U.S. flag

An official website of the United States government

Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock () or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

2020 Federal Information Security Modernization Act

Report Information

Date Issued
Report Number
2020-15709
Report Type
Audit
Description
The Office of the Inspector General is required by the Federal Information Security Modernization Act of 2014 (FISMA) to conduct an annual independent evaluation that determines the effectiveness of the information security program (ISP) and practices of its respective agency. Our objective was to evaluate the Tennessee Valley Authority’s ISP and agency practices for ensuring compliance with FISMA and applicable standards, including guidelines issued by Office of Management and Budget and National Institute of Standards and Technology. Our audit scope was limited to answering the FY 2020 IG FISMA metrics developed as a collaborative effort by the Office of Management and Budget, Department of Homeland Security, and Council of Inspector Generals on Integrity and Efficiency in consultation with the Federal Chief Information Officer Council. The FY 2020 IG FISMA metrics recommend a majority of the functions be at a maturity level 4 (managed and measurable) or higher to be considered effective. Based on our analysis of the metrics and associated maturity levels defined with the IG FISMA metrics, we found TVA’s ISP was operating in an effective manner.
Joint Report
Yes
Participating OIG
Tennessee Valley Authority OIG
Agency Wide
Yes (agency-wide)
Questioned Costs
$0
Funds for Better Use
$0
View report on Oversight.gov

Recommendations

We recommend the Vice President and Chief Information Officer, Information Technology consistently implement configuration baselines on operating systems and/or ensure deviations are documented, implemented, and maintained.

We recommend the Vice President and Chief Information Officer, Information Technology ensure contingency planning roles and responsibilties are filled in accordance with TVA policy.

We recommend the Vice President and Chief Information Officer, Information Technology update the policy to define a process for assigning risk designations for all positions.