DOE's BESS Grid-Security RFI Opens a Docket Without Setting a Single Threshold

The Department of Energy's Office of Cybersecurity, Energy Security, and Emergency Response published a Request for Information on September 9 — Federal Register document 2026-18370, docket DOE-HQ-2026-1123, titled "Securing the United States Bulk-Power System." Thirty-six numbered questions in eight subject groups. Battery energy storage systems, grid-connected inverters, and their associated software, firmware, services, and remote access are named explicitly as subjects of inquiry.

It sets no voltage or capacity threshold, names no vendor, creates no licensing procedure, and restricts no transaction. Comments are due October 9, which gives anyone assembling a coordinated industry response roughly four weeks from the first working day after Labor Day. DOE has scheduled an informational webinar for September 16.

The RFI implements the opening phase of Executive Order 14421, issued August 26, which declared a national emergency over foreign adversary access to the bulk-power system and directed DOE to publish implementing rules or regulations "as needed" within 120 days. That clock expires around late December. DOE has not said whether the deadline produces a proposed rule, an interim final rule, or some other instrument; the "as needed" qualifier leaves the form open, and no public agency statement narrows it.

The authority itself is conditional. The order lets DOE prohibit or condition transactions involving foreign-produced bulk-power equipment, but only after DOE makes two separate determinations: that the equipment has a specified connection to a "Covered Foreign Entity," and that the transaction presents an undue or unacceptable national-security risk. Neither determination has been made for any BESS supplier or any transaction.

Ronan Adike's September 4 piece separated that two-determination test from the tax-credit, Buy America, and recycling-policy routes, and noted that no grid-security implementation document then existed. This RFI is the first one. It opens a formal docket, fixes a comment deadline, and indicates DOE is building toward specific rules rather than holding the emergency authority in reserve. It contains no equipment, vendor, or licensing decision.

Where DOE is uncertain about its own scope

The shape of the question set carries information. Where DOE supplies a candidate definition, it has already decided what it wants to regulate. Where it asks the industry to propose one, it hasn't.

Thresholds. Question A-2 lists BESS alongside grid-connected inverters, uninterruptible power supplies serving critical infrastructure, small or backup generators, and industrial control systems, then asks what voltage, capacity, connectivity, function, location, or criticality thresholds should apply. It supplies no candidate kV, MW, or MWh figure. The executive order does define the bulk-power system to include transmission lines rated 69 kV or higher plus associated facilities and control systems, but that is a definition of the system, not a threshold for the equipment. The RFI asks separately what thresholds should govern BESS, which means the 69 kV number should not be read as a proposed cutoff.

Question A-6 asks whether early implementation should be prioritized by voltage, capacity, connectivity, remote access, market concentration, replacement lead time, or consequence severity, and how segmentation, relabeling, or de minimis arrangements should be treated. DOE is asking where to draw the line and in what order.

Unit of analysis. The RFI has not decided whether cells, modules, racks, inverters, and controls get reviewed as one system or separately. Question A-3 asks when components, software, firmware, digital services, maintenance services, and remote-access capabilities should count as "associated with" equipment, including whether they can affect operation, protection, control, monitoring, availability, configuration, integrity, confidentiality, safety, or recovery. That is a question about where the review boundary falls inside a BESS. For a procurement team, the answer determines whether a cell supplier, an inverter supplier, a battery-management-system vendor, and a SCADA integrator face one evaluation or four.

Production and provenance. Question A-5 asks how final assembly, substantial transformation, domestic content, contract manufacturing, original-design manufacturing, white labeling, refurbishment, remanufacturing, and repair should affect "foreign-produced" status, and what records should substantiate country of manufacture. Several of those terms are customs and trade-law vocabulary. The RFI borrows them without stating whether trade-law tests would apply, and it establishes no component-origin percentage and no required tracing depth.

Firmware and software. Questions B-5 through B-7 cover hardware and software bills of material, component and update authentication, tampering and counterfeit detection, secure development practices, source protection, reproducible builds, code signing, update security, vulnerability disclosure, patch validation, end-of-life support, and continuity arrangements. The document uses provenance and design-and-development language rather than defining an authorship test, but what it is circling is who wrote the code, who controls the build, and who can push a change to a deployed system.

Remote access. DOE names inventory, authorization, multifactor authentication, least privilege, time limits, logging, monitoring, georestrictions, jump hosts, credential control, emergency access, revocation, and the ability to disable remote access without impairing safe operation. It does not use the word "air-gapping" anywhere. It uses "network segmentation," "isolate," and "access restrictions." Anyone drafting a specification against this document should use DOE's vocabulary rather than the industry shorthand, because the shorthand carries an absoluteness the RFI has not adopted.

Production tooling and replacement capacity. Question F-1 asks about material dependence on foreign sources for equipment, components, software, firmware, production tooling, testing capability, and critical minerals. Questions F-3 and F-5 ask about technical equivalence, interoperability, certification, physical footprint, civil works, control integration, firmware compatibility, warranty, lead time, lifecycle cost, aggregated procurement, purchase commitments, spares, standardization, modularity, and domestic repair or testing facilities. These questions map the supply-side constraint DOE would run into if it restricted an incumbent supplier before alternatives were procurable. My reading: an agency that asks them in this much detail has already understood that a restriction it cannot substitute against is a restriction it cannot enforce.

A new statutory authority alongside an existing reliability standard

DOE is the sole issuing agency. The executive order rests on the International Emergency Economic Powers Act, the National Emergencies Act, and 3 U.S.C. §301. IEEPA gives the president broad authority to regulate transactions involving foreign threats during a declared emergency; enforcement here runs through DOE. FERC is not named in either the order or the RFI. Commerce, Homeland Security, Defense, the intelligence community, and Interior are consultation parties.

Part of the operational territory is already covered by mandatory reliability standards, but those standards stop short of the subjects the RFI asks about. NERC's CIP-013-2 requires registered entities to maintain supply-chain cyber-risk-management plans for covered assets, including vendor incident notification, termination of vendor access, vulnerability disclosure, and verification of software integrity and authenticity. It prescribes no country-of-origin rule, identifies no disfavored country or vendor, and requires no component-level foreign provenance. It also states explicitly that entities need not renegotiate existing contracts and that actual contract terms and vendor performance fall outside the standard's scope. Equipment transactions, foreign production and control, mitigation of already-installed equipment, replacement capacity, licensing: CIP-013 does not reach any of it. That is the ground the RFI is entering.

Two further distinctions worth holding separately. NERC's BES definition guidance already applies to standalone and hybrid BESS as dispersed power-producing resources, generally pulling them into the Bulk Electric System when aggregate gross nameplate capacity exceeds 75 MVA and the common point of connection sits at 100 kV or above. Those are NERC's criteria for its own reliability framework, not thresholds DOE has proposed for EO 14421. And FERC's Order No. 912, issued September 2025, directed NERC to develop additional supply-chain protections on an 18-month submission clock. That process runs in parallel to DOE's, under Federal Power Act §215 rather than IEEPA.

The grid-security and tax-code regimes do not reference each other

Search the RFI and EO 14421 for "foreign entity of concern," "prohibited foreign entity," "material assistance," "30D," "45X," and "7701." None of those terms appears. The two documents do not reference, adopt, or harmonize with Treasury's definitions.

The executive order defines a "Covered Foreign Entity" through the arms-embargo and sanctions framework in 22 C.F.R. §126.1, or through a separate DOE determination of conduct detrimental to US national security or foreign policy. Any such determination applies "exclusively for purposes" of the order.

The tax code's prohibited foreign entity definition under 26 U.S.C. §7701 is built differently: enumerated government lists, a "foreign-controlled entity" category, and a "foreign-influenced entity" test examining board appointment rights, ownership percentages, debt, and agreements conferring effective control. Section 45X adds a material-assistance restriction, which is a cost-ratio calculation on the production costs of an eligible component and functions as a condition on credit eligibility. Section 30D keeps its own restriction for clean vehicles.

The collision case is straightforward to construct. A domestically produced cell could satisfy the §45X material-assistance calculation while the downstream BESS transaction remained subject to grid-security review because of Covered Foreign Entity firmware, service contracts, or remote-access rights. Run it the other way and the absence of a DOE risk determination establishes nothing about credit eligibility if the taxpayer or the component fails the tax-code tests. The regimes evaluate different attributes, under different statutes, for different consequences: credit dollars on one side, permission to install on the other.

What the grid-security process adds is a transaction-level screen sitting entirely outside the tax stack, examining firmware provenance, remote-access architecture, and vendor ownership chains that the tax code never looks at. In an earlier piece I separated policy eligibility from customer qualification and from contractable supply for US battery production. This inserts a fourth checkpoint between the first and the last: a cell can be credit-eligible, customer-qualified, and physically available, and the transaction can still be conditioned.

What procurement teams can document now

Nothing here is a compliance requirement. But the categories DOE asks about are the best available signal of what a future rule would examine, and most of them translate into vendor documentation that can be specified today.

Component provenance and bills of material. The RFI asks about manufacturing location, component provenance, and sub-tier tracing depth without specifying how deep. The live question for a specification writer is whether to require provenance at the finished-cell or rack level, or to trace into cathode precursor, anode material, separator, and electrolyte. A spec that captures only final-assembly location will need re-qualification if DOE's eventual rule traces further. Asking for sub-tier documentation now, even where the supplier's first response comes back incomplete, establishes the expectation and surfaces the gaps while there is still time to close them.

Firmware and software provenance. DOE asks about design and development provenance, reproducible builds, code signing, and update authentication. A usable attestation needs to identify the entity or entities that authored the code, the build environment and its access controls, the code-signing chain, and which personnel or organizations hold authority to push updates to deployed systems. Most BESS suppliers do not currently hold this documentation at component level, and the reason is worth understanding before you ask: the integrator often does not own the firmware stack. Requiring the attestation surfaces whether the supplier controls its own code or depends on a sub-tier provider nobody in the chain has examined.

Remote-access architecture. The RFI asks about the ability to disable remote access without impairing safe operation. A system specified from the outset with separable communications and power-conversion layers can demonstrate that. A system where the BMS, inverter controls, and SCADA communications share firmware or hardware cannot be brought to that standard without redesign. The cost of separability at design stage is modest; the retrofit cost is not. Teams specifying new systems have a window here that teams holding installed fleets do not.

Vendor ownership and transition provisions. Ownership structure, access rights, white-labeling arrangements, ownership-change notification, audit rights, incident reporting, transition planning. These are contractual, not technical, and they can go into RFPs and master supply agreements immediately.

Modularity and substitutability. If DOE eventually restricts a specific supplier, a system built for component substitution — standardized rack interfaces, firmware that accepts multiple inverter platforms, a re-sourceable BMS — reduces what compliance costs. DOE's questions about interoperability, standardization, and replacement lead time indicate the agency is already thinking about substitution. Specifying modular architecture is a hedge against a restriction whose scope nobody yet knows.