Company: TVC
Filing Date: 2025-11-13
Form Type: 10-K
Source: 0001376986-25-000056
Chunk: 679

Company: Tennessee Valley Authority
Filing Date: 2025-11-13
Form: 10-K
Item: Item 1B
Chunk 679
---
 will not be materially affected in the future by cybersecurity risks or any future material risks.  For more information on TVA’s cybersecurity related risks, see Item 1A, Risk Factors – Cybersecurity and Information Technology Risks in this Annual Report.

Governance

The TVA Board is ultimately responsible for oversight of the identification, management, and mitigation of enterprise-wide risk, including cybersecurity risk, and receives reports from the Audit, Risk, and Cybersecurity Committee (“Audit Committee”).  The Audit Committee is a standing committee of the TVA Board and advises the TVA Board on a variety of matters, including TVA’s processes for identifying, monitoring, and mitigating enterprise risk and reviewing and overseeing strategies for addressing TVA’s cybersecurity, data, and privacy policies and response protocols.  The Audit Committee meets at least quarterly.  Reporting to the Audit Committee and the TVA Board is the risk council comprised of TVA’s top leaders and the Chief Risk Officer (“CRO”), which is responsible for the highest level of management oversight of risk at TVA.  The risk council’s  primary purpose is to oversee TVA’s management of enterprise-wide risks with policy implications reported to the TVA Board or a designated TVA Board committee. The risk council oversees a subordinate committee that provides comprehensive risk oversight of TVA’s security, artificial intelligence, privacy, and technology risks consistent with TVA’s mission, strategic imperatives, and approved financial and operational plans.

TVA’s governance, oversight, execution, and support activities include quarterly Enterprise Risk and Assurance updates to the Audit Committee, an annual alignment with TVA’s broader risk management framework and business planning initiatives, and tactical and intentional initiatives focused on reducing risk, increasing maturity, and helping ensure regulatory compliance and adherence.  TVA engages in various audits in order to provide assurance of TVA’s effective management of cybersecurity risk and risk as a whole and is also subject to required external audits to ensure compliance with certain regulatory standards that are designed to protect against cybersecurity incidents.

TVA's current VP, Cybersecurity serves as Chief Information Security Officer ("CISO").  The current CISO is also designated as the Chief Artificial Intelligence Officer and the agency’s Federal Senior Intelligence Coordinator.  Starting in operational technology as part of nuclear generation, the current CISO has spent his career in public power in various North American Electric Reliability Corporation regions and has been in the industry for over 25 years.  He has led Cybersecurity for over 10 years in the sector.  He was previously the CISO of the