Federal Reports

The Tennessee Valley Authority’s (TVA) three nuclear plants, Browns Ferry, Sequoyah, and Watts Bar, are capable of generating an average of 8,275 megawatts of electricity, making TVA the third-largest nuclear fleet in the United States.  In fiscal year 2025, TVA generated 56,157 million kilowatt hours of nuclear power, accounting for 33 percent of TVA’s total fleet power generation.  To maintain the nuclear fleet, TVA is making significant investment.  For fiscal year 2025, the TVA Board of Directors approved $257 million to support reliable operation of the seven units across TVA’s three nuclear plants. 

Due to potential risks to cost and schedule from rework, we performed an evaluation of contractor rework for nuclear projects at TVA.  The objectives were to evaluate TVA’s oversight of contractor rework and determine if rework was being handled in accordance with contract terms and conditions.  Our scope included active nuclear projects in the implementation phase.

We reviewed nine contracts associated with our sample of projects and identified rework was required for one.  We could not determine if all rework identified was handled in accordance with contract terms and conditions due to a lack of formal documentation and tracking of rework.  In addition, we identified a lack of guidance for oversight of rework.  Specifically, TVA and Nuclear’s project management Standard Programs and Processes do not define rework or provide any information on how rework should be documented and tracked, which contributed to the inability to determine if all rework was handled in accordance with contract terms and conditions.

Why We Did This Report

We visited the Wyckoff/Eagle Harbor Superfund site on Bainbridge Island, Washington, to observe the EPA’s management of public access to the site, including contaminated beaches. Through our visit, we aimed to determine whether we should conduct additional oversight. 

Summary of Findings

Prior to our visit we identified concerns about public access to the site, but during our visit we observed physical access controls and informational devices that should effectively limit public exposure to contaminants. Therefore, we do not anticipate conducting additional oversight at this time.

Amtrak (the company) has been moving its technology systems and data to the cloud to provide on-demand access to shared services and reduce its dependence on in-house servers and databases. Migrating applications and data to the cloud, however, poses inherent security risks, exposing the company to an increased risk of cyberattacks. Accordingly, our objective was to assess the extent to which the company has implemented effective governance processes and security controls for cloud computing. In July 2025, we issued an interim report on this audit to alert the company to two pressing cybersecurity issues related to its cloud computing. In this report, we provide an update on the company’s progress on these issues and an overall assessment of its cloud computing practices. Given the sensitive nature of the report’s information, however, we are summarizing the results in this public version of the report.

Our assessment of the company’s governance processes and security controls of its cloud applications resulted in nine recommendations. In commenting on a draft of this report, the Executive Vice President for Digital Technology and Innovation agreed with our recommendations and described ongoing and planned actions to address them.