METROPOLITAN EDISON COMPANY - Pennsylvania Public Utility ...

More documents

Recommendations

Info

FirstEnergy management stated that refresher courses are updated and madeavailable annually for all employees that have access to cyber assets. The process fordelivering the training is as follows:• An initial email is sent informing the individual of the mandatory training, alongwith a deadline date.• A reminder email is sent after one week to individuals that have notcompleted the training.• An email is sent after two weeks to managers/supervisors containing a list ofindividuals that have not completed the training.• An email is sent from the Director of Corporate Security to the individualdirectors of any personnel that have not completed the training after fourweeks.The training is provided through the FirstEnergy portal to all employees and contractorswho have access to any FirstEnergy cyber assets. This allows all individuals access tothe training on a continuous basis. It also acts as a reference should they have anyquestions concerning the training or cyber security.However, summary statistical data that was provided by the FE-PA Companiesshows that not all employees are completing this annual training. See Exhibit IX-6summary of CBT training statistics. Less than 80% of all FE-PA operating companyemployees with access to cyber assets completed cyber security training from 2007 to2009.Refresher training on cyber security should be conducted annually in order tokeep the workforce well educated about security threats and vulnerabilities that cyberassets are exposed to and any changes in policies and procedures. FirstEnergy did notprovide any particular reason as to why its employees that have access to cyber assetsdid not complete CBT training from 2007 to 2009. Moreover, the Audit Staff is notcertain whether FirstEnergy’s method of tracking the CBT statistics is appropriate. Inparticular, when reviewing the data in Exhibit IX-6 it is not clear whether the 16% ofMet-Ed employees that did not complete CBT related to security awareness andprocedures in 2007 were a part of the 79% that completed the similar training in 2008 orsimilarly in 2009 and so on. FirstEnergy should strive to track the number of employeesthat did not complete CBT, the reason for not doing so and expedite the training ofthese employees in future years. By not maintaining and reporting this information,there could be a possibility that employees which have access to cyber assets neverreceive CBT related to security awareness and procedures and are not identified; evenif the training data seems to indicate most employees have received training andperiodic update/refresher training.Information technology has progressed markedly in recent years and with thisadvancement in technology the security risks to the cyber infrastructure have alsoincreased considerably. It is imperative for companies, especially one such as anelectric distribution utility that maintains thousands of confidential customer records, tobe aware of the potential dangers of cyber security threats and vulnerabilities. It iscrucial for the workforce to know and learn how FirstEnergy protects its cyber assets- 60 -
Exhibit IX-6FE-PA CompaniesPercentage of Employees that Completed Computer Based TrainingRelated to Security Awareness and Procedures2007-2009Met-EdYearNumber of Employees WithAccess to Cyber AssetsNumber of EmployeesCompleting CBTPercentage of EmployeesCompleting CBT2007 383 322 84%2008 494 390 79%2009 534 410 77%PenelecYearNumber of Employees WithAccess to Cyber AssetsNumber of EmployeesCompleting CBTPercentage of EmployeesCompleting CBT2007 727 520 72%2008 782 474 61%2009 970 610 63%Penn PowerYearNumber of Employees WithAccess to Cyber AssetsNumber of EmployeesCompleting CBTPercentage of EmployeesCompleting CBT2007 83 75 90%2008 92 68 74%2009 124 93 75%FE-PA CompaniesYearNumber of Employees WithAccess to Cyber AssetsNumber of EmployeesCompleting CBTPercentage of EmployeesCompleting CBT2007 1,193 917 77%2008 1,368 932 68%2009 1,628 1,113 68%Source: Response to Data Request SS-5and what they can do to help make the cyber environment safer. Refresher traininghelps employees be proactive and adopt good cyber security habits.Staff’s Follow-up Recommendation – Ensure that all employees that have accessto cyber assets complete required annual training related to security awarenessand procedures by maintaining appropriate CBT tracking records.- 61 -
Page 5:
METROPOLITAN EDISON COMPANYPENNSYLV
Page 8 and 9:
• Support Services• Human Resou
Page 10 and 11:
• Developed and implemented forma
Page 12 and 13:
FIRSTENERGY PENNSYLVANIA COMPANIESM
Page 14 and 15:
FIRSTENERGY PENNSYLVANIA COMPANIESM
Page 16 and 17: FIRSTENERGY PENNSYLVANIA COMPANIESM
Page 24 and 25: III. AFFILIATE INTERESTSBackground
Page 26 and 27: In addition, subsidiary or related
Page 28 and 29: BWG recommended that a detailed, wr
Page 30 and 31: management. Other potential uses of
Page 32 and 33: IV. CORPORATE GOVERNANCEBackground
Page 34 and 35: V. FINANCIAL MANAGEMENTBackground -
Page 36 and 37: the internal audit was to determine
Page 38 and 39: Committee citing the internal contr
Page 40 and 41: VI. ELECTRIC RELIABILITYBackground
Page 42: Exhibit VI-1Metropolitan Edison Com
Page 45 and 46: provide additional details to the C
Page 47 and 48: Exhibit VI-6FirstEnergy Pennsylvani
Page 49 and 50: All three FE-PA Companies have had
Page 51 and 52: FirstEnergy is following the right
Page 53 and 54: Company, and The Toledo Edison Comp
Page 55 and 56: technicians. These strategies are u
Page 57 and 58: VIII. EMERGENCY PREPAREDNESSBackgro
Page 59 and 60: Routine periodic updating of the em
Page 61 and 62: Follow-up Finding and Conclusion No
Page 63 and 64: old excess inventory. Spare invento
Page 65: controls were automated. Moreover,
Page 69 and 70: FE-PA Companies were unable to iden
Page 71 and 72: Staff’s Follow-up Recommendation
Page 73 and 74: Exhibit X-6Metropolitan Edison Comp
Page 75 and 76: Prior Recommendation - Develop a co
Page 77 and 78: Therefore, BWG suggested that First
Page 79 and 80: XI. CUSTOMER SERVICEBackground - Th
Page 81 and 82: Exhibit XI-2FE-PA CompaniesPercenta
Page 83 and 84: Exhibit XI-5FE-PA Companies Compare
Page 85 and 86: Exhibit XI-7FE-PA Companies Compare
Page 87 and 88: Follow-up Finding and Conclusion No
Page 89 and 90: uilding, in an effort to protect re
Page 91 and 92: Companies would submit a supplement
Page 93 and 94: 3. The "four-fifths" rule (underuti
Page 95 and 96: Met-Ed has female underutilization
Page 97 and 98: Exhibit XII-4Page 1 of 2FirstEnergy
Page 99 and 100: The number of years that FirstEnerg
Page 101 and 102: FE-PA Companies do track purchases
show all

METROPOLITAN EDISON COMPANY - Pennsylvania Public Utility ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?