vendor list within 120 days.
Timeline
January 2025: Water utilities in at least 12 states experienced cyberattacks. The Cybersecurity and Infrastructure Security Agency (CISA) observed malicious activity targeting over 100 internet-exposed systems in the water and wastewater sector.
January 15, 2025: Executive order issued banning foreign-made bulk-power system equipment.
Same day: The FBI disrupted a Chinese botnet used to breach the Federal Reserve, NASA, and other federal agencies managing critical infrastructure.
Also January 15: OpenAI and dozens of tech and finance companies issued a joint warning about AI-enabled cyberattacks becoming "far more widespread and sophisticated."
Within 120 days (by May 2025): Federal agencies must publish rules, regulations, and a list of pre-qualified equipment and vendors. Agencies must also submit plans for identifying, inventorying, isolating, monitoring, or replacing at-risk equipment currently in use.
Which Controls Failed or Were Missing
The incidents leading to this order reveal failures across multiple control domains:
Supplier security assessment (ISO/IEC 27001:2022 Annex A 5.19, 5.21, 5.22): Organizations failed to adequately assess the security posture of equipment suppliers before procurement. The presence of remotely accessible backdoors suggests vendor security reviews either didn't occur or didn't include architecture analysis and code review requirements.
Technology acquisition controls (SOC 2 CC6.3): Change management processes didn't enforce security evaluation criteria for new technology acquisitions. If your procurement workflow allows operational technology purchases without security architecture review, you're replicating this failure.
Supply chain risk management (ISO/IEC 27036 series): The absence of documented supplier risk tiers and ongoing monitoring meant organizations had no visibility into the geopolitical risk profile of their critical infrastructure vendors. When your supplier assessment checklist doesn't include questions about remote access capabilities, firmware update mechanisms, and data transmission pathways, you can't identify these vulnerabilities.
Asset inventory and classification (ISO/IEC 27001:2022 Annex A 5.9): Many affected organizations likely couldn't answer basic questions: Which of our systems contain foreign-made components? Which vendors have remote access? What data leaves our network boundary? The 120-day deadline for agencies to "identify, inventory, isolate, monitor, or replace" at-risk equipment suggests this information doesn't currently exist in accessible form.
Vendor access management (SOC 2 CC6.6, CC6.7): The concern over remotely accessible firmware points to inadequate controls around vendor privileged access. If suppliers can push updates without your approval workflow, authentication verification, or rollback capability, you've created an unmonitored attack vector.
What the Relevant Standards Require
ISO/IEC 27001:2022 Annex A 5.19 (Information security in supplier relationships) requires you to define and document information security requirements for each type of supplier relationship. For critical infrastructure equipment, this means specifying:
- Acceptable countries of origin for hardware and software components
- Required security certifications (FIPS-Validated Cryptography for encryption modules, for example)
- Prohibited remote access capabilities or required access controls
- Firmware update verification and approval processes
- Source code escrow or review rights for critical systems
Annex A 5.21 (Managing information security in the ICT supply chain) explicitly requires you to establish processes for managing risks associated with the ICT supply chain. This isn't optional. You need documented criteria for supplier selection, ongoing monitoring mechanisms, and contractual security requirements that you actually verify.
SOC 2 CC6.3 (Logical and Physical Access Controls) requires the organization to "consider the criticality of the asset in determining the level of controls" and implement controls over the acquisition and management of infrastructure and software. For bulk-power systems, this means your procurement process must include security architecture review before purchase orders get approved.
ISO/IEC 27036-1 (Information security for supplier relationships, Overview and concepts) provides the framework most organizations skip: categorizing suppliers by risk, defining security requirements proportional to that risk, and monitoring compliance throughout the relationship lifecycle.
Lessons and Action Items for Your Team
Conduct a supplier origin audit within 30 days: Create a spreadsheet listing every vendor with access to your production environment, the country where their software is developed, where their hardware is manufactured, and what remote access they maintain. If you can't complete this in 30 days, your asset inventory control has failed.
Implement geopolitical risk scoring: Add a supplier risk tier to your vendor management program that accounts for country of origin, ownership structure, and potential foreign government influence. This isn't about blanket country bans, it's about applying proportional controls. A supplier in a high-risk tier might require on-premises deployment instead of SaaS, source code review, or contractual prohibitions on data transfer.
Require vendor access justification and monitoring: Every vendor with remote access to your systems should have a documented business justification, an approved access period, and monitoring that alerts you when they connect. If your vendors can push firmware updates without your explicit approval, you're accepting the same risk that triggered this executive order.
Build security requirements into procurement: Your purchase approval workflow should block any acquisition of systems that process sensitive data or control critical operations until security architecture review is complete. The review should specifically address: authentication mechanisms, encryption standards, update processes, data flows, and vendor access requirements.
Test your incident response for supply chain compromise: Run a tabletop exercise where a critical vendor is compromised. Can you identify all systems that vendor touches? Can you isolate them? Do you have alternative suppliers identified? The agencies now scrambling to meet the 120-day deadline didn't have answers to these questions ready.
Document your risk treatment decisions: If you choose to continue using foreign-made equipment in critical systems, document why, what compensating controls you've implemented, and what your replacement timeline looks like. ISO/IEC 27001 Clause 6.1.3 requires you to retain documented information about risk treatment decisions. When the next executive order or regulation arrives, you'll need to prove you made informed choices.
The executive order doesn't just affect federal agencies and power companies. It signals that supply chain security for critical systems is moving from recommended practice to regulatory requirement. If your compliance program treats vendor management as a checkbox exercise rather than an ongoing risk assessment, you're building the same vulnerabilities this order attempts to address.
