METROPOLITAN EDISON COMPANY - Pennsylvania Public Utility ...

Companies, the working inventory turnover rates at December 31, 2009 appear to bereasonable. As shown in Exhibit IX-3, the combined total inventory reduction for theFE-PA Companies was approximately $7.4 million (i.e., $1,839,000 for Met-Ed,$5,409,000 for Penelec, and $130,000 for Penn Power) from 2006 to 2009. Assuming aconservative average annual carrying cost of approximately 10%, the FE-PACompanies combined inventory reduction from 2006 to 2009 has resulted in anassociated reduction in annual inventory carrying costs of approximately $738,000 (i.e.,$184,000 for Met-Ed, $541,000 for Penelec, and $13,000 for Penn Power).Staff’s Follow-up Recommendation – None.Prior Recommendation – FirstEnergy should develop and implement formal accesscontrol procedures that include a formal consolidated Access Authorization Form.Security and access control review should include an examination and verification of theinitial access authorized for selected users.Prior Situation – BWG concluded that FirstEnergy’s access control processes andprocedures were not adequate. FirstEnergy did not have a formal process or a formalAccess Authorization Form to administer the critical function of access control over theirapproximately 40 applications. Virtual Private Network (VPN) and Network AccessAgreements had been developed to address these areas but there were other criticalsystems and applications such as software from SAP that were without a formalprocess for documenting access. Moreover, FirstEnergy had not deployed anautomated tool for security monitoring and analysis of access control within itsInformation Technology (IT) enterprise. FirstEnergy’s IT Department was performingsecurity analysis manually.Follow-up Finding and Conclusion No. IX-2 – FirstEnergy has developed andimplemented formal access control procedures which include an examinationand verification of the initial access authorized for selected users.FirstEnergy uses Active Directory (AD) to enforce access control policies onemployees that use IT infrastructure. AD was initially implemented in August 2001. ADis comprised of user and service accounts, machine accounts, printers and securitygroups. Beginning in early 2009, to acquire access for a user, a request must besubmitted to the IT service desk which creates a ticket for the Central SecurityAdministration (CSA) group who in turn create a user account in AD. The entireprovisioning process is documented within FirstEnergy’s Lotus Notes system and isupdated when a change to the process occurs. The CSA group requires the SAPidentification and application owners’ approval before they can grant user access.Beginning in 2008, critical and sensitive systems and critical applications, suchas SAP, had a formal process for documenting access which is documented andavailable for periodic reviews for internal and external auditors. Access controlprocedures are crucial when dealing with IT applications, especially those ascomprehensive as SAP. Also, in 2008, security monitoring and analysis of such access- 58 -