Network Architecture - Hydro

The Office of the Inspector General performed an audit of a TVA hydroelectric facility to determine if the network architecture and assets in use to support site business and operations were compliant with TVA policies, procedures, and identified best practices. We determined several areas of the network architecture and assets did not follow TVA policies, procedures, or identified best practices. Specifically, we identified the following issues: • Network redundancy was not implemented in accordance with identified best practices. • Network asset retirement was not implemented in accordance with Power Operations’ Standard Operating Procedure. • Power Operations’ location specific standard operating procedure did not require unique passwords in accordance with identified best practices. In addition, we identified the following internal control deficiencies significant to our audit objective: • Baseline configurations were not implemented in accordance with location specific Power Operations’ standard operating procedure. • Physical access permissions and controls were not implemented in accordance with identified best practices. TVA management agreed with our recommendations.