XML 89 R33.htm IDEA: XBRL DOCUMENT
v3.25.3

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Sep. 30, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Risk Management TVA’s cybersecurity risk management programs and processes exist under a written cybersecurity policy, which provides the foundation for TVA’s information security programs. Under the policy, TVA engages assessors, consultants, auditors, and other third parties. All TVA employees, contractors, grantees, other federal agencies, state and local governments, industry partners, and others who possess TVA information or who operate, use, or have access to TVA's information systems are made responsible for complying with TVA's cybersecurity policy and information security-related communications, plans, practices, procedures, and standards issued as part of the information security programs. TVA’s cybersecurity risk management framework provides the structure for protecting against cybersecurity threats, including through promoting risk management efforts, situational awareness, and cyber risk modeling and simulations. Within this framework, TVA operates numerous programs under internal written policies and procedures, which are aimed at helping protect TVA’s information resources. These include a vulnerability management program to help address cybersecurity threats to TVA digital assets; a patch and remediation management program to help computer systems remain current with software patches or software updates; an offensive threat management program to emulate threat actor activities; a cybersecurity training program to help educate employees and contractors, including by providing scenarios designed to train the workforce on responding to cybersecurity incidents; implementation of standard terms and conditions where appropriate in TVA’s supply chain contracts to help mitigate TVA’s cybersecurity risk, including through requiring timely notice of vendor cybersecurity incidents and data impacts and compliance with laws, regulations, and TVA’s policies on cybersecurity; and a program to accomplish cybersecurity event detection alerting. These programs are based on principles from the National Institute of Standards and Technology and certain regulatory standards that are designed to protect against cybersecurity incidents, including the North American Electric Reliability Corporation Critical Infrastructure Protection Standards and Nuclear Regulatory Commission cybersecurity standards, and are periodically assessed by third-party experts. In the last three fiscal years, TVA has not experienced any material cybersecurity incidents. TVA is not currently aware of any potential cybersecurity threats, including as a result of any previous cybersecurity incidents, that may have materially affected or are reasonably likely to materially affect TVA, including its business strategy, results of operations, or financial condition; however, TVA cannot provide assurance that it will not be materially affected in the future by cybersecurity risks or any future material risks. For more information on TVA’s cybersecurity related risks, see Item 1A, Risk Factors – Cybersecurity and Information Technology Risks in this Annual Report.
Cybersecurity Risk Management Processes Integrated [Text Block] | . Within this framework, TVA operates numerous programs under internal written policies and procedures, which are aimed at helping protect TVA’s information resources. These include a vulnerability management program to help address cybersecurity threats to TVA digital assets; a patch and remediation management program to help computer systems remain current with software patches or software updates; an offensive threat management program to emulate threat actor activities; a cybersecurity training program to help educate employees and contractors, including by providing scenarios designed to train the workforce on responding to cybersecurity incidents; implementation of standard terms and conditions where appropriate in TVA’s supply chain contracts to help mitigate TVA’s cybersecurity risk, including through requiring timely notice of vendor cybersecurity incidents and data impacts and compliance with laws, regulations, and TVA’s policies on cybersecurity; and a program to accomplish cybersecurity event detection alerting.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | The TVA Board is ultimately responsible for oversight of the identification, management, and mitigation of enterprise-wide risk, including cybersecurity risk, and receives reports from the Audit, Risk, and Cybersecurity Committee (“Audit Committee”).
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Audit Committee is a standing committee of the TVA Board and advises the TVA Board on a variety of matters, including TVA’s processes for identifying, monitoring, and mitigating enterprise risk and reviewing and overseeing strategies for addressing TVA’s cybersecurity, data, and privacy policies and response protocols. The Audit Committee meets at least quarterly.
Cybersecurity Risk Role of Management [Text Block] | TVA’s management of enterprise-wide risks with policy implications reported to the TVA Board or a designated TVA Board committee. The risk council oversees a subordinate committee that provides comprehensive risk oversight of TVA’s security, artificial intelligence, privacy, and technology risks consistent with TVA’s mission, strategic imperatives, and approved financial and operational plans.
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Reporting to the Audit Committee and the TVA Board is the risk council comprised of TVA’s top leaders and the Chief Risk Officer (“CRO”), which is responsible for the highest level of management oversight of risk at TVA. The risk council’s primary purpose is to oversee TVA’s management of enterprise-wide risks with policy implications reported to the TVA Board or a designated TVA Board committee. The risk council oversees a subordinate committee that provides comprehensive risk oversight of TVA’s security, artificial intelligence, privacy, and technology risks consistent with TVA’s mission, strategic imperatives, and approved financial and operational plans. TVA’s governance, oversight, execution, and support activities include quarterly Enterprise Risk and Assurance updates to the Audit Committee, an annual alignment with TVA’s broader risk management framework and business planning initiatives, and tactical and intentional initiatives focused on reducing risk, increasing maturity, and helping ensure regulatory compliance and adherence. TVA engages in various audits in order to provide assurance of TVA’s effective management of cybersecurity risk and risk as a whole and is also subject to required external audits to ensure compliance with certain regulatory standards that are designed to protect against cybersecurity incidents. TVA's current VP, Cybersecurity serves as Chief Information Security Officer ("CISO"). The current CISO is also designated as the Chief Artificial Intelligence Officer and the agency’s Federal Senior Intelligence Coordinator.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Starting in operational technology as part of nuclear generation, the current CISO has spent his career in public power in various North American Electric Reliability Corporation regions and has been in the industry for over 25 years. He has led Cybersecurity for over 10 years in the sector. He was previously the CISO of the New York Power Authority, and he has experience supporting all verticals of electric operations, from the perspectives of security, resiliency, and recovery. He is a Certified Information Security Manager and has previously held Chair and Co-chair roles in the industry, such as with the Electric Subsector Coordinating Council's Cyber Mutual Aid Committee. He seeks to focus on information sharing and building partnerships to enable understanding of emerging threats. The current CISO remains active in various security organizations and the broader industry. He has a degree in Computer Science and a Master of Business Administration.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | TVA’s governance, oversight, execution, and support activities include quarterly Enterprise Risk and Assurance updates to the Audit Committee

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration