DOE O 438.1, Securing the Bulk-Power System

AVAILABLE ONLINE AT: INITIATED BY: www.directives.doe.gov Office of Electricity U.S. Department of Energy ORDER Washington, DC Approved: 1-15-2021 SUBJECT: SECURING THE BULK-POWER SYSTEM 1. PURPOSE. To require elements of the Department of Energy (DOE) to establish procedures for implementing Secretarial orders that prohibit the acquisition, importation, transfer, or installation of bulk-power system (BPS) electric equipment (transaction) by DOE elements. On May 1, 2020, the President issued Executive Order 13920, Securing the United States Bulk-Power System, (EO 13920 or EO) finding that threats by foreign adversaries to the security of the BPS constitute a national emergency. Section 1 of EO 13920 authorizes the Secretary to prohibit a transaction when it: 1) involves a foreign adversary, as defined in Attachment 2, or an associated national thereof that has any interest therein (including through an interest in a contract for the provision of the equipment); and 2) poses an undue or unacceptable risk, as defined in Attachment 2. DOE O 438.1 implements EO 13920 as it pertains to Departmental BPS transactions. 2. CANCELS/SUPERSEDES. None. 3. APPLICABILITY. a. Departmental Applicability. This Order applies to any Departmental element that acquires, manages, operates, or maintains BPS electric equipment, as defined in Attachment 2, including the Power Marketing Administrations. (1) The Administrator of the National Nuclear Security Administration (NNSA) must assure that NNSA employees comply with their responsibilities under this directive. Nothing in this directive will be construed to interfere with the NNSA Administrator’s authority under section 3212(d) of Public Law (P.L.) 106-65 to establish Administration-specific policies, unless disapproved by the Secretary. (2) This Order applies to the Bonneville Power Administration (BPA). The BPA Administrator will assure that BPA employees and Contractors comply with their respective responsibilities under this Order consistent with BPA’s self-financing, procurement, and other statutory authorities. (3) This Order does not apply to BPS equipment acquisition and use for assessment and testing of such equipment in support of DOE and other federal agencies for the purposes of threat and vulnerability assessments. b. DOE Contractors. Except for the equivalencies/exemptions in paragraph 3.c., the Contractor Requirements Document (CRD), Attachment 1, sets forth the requirements of this Order that will apply to contracts that include the CRD. DOE O 438.1 http://www.directives.doe.gov/ 2 DOE O 438.1 1-15-2021 Specifically, the CRD or its requirements must be included in the following: (1) Management and Operating (M&O) contracts; (2) Non-M&O Major Site/Facility contracts; and (3) Other contracts, as determined by Heads of Departmental Elements or Heads of Field Elements, in accordance with paragraphs 5.d.(5) and 5.e.(5). c. Equivalencies/Exemptions for DOE O 438.1. Equivalencies and Exemptions to this Order are processed in accordance with DOE O 251.1, Departmental Directives Program, current version. Equivalency. In accordance with the responsibilities and authorities assigned by Executive Order 12344, codified at 50 USC sections 2406 and 2511, and to ensure consistency throughout the joint Navy/DOE Naval Nuclear Propulsion Program, the Deputy Administrator for Naval Reactors (Director) will implement and oversee requirements and practices pertaining to this Directive for activities under the Director's cognizance, as deemed appropriate.

4. REQUIREMENTS. a. Prohibition Process. Applicable Departmental elements must have a process in place to implement any Secretarial prohibitions (acquiring, importing, transferring, or installing for use in their respective areas of responsibilities BPS electric equipment that has been manufactured or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of foreign adversaries and poses undue or unacceptable risk). A transaction that meets the conditions set forth in the preceding sentence is referred to herein as a Prohibited Transaction. Applicable Departmental elements are prohibited from acquiring, importing, transferring, or installing BPS electric equipment identified in Attachment 3 (Regulated Equipment) that has been manufactured or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of the People’s Republic of China (PRC). b. Procurement. Applicable Departmental elements must include a section in their BPS electric equipment procurement requirements that makes the consideration of potential risks to national security as integral to their procurement decision- making processes and related infrastructure risk management for Contractors, their subcontractors, and vendors at all tiers in accordance with the Federal Acquisition Regulation, other applicable regulations and guidance, or technical specifications that may include restrictions on parts from foreign adversaries. c. Supply Chain Risk Management (SCRM). Applicable Departmental elements shall utilize a SCRM program, such as the Office of the Chief Information Officer’s SCRM program or a functional equivalent, to assess vendors and products through multiple risk lenses such as national security, intelligence, DOE O 438.1 3 1-15-2021 cybersecurity, compliance, and finance to make informed risk-based decisions for BPS electric equipment. d. Compliance. Not later than ninety (90) days after the issuance of this Order, applicable Departmental elements shall: (1) Establish an internal monitoring process to track compliance with requirements 4.a. through 4.c. above. (2) Conduct a high-level assessment of existing supply chains to identify potential vulnerabilities for Prohibited Transactions, to include an action plan to address those vulnerabilities. Not later than one (1) year after the completion of the ninety (90) day assessment, applicable Departmental elements shall complete a full assessment of existing supply chains, to include, at minimum, first-tier subcontractor vendors, that identifies, mitigates, and/or eliminates Prohibited Transactions. e. Waivers. The Secretary may waive any term of this Order based on sufficient justification documented in a Determinations and Findings (D&F). 5. RESPONSIBILITIES. a. Secretary. (1) Establishes Departmental policy with respect to securing BPS electric equipment transactions as described in the EO. (2) Determines whether to prohibit transactions of particular BPS electric equipment, or particular vendors, as authorized by section 1 of EO 13920, and exercises such authority granted to the Secretary by EO 13920. (3) Periodically reviews the list of foreign adversaries in consultation with appropriate agency heads and may amend the list at any time. (4) Provides final approval or disapproval of waiver requests under paragraph 4.e. above. b. Deputy Secretary. Carries out any duties listed under paragraph 5.a. of this section, as may be delegated by the Secretary.

c. Assistant Secretary, Office of Electricity (OE). (1) Establishes and maintains oversight of this Order. (2) Consults with and provides assistance to the Heads of Departmental Elements and Heads of Field Elements to establish policies and processes for implementation of this Order. 4 DOE O 438.1 1-15-2021 (3) Maintains the list of Prohibited Transactions, as determined by the Secretary, and notifies the Head of Departmental Elements and Head of Field Elements of any changes. This includes collecting and maintaining the list of known Contractors, vendors, and specific equipment or components to be excluded to prevent Prohibited Transactions. These lists will be provided to the DOE and NNSA Senior Procurement Executives (SPEs) for promulgation through the DOE/NNSA procurement systems. (4) Reviews and provides approval/disapproval recommendations to the Secretary for waiver requests under paragraph 4.e. above. (5) Maintains a list of approved/disapproved waiver recommendations and their justifications. d. Heads of Departmental Elements. (1) Determine which sites and facilities under their purview engage in BPS electric equipment transactions. (2) Establish processes to implement prohibitions determined by the Secretary. (3) Require the incorporation of national security considerations for BPS electric equipment procurement actions and incorporate SCRM processes when evaluating BPS vendors and products. (4) Ensure compliance with this Order under paragraph 4.d. above. (5) Determine which contracts under their purview must incorporate the CRD or its requirements, when the update is needed (i.e., at next contract award, renewal, extension, or other), and notify appropriate Heads of Contracting Activity (HCAs) regarding the CRD’s applicability to those contracts. (6) Identify Contractor noncompliance with the CRD and inform the Contracting Officer for action. (7) Submit to the Secretary requests for waivers under paragraph 4.e. above. e. Heads of Field Elements. (1) Determine which sites and facilities under their purview engage in BPS electric equipment transactions. (2) Establish processes to implement prohibitions determined by the Secretary. DOE O 438.1 5 1-15-2021 (3) Require the incorporation of national security considerations for BPS electric equipment procurement actions and incorporate SCRM processes when evaluating BPS vendors and products. (4) Ensure compliance with this Order under paragraph 4.d. above. (5) Oversee processes to assess Contractors, their subcontractors, and vendors at all tiers to identify and eliminate Prohibited Transactions. (6) Determine which contracts under their purview must incorporate the CRD or its requirements, and notify appropriate HCAs regarding the CRD’s applicability to those contracts. (7) Identify Contractor noncompliance with the CRD and inform the Contracting Officer for action. (8) Submit to the Secretary requests for waivers under paragraph 4.e. above. f. Senior Procurement Executives (SPEs). Update acquisition policy and provide for appropriate oversight process of the DOE/NNSA procurement systems to ensure compliance with this order. g. Heads of Contracting Activity (HCAs). (1) After notification from Heads of Departmental Elements or Heads of Field Elements, notify Contracting Officers under their purview to incorporate the CRD of this Order or its requirements into applicable contracts. (2) Implement processes to implement prohibitions determined by the Secretary.

(2) Oversee processes to assess Contractors, their subcontractors, and vendors at all tiers to identify and eliminate Prohibited Transactions. h. Contracting Officers. (1) Incorporate national security considerations for BPS electric equipment procurement actions and incorporate SCRM processes when evaluating BPS electric equipment vendors and products. (2) When notified of contract applicability, ensure that the CRD of this Order or its requirements are incorporated into applicable contracts under their purview. (3) Communicate official Departmental decisions to Contractors, as needed. 6 DOE O 438.1 1-15-2021 (4) Provide information to DOE OE and the DOE and NNSA SPEs regarding identified Contractors, vendors, equipment, or components that meet the definition of a prohibited transaction as defined in Attachment 2. (5) Notify the Contractor in writing of any noncompliance with the CRD. 6. INVOKED STANDARDS. This Order does not invoke any DOE technical standards or industry standards as required methods. Note: DOE O 251.1D, Appendix J provides a definition for “invoked technical standard.” 7. REFERENCES. a. Executive Order 13920 of May 1, 2020, Securing the United States Bulk-Power System. b. “Prohibition Order Securing Critical Defense Facilities,” December 17, 2020. c. DOE O 251.1, Departmental Directives Program, current version. 8. DEFINITIONS. Definitions are addressed in Attachment 2. 9. CONTACT. For assistance, contact the Office of Electricity at 202-586-1411 and bulkpowersystemEO@hq.doe.gov. BY ORDER OF THE SECRETARY OF ENERGY MARK MENEZES Deputy Secretary mailto:bulkpowersystemEO@hq.doe.gov DOE O 438.1 Attachment 1 - CRD, Contractors Only 1-15-2021 Page 1-1 CONTRACTOR REQUIREMENTS DOCUMENT DOE O 438.1, Securing the Bulk-Power System Regardless of the performer of the work, the Contractor is responsible for complying with the requirements of this Contractor Requirements Document (CRD). The Contractor is responsible for flowing down the requirements of this CRD to subcontractors at any tier to the extent necessary to ensure the Contractor’s compliance with the requirements. In addition to the requirements set forth in this CRD, Contractors are responsible for understanding Attachments 2 and 3 of DOE O 438.1, referenced in and made a part of this CRD, which provide information applicable to contracts in which this CRD or its requirements are inserted. 1. REQUIREMENTS. a. Prohibition Process. Contractors must have a process in place to implement any Secretarial prohibitions (acquiring, importing, transferring, or installing for use in their in respective areas of responsibilities BPS electric equipment defined in Attachment 2 that has been manufactured or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of foreign adversaries, as defined in Attachment 2, and poses an undue or unacceptable risk, as defined in Attachment 2). A transaction that meets the conditions set forth in the preceding sentence is referred to herein as a Prohibited Transaction. Applicable contractors are prohibited from acquiring, importing, transferring, or installing BPS electric equipment identified in Attachment 3 (Regulated Equipment) that has been manufactured or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of the People’s Republic of China (PRC).

b. Procurement. Contractors must include a section in their BPS electric equipment procurement planning documents that makes the consideration of potential risks to national security as integral to their procurement decision-making processes and related infrastructure risk management for themselves, their subcontractors, and vendors at all tiers in accordance with applicable regulations and guidance or technical specifications that may include restrictions on parts from foreign adversaries. c. Supply Chain Risk Management (SCRM). Contractors shall utilize a SCRM program, approved by the Contracting Officer, to assess vendors and products through multiple risk lenses such as national security, intelligence, cybersecurity, compliance, and finance to make informed risk-based decisions for BPS electric equipment. d. Compliance. Not later than ninety (90) days after incorporation of this CRD into a contract, Contractors shall: (1) Establish an internal monitoring process to track compliance with requirements 1.a. through 1.c. above. Attachment 1 - CRD, Contractors Only DOE O 438.1 Page1-2 1-15-2021 (2) Conduct a high-level assessment of existing supply chains to identify potential vulnerabilities for Prohibited Transactions, to include an action plan to address those vulnerabilities. (3) Report the internal monitoring processes and high-level assessment to their cognizant Contracting Officer, who then provides that report to their Head of Departmental Element or Head of Field Element. Not later than one (1) year after the completion of the ninety (90) day assessment, the Contractors shall: (1) Complete a full assessment of existing supply chains, to include, at minimum, first-tier subcontractor vendors, that identifies, mitigates, and/or eliminates Prohibited Transactions. (2) Report the full assessment to their cognizant Contracting Officer, who then provides that report to their Head of Departmental Element or Head of Field Element. e. Noncompliance. If a Contracting Officer notifies the Contractor in writing of any noncompliance with this CRD, the Contractor must take appropriate action to ensure that, within thirty (30) days, or another reasonable time period as determined by the Contracting Officer, the Contractor is in compliance with the requirements of the CRD. DOE O 438.1 Attachment 2 – Federal Employees and Contractors 1-15-2021 Page 2-1 ATTACHMENT 2: DEFINITIONS This Attachment provides information and/or requirements associated with DOE O 438.1 as well as information and requirements applicable to contracts in which the associated CRD (Attachment 1 to DOE O 438.1) or its requirements are inserted. 1. Bulk-Power System (BPS). (i) Facilities and control systems necessary for operating an interconnected electric energy transmission network (or any portion thereof); and (ii) electric energy from generation facilities needed to maintain transmission reliability. This definition includes transmission lines rated at 69,000 volts (69 kV) or more, but does not include facilities used in the local distribution of electric energy. 2. BPS Electric Equipment. Items used in BPS substations, control rooms, or power generating stations, including reactors, capacitors, substation transformers, coupling capacitor potential devices (referred to in EO 13920 as current coupling capacitors and coupling capacity voltage transformers), large generators, backup generators, substation voltage regulators, shunt capacitor equipment, automatic circuit reclosers, instrument transformers, protective relaying, metering equipment, high voltage circuit breakers, generation turbines, industrial control systems, Supervisory Control And Data Acquisition (SCADA) systems, distributed control systems, safety instrumented systems, lightning arrestors, line traps (also known as wave traps), and motor operated air break switches.

3. Foreign Adversary. Any foreign government or foreign non-government person engaged in a long-term pattern or serious instances of conduct significantly adverse to the national security of the United States or its allies or the security and safety of United States persons. a. The Secretary has determined that the following foreign governments constitute the current list of foreign adversaries for the purposes of EO 13920: (1) The People’s Republic of China, (China); (2) the Republic of Cuba (Cuba); (3) the Islamic Republic of Iran (Iran); (4) the Democratic People’s Republic of Korea (North Korea); (5) the Russian Federation (Russia); and (6) the Bolivarian Republic of Venezuela (Venezuela). b. The Secretary’s determination of foreign adversaries is solely for the purposes of EO 13920. c. The Secretary will periodically review this list in consultation with appropriate agency heads and may amend this list at any time regarding a foreign government Attachment 2 – Federal Employees and Contractors DOE O 438.1 Page 2-2 1-15-2021 or foreign non-government person. DOE will amend Attachment 2 to DOE O 438.1 with changes to the list. 4. Person Owned By, Controlled By, or Subject to the Jurisdiction or Direction of a Foreign Adversary. Any person, wherever located, who acts as an agent, representative, or employee, or any person who acts in any other capacity at the order, request, or under the direction or control, of a foreign adversary or of a person whose activities are directly or indirectly supervised, directed, controlled, financed, or subsidized in whole or in majority part by a foreign adversary; any person, wherever located, who is a citizen or resident of a nation-state controlled by a foreign adversary; any corporation, partnership, association, or other organization organized under the laws of a nation-state controlled by a foreign adversary; and any corporation, partnership, association, or other organization, wherever organized or doing business, that is owned or controlled by a foreign adversary. 5. Prohibited Transaction. A transaction in which applicable Departmental elements and Contractors are prohibited from acquiring, importing, transferring, or installing for use in their respective territories, certain BPS electric equipment, as determined by the Secretary, that has been manufactured or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of a foreign adversary and poses an undue or unacceptable risk. 6. Regulated Equipment. Certain BPS electric equipment identified in this Order that Departmental elements and Contractors are prohibited from acquiring, importing, transferring, or installing. The term Regulated Equipment includes software, firmware and digital components that control the operation of Regulated Equipment and are manufactured or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of foreign adversaries 7. Transaction. Any acquisition, importation, transfer, or installation of any BPS electric equipment. 8. Undue or Unacceptable Risk. Those risks identified in section 1(a)(ii) of EO 13920. a. Risk of sabotage to or subversion of the design, integrity, manufacturing, production, distribution, installation, operation, or maintenance of the BPS in the United States; b. Risk of catastrophic effects on the security or resiliency of United States critical infrastructure or the economy of the United States; or

c. An otherwise unacceptable risk to the national security of the United States or the security and safety of United States persons. DOE O 438.1 Attachment 3 – Federal Employees and Contractors 1-15-2021 Page 3-1 (and 3-2) ATTACHMENT 3: REGULATED EQUIPMENT This Attachment provides information and/or requirements associated with DOE O 438.1 as well as information and requirements applicable to contracts in which the associated CRD (Attachment 1 to DOE O 438.1) or its requirements are inserted. 1. Power transformers with low-side voltage rating of 69 thousand volts (kV) or higher and associated control and protection systems like load tap changer, cooling system, and sudden pressure relay. 2. GSU transformers with high-side voltage rating of 69 kV or higher and associated control and protection systems like load tap changer, cooling system, and sudden pressure relay. 3. Circuit breakers operating at 69 kV or higher. 4. Reactive power equipment (Reactors and Capacitors) 69 kV or higher. 5. Associated software and firmware installed in any equipment or used in the operation of items listed in 1 through 4. 1. PURPOSE 2. CANCELS/SUPERSEDES 3. APPLICABILITY. a. Departmental Applicability b. DOE Contractors c. Equivalencies/Exemptions for DOE O 438.1. 4. REQUIREMENTS. a. Prohibition Process. b. Procurement. d. Compliance. e. Waivers. 5. RESPONSIBILITIES. a. Secretary. b. Deputy Secretary. c. Assistant Secretary, Office of Electricity (OE). d. Heads of Departmental Elements. e. Heads of Field Elements. f. Senior Procurement Executives (SPEs). g. Heads of Contracting Activity (HCAs). h. Contracting Officers. 6. INVOKED STANDARDS 7. REFERENCES. 8. DEFINITIONS 9. CONTACT ATTACHMENT 1. CONTRACTOR REQUIREMENTS DOCUMENT 1. REQUIREMENTS. a. Prohibition Process. b. Procurement. c. Supply Chain Risk Management (SCRM). d. Compliance. e. Noncompliance. ATTACHMENT 2: DEFINITIONS 1. Bulk-Power System (BPS) 2. BPS Electric Equipment. 3. Foreign Adversary 4. Person Owned By, Controlled By, or Subject to the Jurisdiction or Direction of a Foreign Adversary 5. Prohibited Transaction. 6. Regulated Equipment 7. Transaction. 8. Undue or Unacceptable Risk. Those risks identified in section 1(a)(ii) of EO 13920. ATTACHMENT 3: REGULATED EQUIPMENT