Federal Information Security Modernization Act
The Federal Information Security Modernization Act of 2014 (FISMA) requires each agency’s Inspector General to conduct an annual independent evaluation to determine the effectiveness of the information security program (ISP) and practices of its respective agency. Our objective was to determine the effectiveness of the Tennessee Valley Authority’s (TVA) ISP and practices as defined by the FY 2025 IG FISMA Reporting Metrics. Our audit scope was limited to answering the fiscal year (FY) 2025 IG metrics, which include 20 core and 5 supplemental IG metrics. The FISMA