Because CIP-013 and the executive order solve different problems. CIP-013 focuses on supplier assurance and software integrity, while the order asks who designed, developed, manufactured, or supplied the equipment and whether a covered foreign entity is involved. A device can satisfy CIP-013 and still fall inside the order’s prohibition.
Why CIP-013 and the executive order do not cover the same control problem
CIP-013 is a supplier assurance requirement for the electric sector, but the executive order changes the question from software integrity to equipment provenance and ownership lineage. That matters because a utility can pass supplier checks for one control set and still have hardware or embedded components that fall inside the order’s sourcing and foreign-entity restrictions.
For utilities, the practical takeaway is that compliance evidence has to be evaluated at the asset and procurement level, not just at the cybersecurity-program level. A clean CIP-013 file does not answer whether a particular device, controller, or component was designed, developed, manufactured, or supplied by a covered party.
What utilities should verify before assuming one control satisfies the other
The useful check is whether your current inventory can trace each relevant asset back through the equipment supply chain, not just through the software bill of materials or vendor assurance package. That includes asking who supplied the equipment, where the design and manufacturing chain runs, and whether any covered foreign entity appears in the path.
If your records only show that a supplier was assessed, they may still leave a gap on the executive order side. The order is a procurement and provenance question, so the evidence standard is different even when the operational technology environment is already subject to CIP-013 expectations.
Utilities that already manage CIP-013 controls can use that program as a starting point, but they should extend it with provenance review, contract clauses, and procurement screening that are specific to the equipment path. The order is easiest to operationalise when sourcing, engineering, legal, and cybersecurity all review the same asset record.
How to respond when a device meets CIP-013 but still raises EO exposure
When the same device is acceptable under CIP-013 yet may fall within the order’s prohibition, the response is to separate the compliance decision from the security decision. The security team may have accepted the supplier risk, but the procurement and compliance teams still need to decide whether the equipment can be acquired, retained, or deployed under the order’s rules.
That distinction is especially important for legacy infrastructure and long-lived operational technology, where replacement cycles are slow and documentation is often incomplete. In those cases, the most important work is to establish provenance, identify any covered foreign involvement, and map the affected assets before deployment decisions become urgent.
Risk and Threat Considerations
The risk is not that CIP-013 is ineffective, but that it answers a narrower question than the executive order. If organisations treat supplier assurance as equivalent to provenance screening, they can deploy equipment that appears compliant from one angle while still creating sourcing, regulatory, or national-security exposure from another.
Failure mechanism: A procurement process that validates cybersecurity supplier controls but does not trace the hardware lineage can miss a covered design, manufacturing, or supply relationship. That gap is most likely when asset records, purchasing files, and cyber compliance records are maintained separately.
Impact: The utility may inherit an acquisition or deployment decision that must be revisited later, creating project delay, contract friction, or forced replacement risk. In regulated environments, that can also turn a routine procurement into a compliance exception that requires executive review.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SA-12 — Supply Chain Protection | Addresses supplier and provenance risk for acquired systems. |
| Recommendation — Require provenance evidence and supplier vetting for in-scope equipment. | ||
| CIS Controls v8 | CIS-15 — Service Provider Management | Covers third-party sourcing and supplier oversight for procured technology. |
| Recommendation — Review supplier relationships and contract terms for prohibited-source exposure. | ||
| ISO/IEC 27001:2022 | A.5.21 — Managing information security in the ICT supply chain | Directly supports supply-chain provenance and supplier control review. |
| Recommendation — Apply supply-chain controls to confirm sourcing, manufacture, and supplier traceability. | ||
| NIST CSF 2.0 | GV.SC-01 — Cyber Supply Chain Risk Management Strategy | Fits the need to govern supply-chain risk beyond baseline supplier assurance. |
| Recommendation — Extend governance to provenance screening and sourcing restrictions. | ||
Practitioner Guidance
What to verify: For each in-scope asset class, confirm that your record set can answer both questions, “Was supplier assurance completed?” and “Can we prove the equipment’s design, manufacturing, and supply path?” If the answer to the second question is weak, do not assume the first one closes the gap.
Decision rule: If an asset is acceptable under CIP-013 but provenance is unclear, treat it as a sourcing and compliance issue first, not as a routine security exception. Escalate before purchase, refresh, or major replacement decisions are finalised.
Practitioner takeaway: CIP-013 helps you judge supplier risk, but the executive order forces you to judge provenance and prohibited-entity exposure, so both evidence sets must be managed in parallel.