U.S. flag

An official website of the United States government

Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock () or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Cloud Inventory

Report Information

Date Issued
Report Number
2024-17521
Report Type
Audit
Description
The Office of the Inspector General conducted an audit of TVA’s cloud inventory due to the Tennessee Valley Authority’s (TVA) increased use of cloud services.  Our objective was to determine if TVA maintained an accurate and complete cloud inventory.  Although we determined TVA’s (1) defined processes related to managing cloud inventory were designed in alignment with identified best practices, and (2) access controls for the cloud inventory were operating effectively, TVA does not maintain an accurate and complete cloud inventory.  Specifically, (1) cloud services procured outside of the IT organization’s procurement process were not included in inventory, (2) reconciliation controls did not include all available sources to identify cloud services, and (3) required fields in existing inventory data were incomplete.  This report, specifically identifies Center for Internet Security, a nongovernmental organization/business entity.  Pursuant to the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023, Pub. L. No. 117-263 §5274, any such organization may submit a written response to the report within 30 days, clarifying or providing additional context for each instance within the report in which the organization is specifically identified.  Any response provided for that purpose will be appended to the final, published report.  If you have any questions about this process, please contact Jeffrey McKenzie at (865) 633-7374 or jtmckenzie@tvaoig.gov within 30 days of publication.
Joint Report
No
Agency Wide
Yes (agency-wide)
Questioned Costs
$0
Funds for Better Use
$0
View report on Oversight.gov

Recommendations

We recommend the Vice President, Chief Information and Digital Officer, Information Technology, implement controls to prevent and detect disallowed cloud services procured outside of the IT procurement process, in conjunction with TVA Supply Chain and TVA Financial Services personnel.

We recommend the Vice President, Chief Information and Digital Officer, Information Technology, update the cloud inventory reconciliation process to include other data sources of cloud services procured or in use to improve cloud inventory completeness.

We recommend the Vice President, Chief Information and Digital Officer, Information Technology, review and update the cloud inventory as appropriate.

We recommend the Vice President, Chief Information and Digital Officer, Information Technology, implement a periodic process to identify and update blank required fields to improve cloud inventory accuracy.