Open Recommendations

Determine what enterprise risk management roles, responsibilities, and strategy components should be defined and leveraged for the development and maintenance of cybersecurity profiles.

Develop and maintain cybersecurity risk registers to aggregate, normalize, and prioritize cybersecurity risks.

Develop policies and procedures to create and maintain cybersecurity profiles.

Perform a review of previously granted risk acceptance memorandums to determine whether they were based on a complete review of the system or common controls (as required by National Institute of Standards and Technology Special Publication 800-37, Revision 2) and perform additional risk analysis and/or compensating controls as needed for affected systems.

Ensure that risk acceptance memorandums reflect an assessment of qualitative and quantitative cybersecurity risks, as applicable.

Evaluate options to perform ongoing information continuous monitoring activities commensurate with the current threat environment.

We recommend the Vice President, Generation Projects and Outage Management, evaluate the practice, including the risk to warranty and cost, of TVA performing tuning in place of the contractor.

We recommend the Vice President, Generation Projects and Outage Management, educate project support personnel, as applicable, on their roles and responsibilities.

Establish policies and procedures to track and maintain sub-recipient documentation to ensure expenditures are adequately supported prior to reporting financial information to ARC.

Work with ARC to resolve the questioned cost totaling $46,617 for unsupported ARC funded Personnel, Fringe Benefits, and Supplies cost.

Work with ARC to resolve the questioned cost totaling $20,000 for unsupported non-ARC matching Other cost.

Establish policies and procedures to track and reconcile cost incurred throughout the grant
period to ensure complete and accurate financial reporting.

Work with ARC to revise reported projects costs for ARC funded and non-ARC match costs.

We recommend the Vice President, Safety and Shared Services, update TVA’s Standard Program and Process 10.011, Unmanned Aircraft Systems Program, to require Aviation Services to confirm and maintain documentation of remote pilot certificates for all pilots participating in the program.

We recommend that the Grantee establish policies and procedures to ensure timely preparation and submission of financial and progress reports in accordance with the Uniform Guidance and ARC grant agreement requirements.

We recommend that the Grantee establish policies and procedures for the timely preparation and submission of progress reports in accordance with the Uniform Guidance and grant agreement.

Executive leaders ensure staff fix or replace damaged furnishings to allow effective cleaning and disinfection.

Executive leaders ensure staff place paper maps at information desks to assist veterans in navigating the facility.

Executive leaders ensure staff store clean equipment in a sanitary environment.

Executive leaders ensure hallways and exits are free from obstruction.

Executive leaders ensure staff remove defective equipment from clinical areas to prevent use.

Executive leaders ensure staff have computer screen privacy filters to protect patients personally identifiable information.

The Executive Director oversees improvements to the telephone system to ensure identified vulnerabilities are addressed.

Facility leaders ensure exit signs lead to an exit.

Facility leaders install detectable warning surfaces anywhere a walkway transitions into a roadway.