Supply Chain
The bulk power system (BPS) is exposed to a range of supply chain vulnerabilities that can affect the timely availability of essential equipment, tools, and resources, potentially leading to operational losses, recovery response delays, or service interruptions. Such risks can stem from geopolitical volatility, severe weather events, public health emergencies, cyber and physical security incidents, workforce constraints, and broader economic instability. For the 2025-26 Regional Risk Assessment (RRA), ReliabilityFirst (RF) determined that supply chain vulnerabilities represented a medium-high risk to BPS reliability.
RF’s risk assessment of supply chain vulnerabilities included three focus areas: cyber security supply chain risk management, major electric equipment lead times, and solar generation interconnection timing improvements.
Cyber supply chain risk management
The NERC Supply Chain Risk Management Reliability Standards, which include CIP-005-7 (Electronic Security Perimeters), CIP-010-4 (Configuration Change Management and Vulnerability), and CIP-013-2 (Supply Chain Risk Management), provide a baseline of protection against supply chain risks, but the attack surface continues to evolve and expand. In September 2025, FERC issued Order No. 912, which directed NERC to address gaps in existing supply chain standards for Protected Cyber Assets.
RF has identified several cyber security supply chain risk themes that contribute to the current risk environment:
- Highly sophisticated global threat actors are increasingly exploiting third-party access paths and technology categories (such as cloud technology) that were not previously addressed in CIP requirements.
- Vendor remote access remains a significant attack vector. FERC has repeatedly emphasized the risk posed by insecure vendor access pathways, where unauthorized changes can be introduced during routine maintenance or support activities.
- Geopolitical and trade issues add uncertainty. Ongoing trade tensions and evolving tariff regimes (including shifts toward taxing semiconductors based on “Country of Design” rather than “Country of Origin”) have introduced delays, cost pressures, and sourcing challenges across the utility supply chain. Long infrastructure lead times and supply shortages remain a critical constraint for certain products.
NERC Supply Chain Risk Management (CIP-013) Performance
CIP-013 requires Registered Entities to manage cyber risks associated with the procurement and use of vendor products and services by developing, implementing, and maintaining documented supply chain risk management plans. In practice, CIP-013 requires organizations to demonstrate that supply chain cyber risks are routinely understood, managed, and revisited as part of normal business and operations.
Figure 12. CIP-013 Violation Intake in RF Footprint (2020-2025)
Figure 12. CIP-013 Violation Intake in RF Footprint (2020-2025)
RF reviewed CIP-013 violation intake to better understand supply chain risks in the RF footprint. As shown in Figure 12, CIP-013 violations were relatively infrequent since the standard became enforceable in 2020. 69% of CIP-013 violations were self-reported by registered entities (notably lower than other CIP standards), which may reflect supply chain as an audit priority informed by the ERO Enterprise risk-based compliance monitoring framework.
RF will continue to monitor this trend and focus on outreach efforts to educate entities on best practices and lessons learned associated with designing and implementing supply chain procurement programs. The ERO Enterprise has created numerous security guidelines on supply chain risk through various NERC collaboration groups.
Major equipment lead times
Longer lead times for major electric equipment can be caused by various issues, such as consumer demand exceeding supply, logistical constraints, trade barriers, material scarcity, and skilled labor shortages. When the COVID 19 pandemic began in 2020, the electric grid experienced a “perfect storm” of these factors that resulted in widespread supply chain disruptions for various types of equipment like power transformers, generator step-up transformers, and circuit breakers.
Unfortunately, some of the pandemic-era delays remain, impacting project timelines for planned system reinforcements and network upgrades. Power and generator step-up transformer lead times increased 150-300% from 2022 to 2023, and remain approximately the same in 2026. Manufacturing capacity constraints have been the main driver of long lead times. The BPS has experienced increased demand for certain equipment driven by data center expansions, grid modernization (i.e., integration of inverter-based resources) hardening efforts (i.e., system reinforcements), and electric vehicle infrastructure buildout. At the same time, there has been a deficit in manufacturing capacity, resulting in significantly longer equipment lead times. Between 2019 and 2025, there were demand increases of 274% and 115% for generation step up transformer and power transformer manufacturing capacity, respectively, that were accompanied by respective market deficits of 100% and 39%.
With a substantial investment in manufacturing capacity within the U.S., lead times for major electric equipment are expected to improve over the next five years. Additionally, to meet rising demand and accelerate delivery, transformer manufacturers have adopted design standardization and requested simplified specifications to shorten lead times.
Solar interconnection timing improvements
Solar is a dominant resource type within both the PJM and MISO generation interconnection queues. Historically, supply chain delays have pushed back in-service dates for these resources and, in turn, exacerbated resource adequacy risks to the BPS. As reported by the U.S. Energy Information Administration (EIA), in 2022, 20% of planned solar projects were delayed due in part to supply chain constraints. In 2023 and 2024, approximately 25-30% of planned solar projects experienced delays or cancellations. However, recent data from the EIA indicates that reported delays for planned solar capacity reduced 25% from 2024 to 2025. These delays have also been shorter in duration, and delays have been more common than cancellations (down to only 1% of projects). EIA also observed project delays during the later stages of project development, such as the construction and testing phases. Although the data shows signs of improvement, RF plans to continue monitoring this trend.
RF will also continue monitoring the timelines of solar capacity additions based on RTO interconnection queue data. RTOs have undertaken efforts to shorten study timelines associated with clogged interconnection queues. In 2025, FERC approved PJM’s Interconnection Reliability Resource Initiative to accelerate shovel ready generation projects of approximately 12 GW of proposed resources. MISO proposed a similar Expedited Resource Addition Study (ERAS) process to provide more energy availability of approximately 30 GW of proposed resources. However, both initiatives are temporary and have resulted in mostly natural gas additions. RF will monitor the impact of these initiatives on resource additions.
Built with Shorthand