Building an Interoperable HBOM Ecosystem for Energy Sector Supply Chain Security

Supply-chain security is increasingly recognized as an important element of national security.

Supply-chain compromises involving trusted technology providers and other third parties have shown how adversaries can gain access to sensitive systems, while attacks on electricity and fuel infrastructure have demonstrated the potentially severe consequences for the energy sector. The 2026 Executive Order on securing the United States bulk-power system addresses a core element of this national security problem: the security and resilience of critical equipment may depend not only on the equipment manufacturer, but also on the underlying components, software, firmware, sub-assembly manufacturers, and supply-chain relationships.

Bulk-power equipment, like much of critical infrastructure, is complex, long-lived, and dependent on global supply chains. Risk can arise from hidden functionality; counterfeit or substituted components; malicious hardware implants; overly-concentrated sources of supply; foreign control over maintenance or updates; or an inability to replace critical components during a crisis. A policy focused only on final assembly, the prime contractor, or the label on a finished product will miss some of these risks. An approach that treats all foreign content as equally dangerous, on the other hand, would impose substantial costs without necessarily improving security.

To successfully implement the EO, the Department of Energy (DOE) needs more than a list of prohibited entities or countries. It needs a sustainable way for manufacturers and their suppliers, asset owners, and government analysts to understand what is inside relevant equipment, where it came from, what remains unknown, and how much confidence to place in that information. Hardware bills of materials, or HBOMs, should therefore be part of the implementation strategy for the EO.

This paper presents a vision for an interoperable HBOM ecosystem serving the energy sector and other critical infrastructure. It concludes with recommendations that treat confidentiality, practical implementation, and cross-sector reuse as design requirements from the outset.