Backup Verification of Mission Essential Data

The Office of the Inspector General audited TVA’s backup verification of mission essential data to determine if TVA’s backups were being performed in accordance with business requirements and industry best practice. In summary, we determined that TVA’s backups of mission essential data included industry best practice in their business requirements. However, we found three business requirements were not being met. Specifically, we found (1) TVA was not using the enterprise authentication solution as required by their common control catalog, (2) test restores were not performed for essential backup and infrastructure components, and (3) backup data in transit was not encrypted. TVA management agreed with our findings and recommendations.