Backup and Recovery of Operational Technology - Gas Operations

The Office of the Inspector General performed an audit to determine if the backup and recovery process for operational technology cyber assets at Tennessee Valley Authority (TVA) natural gas plants were (1) designed in accordance with federal guidance and (2) operating as defined by TVA policy.  We determined TVA Generation’s backup and recovery procedure was designed in accordance with federal guidance for most areas.  However, the (1) procedure did not align with federal guidance for encryption and (2) process was not operating as defined by TVA Generation’s procedure.  Specifically, the National Institute of Standards and Technology recommends cryptographic mechanisms be implemented to prevent unauthorized disclosure and modification of data; however, encryption was not addressed in TVA Generation’s procedure.  Additionally, none of the plants selected for testing had a documented backup and recovery plan as required by procedure.