Federal Information Security Modernization Act

The Office of the Inspector General is required by the Federal Information Security Modernization Act of 2014 (FISMA) to conduct an annual independent evaluation that determines the effectiveness of the information security program (ISP) and practices of its respective agency. Our objective was to evaluate the Tennessee Valley Authority’s ISP and practices as defined by the FY 2021 IG FISMA Reporting Metrics Version 1.1. Our audit scope was limited to answering the FY 2021 IG FISMA metrics developed as a collaborative effort by the Office of Management and Budget, Department of Homeland Security, and Council of Inspector Generals on Integrity and Efficiency in consultation with the Federal Chief Information Officer Council. The FY 2021 IG FISMA metrics recommend a majority of the functions be at a maturity level 4 (managed and measurable) or higher to be considered effective. Based on our analysis of the metrics and associated maturity levels defined with the IG FISMA metrics, we found TVA’s ISP was operating in an effective manner.