Estimate what your TCA and removable media records cost

How the estimate works

Your browser runs 10,000 simulations. Each one picks a value from a range for everything you didn't enter, then works out a year of records two ways, your current method and CustodyTap, with the same picks, so the two are compared fairly. The figures above are averages over those simulations, and the range shows where 8 in 10 of them fall.

What's an assumption

How long each method takes to record one use, review the logs each month, pull evidence for an audit and record a reuse or disposal, and how much of the noncompliance a complete record made at the time of use would prevent (we use 20% to 70%). CustodyTap's own figures are estimates of how the product is used. We haven't yet measured them at a utility. Most of the saving rests on them: if recording a use took as long with CustodyTap as with a spreadsheet, the estimate would fall by about half, and if the monthly review and evidence pulls took as long too, little would be left. A pilot measures them for yours, and we'll update this page as pilots give us real figures.

Where the noncompliance numbers come from

• NERC's annual Compliance Monitoring and Enforcement Program reports count reported noncompliance by standard: CIP-010 had 182 in 2024 and 245 in 2025, CIP-003 had 133 and 100, and CIP-011 had 31 and 64.
• NERC doesn't publish counts by requirement, so we assume 10% to 40% of CIP-010 noncompliance is R4, 15% to 50% of CIP-011 is R2, and 10% to 35% of CIP-003 is Attachment 1 Section 5.
• FERC estimated in 2021 that 343 registered entities own medium or high impact BES Cyber Systems and 1,149 have low impact ones. By June 2025, 1,673 U.S. entities were subject to the CIP standards, so we use 343 to 450 and 1,149 to 1,700.
• In 2025, 83% of dispositions were Compliance Exceptions, 14% were Find, Fix, Track and Report, and 2% went through Spreadsheet Notices of Penalty. CIP penalty amounts haven't been published since 2020, so we assume $0 to $250,000, plus legal costs, for the few that reach a penalty.
• If you enter your own count for the last three years, it replaces the national figures. We add half an event so that a clean record isn't read as zero risk.

Where the pay figures come from

U.S. Bureau of Labor Statistics, May 2023: powerhouse, substation and relay repairers (median $96,600 a year) and compliance officers in electric power generation, transmission and distribution (mean $54.21 an hour), with benefits at about 30% to 35% of total pay.

What it leaves out

Time lost when an item can't be found before a job, vendor-managed transient cyber assets, and anything outside these requirements. CustodyTap's exceptions report may also surface issues that were going unnoticed, which can raise the count in the first year. It assumes technicians tap the tags: if they skip it, the saving shrinks.

What it isn't

It isn't a quote, a guarantee, or legal or compliance advice. CustodyTap supports evidence for these requirements; it doesn't make anyone compliant.