Company: TVC
Filing Date: 2025-11-13
Form Type: 10-K
Source: 0001376986-25-000056
Chunk: 678

Company: Tennessee Valley Authority
Filing Date: 2025-11-13
Form: 10-K
Item: Item 1B
Chunk 678
---
ITEM 1B.  UNRESOLVED STAFF COMMENTS

Not applicable.

ITEM 1C.  CYBERSECURITY

Risk ManagementTVA’s cybersecurity risk management programs and processes exist under a written cybersecurity policy, which provides the foundation for TVA’s information security programs.  Under the policy, TVA engages assessors, consultants, auditors, and other third parties.  All TVA employees, contractors, grantees, other federal agencies, state and local governments, industry partners, and others who possess TVA information or who operate, use, or have access to TVA's information systems are made responsible for complying with TVA's cybersecurity policy and information security-related communications, plans, practices, procedures, and standards issued as part of the information security programs. TVA’s cybersecurity risk management framework provides the structure for protecting against cybersecurity threats, including through promoting risk management efforts, situational awareness, and cyber risk modeling and simulations.  Within this framework, TVA operates numerous programs under internal written policies and procedures, which are aimed at helping protect TVA’s information resources.  These include a vulnerability management program to help address cybersecurity threats to TVA digital assets; a patch and remediation management program to help computer systems remain current with software patches or software updates; an offensive threat management program to emulate threat actor activities; a cybersecurity training program to help educate employees and contractors, including by providing scenarios designed to train the workforce on responding to cybersecurity incidents; implementation of standard terms and conditions where appropriate in TVA’s supply chain contracts to help mitigate TVA’s cybersecurity risk, including through requiring timely notice of vendor cybersecurity incidents and data impacts and compliance with laws, regulations, and TVA’s policies on cybersecurity; and a program to accomplish cybersecurity event detection alerting.  These programs are based on principles from the National Institute of Standards and Technology and certain regulatory standards that are designed to protect against cybersecurity incidents, including the North 

49

Table of Contents                                                                  

American Electric Reliability Corporation Critical Infrastructure Protection Standards and Nuclear Regulatory Commission cybersecurity standards, and are periodically assessed by third-party experts. In the last three fiscal years, TVA has not experienced any material cybersecurity incidents.  TVA is not currently aware of any potential cybersecurity threats, including as a result of any previous cybersecurity incidents, that may have materially affected or are reasonably likely to materially affect TVA, including its business strategy, results of operations, or financial condition; however, TVA cannot provide assurance that it