On August 26, 2026, the White House signed Executive Order 14420, declaring a national emergency related to foreign-sourced equipment in the U.S. bulk-power system.
At first glance, this may seem like an issue for utilities, operators, or regulators. It isn't.
This executive order is another signal that the federal government is increasingly viewing critical infrastructure through a national security lens. The question is no longer whether supply chain risk, operational technology risk, and infrastructure resilience belong in boardroom discussions. They do.
The question is whether organizations are prepared.
What Executive Order 14420 Requires
Executive Order 14420 gives the Department of Energy authority to block or unwind transactions involving equipment tied to foreign countries subject to U.S. sanctions or arms embargoes. The order applies to critical components that support the bulk-power system, including transformers, generators, protective relays, and industrial control systems.
More importantly, this is not just about future purchases. The government may require organizations to identify, isolate, or remove equipment already operating within critical infrastructure environments. The Department of Energy now has a defined timeline for issuing implementing guidance and recommending procurement changes.
For organizations that depend on critical infrastructure, the clock has started.
The Question Every Executive Should Be Asking
The executive question is straightforward:
Do you know where foreign-manufactured equipment exists within your environment, who has access to it, and what actions you would take if regulators or an incident required you to isolate or replace it?
Many organizations cannot answer that question with confidence today.
Over time, equipment inventories, vendor relationships, maintenance providers, and remote access pathways accumulate across business units, systems, and third parties. Visibility becomes fragmented. Ownership becomes unclear.
What was once considered an operational challenge has become a resilience and national security issue.
And this extends well beyond traditional utilities.
Organizations that operate data centers, manufacturing facilities, transportation networks, healthcare systems, and defense-related environments all depend on the infrastructure this order is designed to protect. Whether you own grid equipment directly is not the point.
Your business depends on systems that do.
Why Supply Chain Risk Is Now a Boardroom Issue
For years, organizations have treated operational technology, supply chain security, cyber risk, and resilience as separate conversations.
They are not.
Executive Order 14420 reflects a broader reality: the systems that power our economy, support national defense, and deliver essential services are deeply interconnected. A vulnerability in one area can quickly become a business problem, a public safety issue, or a national security concern.
Organizations with a clear understanding of their infrastructure, suppliers, and third-party dependencies will be in a much stronger position to adapt as requirements evolve.
Organizations without that visibility will be forced to answer difficult questions under increasingly compressed timelines.
Three Questions Leaders Must Answer Now
Leaders do not need to become power systems experts to take action. They do need clear answers to three questions:
- Where in our environment is foreign-manufactured bulk-power equipment in use today, and who supplied it?
- Who has remote or privileged access to that equipment, and could that access be restricted immediately if necessary?
- Who owns these answers on an ongoing basis across the organization?
If those questions cannot be answered quickly, that is the finding.
At Fortress, we have long believed that resilience starts with visibility. Organizations cannot manage risk they cannot see, and they cannot respond effectively to policy changes, cyber events, or supply chain disruptions without a clear understanding of the systems and relationships they depend on.
Executive Order 14420 gave organizations a deadline.
It did not give them a plan.
The organizations that start building that plan now will be far better positioned than those waiting for regulation, disruption, or crisis to force the conversation.
