Cybersecurity Vulnerability Management
The Office of the Inspector General performed an audit of the Tennessee Valley Authority’s (TVA) cybersecurity vulnerability management program. Our objective was to determine if TVA is compliant with the Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive (BOD) 22-01, Reducing the Significant Risk of Known Exploited Vulnerabilities (KEVs), and CISA BOD 19-02, Vulnerability Remediation Requirements for Internet-Accessible Systems.