Alpha Covenant Holdings · Duty Sheet · generated 2026-10-25 18:47 UTC · free · all sheets

NERC CIP-013-2 supply chain cyber security risk management — the public enforcement record beside the vendor risk assessment (utilities, pipeline operators, nuclear and heavy-industry suppliers)

Applies to: Bulk electric system owners and operators, pipeline operators, nuclear licensees and the heavy-manufacturing suppliers they onboard; the procurement and supply-chain teams that keep the CIP-013 plan evidence · Rule text: https://www.nerc.com/pa/Stand/Reliability%20Standards/CIP-013-2.pdf

The question the rule asks

CIP-013-2 R1 requires a documented supply chain cyber security risk management plan for procuring BES Cyber Systems, R2 requires implementing it, and R3 requires review and approval at least every 15 months. The standard names no public database; the entity decides what it assesses and must show auditors the evidence it kept.

The party this sheet is about

American National Red Cross · keys supplied: UEI G69LHXJ3ABL5 · matching: screening-2026-06f: every check is an exact-name (or exact-UEI / exact-NPI / exact-EIN / exact-CIK) lookup against the official file named on the line; nothing is inferred from similar names, owners or affiliates

Receipt r_48fdb7aed4f14dcd · read 2026-10-25 18:47:43 UTC · SHA-256 ada5cef5f469d4315bf0a5a44ae275a9349729bd03d580845240767c7b7c187e · verify: https://alphacovenantholdings.com/r/r_48fdb7aed4f14dcd

The official files that answer it, as read on that date

SourceRoleStateRecordsWhat it printed
SAM.gov Exclusions — Public Extract V2 (GSA, daily)answers the questionanswered0No entry under this exact name/UEI in the SAM extract fetched 2026-10-25 (SAM_Exclusions_Public_Extract_V2_26298.ZIP).
U.S. Treasury OFAC — Specially Designated Nationals and Blocked Persons List (SDN.CSV)answers the questionanswered0No entry under this exact name or listed alias on the SDN list fetched 2026-10-24.
Consolidated Screening List (trade.gov) — BIS, State and Treasury lists, OFAC SDN excluded here because it is read directlyanswers the questionanswered00 export-control or sanctions list entries (BIS, State, Treasury non-SDN) under this exact printed name
NRC significant (escalated) enforcement actions — reactor, materials and fuel-cycle licensees and non-licensees, as the NRC's enforcement-actions pages print them since 1996supportinganswered00 NRC escalated enforcement action(s) under this exact printed licensee/facility heading
PHMSA pipeline enforcement cases (Office of Pipeline Safety raw data file — every case since 2002 by operator name, as PHMSA prints it)supportinganswered00 PHMSA pipeline enforcement case(s) under this exact printed operator name
OSHA inspection records (DOL Enforcement API — inspections opened in the last five years, by establishment name as OSHA prints it)supportinganswered22 OSHA inspection(s) opened since 2021-10-26 under this exact printed establishment name (0 with no close date printed); 1 establishment name(s) containing these words listed as candidates, not counted
EPA ECHO (Enforcement and Compliance History Online) — facility recordssupportinganswered2ECHO returned 7 facility record(s) for a name search on 'American National Red Cross'; 2 carry this exact printed name. Each row links to EPA's own Detailed Facility Report.
DoD Section 1260H list (Chinese military companies operating in the United States) — entities and the statutory basis as published in the latest Federal Register notice of designationsupportinganswered00 DoD Section 1260H entries (name or alias as the notice prints it) under this exact printed name
UFLPA Entity List (FLETF, 19 U.S.C. 4681) — complete list as published in the appendix to the latest Federal Register noticesupportinganswered00 UFLPA Entity List entries (name or alias as the FLETF prints it) under this exact printed name
FARA active registrants (DOJ Foreign Agents Registration Act eFile — registrants with an active registration, as the API prints them)supportinganswered00 active FARA registrations under this exact printed name
SEC EDGAR (registrant submissions index, data.sec.gov)supportinganswered0EDGAR's entity index lists no registrant under this exact printed name (a registrant may file under a different printed name — see the EDGAR company search).
Federal Audit Clearinghouse (GSA) — single audit filings under 2 CFR 200 Subpart Fsupportinganswered3 single-audit filing year(s) on file; latest FY2025: 0 finding(s), material weakness No

What to record in the file

The plan, the risk assessment and the procurement decision are the entity's own and stay in the entity's file. What this sheet records for each supplier: the SAM exclusions, OFAC SDN and Consolidated Screening List reads with file dates and SHA-256; the DoD 1260H and UFLPA rows for the Section 889 and forced-labor flow-downs; NRC escalated enforcement actions and PHMSA pipeline cases under the exact printed name where the supplier is itself a licensee or operator; OSHA inspections and EPA ECHO facility rows as printed. Not read, named on the receipt: FERC civil penalties and NERC Notices of Penalty (ferc.gov answers programs with HTTP 403), the OSHA SVEP log (offline), CBP EAPA notices (cbp.gov 403). Nothing on this sheet speaks to a site's physical or cyber security.

What this sheet does not decide

The receipt does not decide eligibility, responsibility, identity or compliance. It records what each official file printed for an exact key or exact printed name on a date. A same-name row is a candidate to be resolved by the reader, not a match. Answering the form's question is the applicant's or reviewer's act; this sheet puts the dated record beside it.

Full receipt (all sources, known limits, print record): screening record · Methodology: https://alphacovenantholdings.com/methodology · Corrections (free, public log): https://alphacovenantholdings.com/corrections