METROPOLITAN EDISON COMPANY - Pennsylvania Public Utility ...

controls were automated. Moreover, annual security analysis is performed to reviewprocesses for documenting access from initial user access to account termination andall changes in between.Critical Infrastructure Protection (CIP) reviews are performed on a quarterly basisand CIP Access Request Database (CARD) reviews are performed annually. TheCARD reviews include asset approver identification and verification, granting andrevoking access, and regular review of asset procedures which are performed manually.In order to automate the CARD review process, FirstEnergy is committed toimplementing Agiliance RiskVision (RiskVision) in January 2011 with configuration,testing and preparations to be performed prior to that date. RiskVision is an enterpriseGovernance, Risk and Compliance (GRC) software package that will be utilized forcompliance purposes for FirstEnergy’s CIP program. RiskVision can monitor CIPcompliance status of assets, automate periodic review requirements, and report on thecompliance status of the business units.Staff’s Follow-up Recommendation – None.Prior Recommendation – FirstEnergy should improve its security awareness andtraining programs to include computer based training (CBT) or other mandatory formalclassroom training for IT and departmental personnel. A refresher course should beconducted annually.Prior Situation – Of the 654 IT Department employees, approximately 269 employees,or less than 50% of the IT staff, completed training activities/courses/conferences in2005. FirstEnergy was conducting security awareness training every two years in theform of posters, broadcast e-mails, and newsletters. However, FirstEnergy was notregularly conducting any formal classroom or CBT security awareness training, exceptfor small groups of IT personnel.Follow-up Finding and Conclusion No. IX-3 – FirstEnergy has implemented aprogram to educate its employees regarding IT security issues via computerbased training, but is not ensuring that employees complete this trainingannually.In 2007, FirstEnergy partnered with a consultant, Global Learning Systems, toimplement CBT. CBT was implemented in June 2007 and cost FirstEnergyapproximately $80,000 to implement across all of its subsidiaries. FirstEnergy uses asoftware application called the “Learning Management Solution” to administer,document, track and report on the CBT program, including:• Number of employees that took the test• Number of employees that completed the test• Completion percentage, etc.- 59 -