Regulatory Affairs news highlights: September 2026

 

Recent regulatory headlines we’re tracking include:

 

August executive order prohibits acquisition or installation of certain foreign-produced BPS electric equipment

President Donald Trump issued Executive Order 14420, “Declaring a National Emergency to Secure the United States Bulk-Power System” on Aug. 26. The order states that the use of foreign-produced bulk power system (BPS) electric equipment is enhancing the abilities of foreign actors to create and exploit vulnerabilities in the BPS. The order declares a national emergency regarding this threat and prohibits the acquisition or installation of certain foreign-produced BPS electric equipment (determined by the Department of Energy [DOE] in consultation with other executive departments), including associated software and digital capabilities.

The DOE may also impose new conditions on the continued use or updating of foreign-manufactured or operated BPS electric equipment already acquired or installed before the date of the executive order. This could include requirements to isolate, monitor, secure, disconnect, replace, or remove the equipment. The order states that the DOE must consider potential effects on reliability and safety when imposing these conditions. Within 120 days of the date of the order, the DOE, in consultation with other executive departments, will establish regulations implementing the order.

 

FERC approves Reliability Standard CIP-014-4 (Physical Security)

FERC approved Reliability Standard CIP-014-4 (Physical Security) and the associated implementation plan, violation risk factors, and violation severity levels on Sept. 10.  CIP-014 requires applicable transmission owners to perform periodic risk assessments to identify critical transmission stations, substations, and control centers, evaluate potential threats and vulnerabilities of a physical attack on those facilities, and develop a physical security plan to protect the facilities.

The order finds that the modifications in CIP-014-4 improve reliability by providing a more consistent, robust approach to identify and assess critical transmission stations, transmission substations, and primary control centers using a documented risk assessment methodology.  The modifications also tighten assessment timelines to a 36-month cycle and require identifying proximate existing BES transmission stations and substations within 1,500 feet to evaluate the impact of a physical attack on adjacent equipment.

 

FERC-NERC joint report finds BPS performed strongly during 2026 extreme cold weather events

In a joint report, FERC, NERC, and the Regional Entities said that the country’s Bulk Power System demonstrated strong performance during extreme cold weather events that took place earlier this year, with no significant disruptions in either the natural gas or electric systems. The report credits the improved performance to the implementation of recommendations from previous winter storm reports. The joint report, launched in March following Winter Storms Fern and Gianna, found that generator outages during those storms were comparable in magnitude to the outages experienced during the January 2025 arctic events, but with improvements compared to prior winter storms. FERC’s press release on the report is available here. The full report is available here.

 

CISA releases updated Insider Threat Mitigation Guide

The Cybersecurity & Infrastructure Security Agency (CISA) released an updated version of its Insider Threat Mitigation Guide in September. The guide discusses the various types of insider threats, and how to detect them. It also recommends best practices for conducting insider threat assessments and creating an insider threat mitigation program.

The last version of the guide was issued in 2020, and the updated version has information and new case studies, as well as discussions of emerging risk considerations such as the use of AI.