Removable media and transient cyber asset tracking for NERC CIP
CustodyTap puts an NFC tag on each USB drive, laptop and piece of test gear. Technicians tap it with their phone at every check-out, scan, connection, hand-off and check-in. The result is a custody record that supports evidence for CIP-003-9 Attachment 1 Section 5 and CIP-010-4 R4.
For compliance leads and field supervisors at utilities with low impact sites, and at those with medium or high impact sites that manage transient cyber assets and removable media.
Records made at the cabinet, not reconstructed later
Tap the tag and confirm with a fingerprint, and the record is made. The app offers only the actions that make sense for that item right now, so the details auditors ask for get filled in at the time:
- what the item was used for, and who authorized it;
- the scan method, tool, definitions date and result;
- when it was connected and disconnected.
Every action has a name on it
Each tap is confirmed with the technician's own fingerprint or face unlock on their own phone. A hand-off isn't complete until the receiver taps the same tag and accepts it. If they don't, the item stays with the person who had it, and the missed hand-off shows up as an exception.
A record that shows if anyone changes it
Events are chained together by hash, and each day's head is emailed to your admins. A changed or deleted record breaks the chain. Exports come with a short script that checks everything without CustodyTap, so your auditor doesn't have to take our word for it.
Reuse and disposal, documented
Sanitization and destruction records include the method, the witness and photos with their SHA-256. Each one produces a certificate that supports evidence for CIP-011-3 R2.
No BCSI required
Items are tracked by asset code and location code. Free-text fields carry a reminder to keep system names and addresses out.
What your auditor gets
- One custody history per item, from registration to destruction
- A use log with one row per connection
- An exceptions report: missing scans, expired hand-offs, broken seals, lost items
- Certificates of sanitization and destruction
- A data export they can check themselves
What do your records cost now?
Enter how many transient cyber assets and removable media you manage and how you record their use. You'll see an estimate of technician and compliance time and expected noncompliance costs, based on NERC's published counts, with its range and every assumption shown.
Start a 90-day pilot on one site
We set up your organization, tag your first items and train your technicians. You keep your data.
dbrown@enthropicdata.com