Federal Reports

ePostage is an electronic postage program that provides small merchants a convenient way to print labels, pay postage, and drop off packages at a post office rather than designated facilities for large customers. The Postal Service collected billions in ePostage revenue in fiscal year 2023, and future program growth aligns with its Delivering for America goals to serve small and medium businesses. Effective ePostage management to verify correct postage and enforce program requirements is critical for the Postal Service to protect revenue and operations and meet its planned goals.

The Office of the Inspector General determined the Cumberland Energy Solution project complied with most elements of scope management and the bid process. However, we identified certain areas under each process that need improvement to help mitigate potential Tennessee Valley Authority (TVA) risk. In summary:• TVA’s Cybersecurity, a business unit under TVA’s Technology and Innovation business unit, was not included as a stakeholder throughout the project. • TVA did not adequately mitigate risks related to the use of equipment from nondesignated countries. Specifically,- Cybersecurity concerns related to the use of equipment from a nondesignated country had not been evaluated. - Some procurements were not evaluated for compliance with the Trade Agreements Act.• The Cumberland Energy Solution project risk register could be improved related to (1) project staffing and (2) gas pipeline construction. • TVA’s contract pricing strategies may cause TVA to pay inflated costs.

The Office of the Inspector General performed an audit to determine if TVA manages access to nonpublic critical and sensitive information in accordance with TVA information management policy. Our scope was limited to TVA’s SharePoint® sites as of March 19, 2024. We determined TVA’s management of access to nonpublic critical and sensitive information could be improved. In addition, we determined TVA was not providing SharePoint® site owners with appropriate training to properly manage access to TVA nonpublic critical and sensitive information. This report, specifically identifies Microsoft, a nongovernmental organization/business entity. Pursuant to the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023, Pub. L. No. 117-263 §5274, any such organization may submit a written response to the report within 30 days, clarifying or providing additional context for each instance within the report in which the organization is specifically identified. Any response provided for that purpose will be appended to the final, published report. If you have any questions about this process, please contact Jeffrey McKenzie at (865) 633-7374 or jtmckenzie@tvaoig.gov within 30 days of publication.

Objective: To determine whether the Social Security Administration has adequate controls in place that are functioning as intended to properly prevent unauthorized access and use of Business Services Online services.