U.S. flag

An official website of the United States government

Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock () or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Lost or Stolen Information Technology Assets

Report Information

Date Issued
Report Number
2025-17556
Report Type
Audit
Description
The Tennessee Valley Authority (TVA) manages devices that may contain critical infrastructure information, personally identifiable information, or sensitive business information.  Failure to properly handle and report lost or stolen devices increases the risk of unauthorized access to TVA data.  Additionally, federal agencies are required to report lost or stolen computing devices to the Cybersecurity and Infrastructure Security Agency.  Due to the risks associated with lost or stolen devices, we conducted an audit to determine if TVA follows policies, procedures, and federal guidance for lost or stolen devices.  The scope of our audit included devices managed by TVA’s Information Technology (IT) organization that were categorized as lost or stolen within TVA’s asset management system as of July 10, 2025.  As of that date, TVA IT managed 23,518 computers and 9,017 handheld devices in the IT asset management system.  Of these devices, a total of 267 (236 computers and 31 handheld devices) were categorized as lost or stolen. We determined TVA did not comply with federal requirements because at least 127 of 267 lost or stolen devices were not reported to the Cybersecurity and Infrastructure Security Agency.  We were unable to determine if an additional 98 devices were reported due to incomplete records.  We also determined TVA did not follow policies and procedures related to lost or stolen IT assets.  Specifically, TVA did not complete an incident action plan for most lost or stolen devices and did not always complete the asset verification process in a timely manner.  Additionally, we found controls TVA had in place to address the risk of unauthorized information disclosure from lost or stolen devices were not implemented consistently, including (1) remote-wipe capabilities and (2) encryption.
Joint Report
No
Agency Wide
Yes (agency-wide)
Questioned Costs
$0
Funds for Better Use
$0

Recommendations

We recommend the Senior Vice President and Chief Information Officer take steps to comply with the Cybersecurity and Infrastructure Security Agency reporting requirements for all lost or stolen devices.

We recommend the Senior Vice President and Chief Information Officer review the Incident Action Plan process and implement controls to ensure required steps are completed and documented.

We recommend the Senior Vice President and Chief Information Officer review and update the asset verification process to establish a timeframe for timely completion.

We recommend the Senior Vice President and Chief Information Officer consistently implement remote-wipe capabilities for Information Technology managed laptops where technically feasible.

We recommend the Senior Vice President and Chief Information Officer enforce device encryption requirements for Information Technology managed laptops and desktops where technically feasible.