Substation Physical Security

As part of our annual audit plan, we performed an audit of physical access to Tennessee Valley Authority’s (TVA) substations. Our audit objective was to determine if substations had appropriate physical access controls. Our scope included substations that contain devices with TVA network connectivity. We found substations had overall appropriate physical access controls. However, we identified control weaknesses in TVA’s annual access review process and management of one of the physical access controls. Additionally, we determined TVA’s Standard Programs and Processes should be revised to define requirements for physical access reviews.