The Office of the Inspector General performed an audit of the Tennessee Valley Authority’s (TVA) cybersecurity vulnerability management program. Our objective was to determine if TVA is compliant with the Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive (BOD) 22-01, Reducing the Significant Risk of Known Exploited Vulnerabilities (KEVs), and CISA BOD 19-02, Vulnerability Remediation Requirements for Internet-Accessible Systems.
We determined TVA generally complied with CISA BOD 19-02 and CISA BOD 22-01; however, two requirements were not fully met. Specifically, TVA did not (1) update CISA with modifications to the inventory of internet-accessible internet protocol (IP) addresses within the five-day requirement or (2) meet the CISA required remediation timeline for 8 of 22 KEVs.
