Access control total cost of ownership, compared over 10 years

Most access control quotes answer one question: what does it cost to install. That is a fair question, and our commercial access control cost guide answers it for Orange County in detail. But the install invoice is the one number you already know about. The costs that decide whether a system was a good buy show up later, as a monthly license, a server that dies in year six, a box of replacement badges, or an office manager who spends Friday afternoons re-programming keypad codes.

We have been installing and servicing these systems since 1984, which means we have watched a lot of them age. This guide lays out every cost bucket we see over a typical ten-year life, then runs the numbers for two example buildings. The examples use stated assumptions and ranges. They are illustrative, not quotes, and you should swap in your own numbers wherever you have them.

What total cost of ownership means here

Total cost of ownership, or TCO, is the sum of everything a system costs from the day it goes in to the day you replace it. For access control, ten years is a sensible window. It is roughly where controllers and readers start to reach the end of a normal service life, and long enough that recurring costs stop being rounding errors. A $20 per door monthly license looks small on a proposal. On four doors over ten years it is $9,600.

The install is also the part of the cost with the least uncertainty. Any competent bidder will price your doors within a reasonable range of each other. Where proposals really diverge is in what they leave out: whether a server is included and who maintains it, which license tier your features actually require, what a service call costs after the warranty ends, and what it would take to leave the platform.

The four approaches we are comparing

Installed ranges are for typical Orange County commercial retrofits in 2026 and match our cost guide. Complex openings, such as aluminum storefront doors or doors that need electrified exit devices, run $3,500 to $6,000 and up regardless of approach.

Where the money goes after install day

Here is every bucket we include in a ten-year number, with what drives each one.

• Software and licensing. Cloud platforms charge per door, typically $10 to $30 a month depending on platform and tier. Brivo publishes tiers starting around $13.50 per door per month, and Verkada sells door licenses on fixed terms. PDK licensing is quoted per project, so ask for your number rather than trusting a generic one. On-premise systems in the class we install (CDVI, Paxton, Keri) carry little or no recurring software cost, though major version upgrades are sometimes billed.
• The server and the IT time behind it. On-premise software runs on a PC or server you own. It needs operating system patches, backups, and replacement every several years. Operating system support dates are a hard deadline here: Windows 10 support ended in October 2025, and Windows Server 2016 extended support ends January 12, 2027. A server that can no longer be patched is a security problem sitting on your network with the keys to the building.
• Service and repairs. Readers fail, a controller board takes a surge, a door closer drifts out of adjustment and the lock stops latching. On-premise systems also tend to generate service calls for routine changes like a new door schedule, because the person who knows the software is often the installer. Whether you pay per call or through an agreement, see our guide to access control maintenance agreements for what a good one covers.
• Batteries. Wireless and standalone locks run on AA batteries. Schlage rates its NDE wireless lock at up to about two years per set, and heavier traffic shortens that. Wired systems carry sealed lead-acid backup batteries in the power supplies, and the usual guidance is to replace those every three to five years, sooner in a hot electrical closet.
• Hardware refresh. Controllers and readers commonly last 10 to 15 years. Inside a ten-year window you will likely replace a few components rather than the system, which is why we fold that into service and repairs below instead of pricing a full refresh.
• Credentials. Basic 125 kHz prox cards run about $3 to $4 each in quantity; high-security smartcards run roughly $5 to $14. People lose them, and every new hire needs one. Mobile credentials cut that cost. ProdataKey includes unlimited mobile credentials at no extra charge, while other platforms may charge per user. If you print photo badges, the card printer and its supplies are their own line item.
• Admin time. Someone adds new hires, removes departures, changes schedules, and lets the HVAC tech in on a Saturday. On a cloud system that is a few minutes in a browser or phone app. With keypads it can mean walking to every door to change a code. At $40 an hour, one hour a month of staff time is $4,800 over ten years, which makes this bucket bigger than people expect.
• Rekeying. This is the baseline cost of a key system. Every time a key walks out the door with a former employee, you either rekey or accept the risk. Commercial rekey pricing varies widely, from a few dozen dollars per standard cylinder to well over $100 for high-security or restricted keyways, plus a trip charge.

Adding doors, and eventually leaving

Two costs rarely appear on a proposal because they happen later: growing the system and getting out of it.

Expansion cost depends on controller capacity and the platform's hardware model. A system installed with spare door capacity adds a door for the reader, lock, and wiring. A system installed with a panel that is already full may need a new controller before the next door goes on. On PDK, a new door typically means adding a Red expansion controller, which is one of the reasons we install it most. Standalone keypads expand one lock at a time, and every one is another island to manage. We compare how each cloud platform handles growth in our PDK vs. Brivo vs. Verkada guide.

Exit cost is the one to think hardest about. Most platforms, PDK included, run on their own controllers, so moving to different software usually means new controllers and new readers, and often new credentials. The wiring, electrified locks, power supplies, and request-to-exit devices carry over. That split is why we budget a platform migration at roughly 40 to 60 percent of a fresh install. Systems built on open-architecture controllers, most commonly Mercury-based panels, can sometimes be moved to a different software vendor without replacing the panels, since many software makers support that hardware. That can lower exit cost, though reprogramming, licensing, and compatibility still need to be confirmed for the specific software you are moving to. Platforms that require their own proprietary hardware for everything, cameras included, tend to have the highest exit cost of all.

A worked 10-year example

The numbers below are illustrative, not a quote. They exist to show how the buckets add up, and every one of them rests on an assumption we state here so you can argue with it.

• Window and dollars. Ten years, today's dollars, no inflation or financing. Mechanical lock wear and general door repairs are left out because they apply to every option equally.
• 4-door office. About 25 people. All four doors are standard openings.
• 12-door building. About 60 people at one site. Ten standard doors plus two complex doors (storefront or electrified exit device) at $3,500 to $6,000 each.
• Installation. Keypads at $2,000 to $3,000 per door; on-premise and cloud at $3,000 to $4,000 per standard door. Keys assume the existing locks stay.
• Software. Cloud at $10 to $30 per door per month. App-managed keypads at $0 to $10 per door per month. On-premise version upgrades at $0 to $1,500 (4 doors) or $0 to $3,000 (12 doors) over the decade.
• Server and IT (on-premise only). One or two server replacements at $1,500 to $3,000 each, plus $0 to $50 a month (4 doors) or $0 to $100 a month (12 doors) of outside IT upkeep. The $0 end assumes your own IT staff absorbs it.
• Batteries. Keypad locks: five to seven battery changes per lock at $10 to $20 each. Wired systems: power-supply batteries replaced two or three times, one or two batteries (4 doors) or two to four batteries (12 doors) at $75 to $100 each.
• Credentials. On-premise cards: 8 to 12 cards a year (4 doors) or 20 to 30 a year (12 doors) at $4 to $10 each. Cloud: mostly mobile credentials, with a smaller card budget for visitors and holdouts.
• Rekeys. Key systems: three to six full rekeys over ten years at $300 to $600 each (4 doors) or $900 to $1,800 each (12 doors). Electronic systems: zero or one rekey of the override cylinders.
• Admin time. Valued at $40 an hour. Hours per month are listed in the table and are the most subjective assumption here, so we show totals with and without them.

4-door office, 10 years

12-door building, 10 years

12-door cash totals include licensing of $0 to $14,400 (keypads), $0 to $3,000 (on-premise), and $14,400 to $43,200 (cloud); on-premise server and IT of $1,500 to $18,000; service and repairs of $1,500 to $6,000 (keypads and cloud) or $2,500 to $8,000 (on-premise); batteries of $600 to $1,680 (keypads) or $300 to $1,200 (wired); credentials of $0 to $500, $800 to $3,000, and $200 to $1,500; and override rekeys of $0 to $1,500. Illustrative, not a quote.

How to read these numbers

A few things stand out, and not all of them flatter what we sell.

Keys are the cheapest option in cash at both sizes, by a lot. What they do not buy you is any record of who opened a door, any way to take access away without a locksmith, or any schedule that locks the building when the last person forgets to. At four doors, cloud costs roughly $16,000 to $31,000 more than keys over the decade, comparing like ends of the ranges. Whether that is worth it depends on what one bad incident would cost you. For a lot of businesses one incident settles it.

On-premise and cloud overlap heavily. Cloud's license is the largest recurring line in the whole comparison, and it is visible on every invoice. On-premise's costs are spread across server replacements, IT time, and service calls, and they are easy to forget when comparing bids. At the low end of on-premise, where in-house IT absorbs the server for free, it beats cloud. At the high end, where you pay someone to maintain a server and call the installer for every schedule change, it does not.

Standalone keypads look cheap at four doors and fall apart at twelve. The hardware is less expensive, but every lock is managed on its own, codes get shared, and admin time climbs with the door count.

Where cloud is not the cheapest answer

We install cloud systems, mostly ProdataKey, in the majority of Orange County buildings we work on. We also tell people when it is the wrong spend. The common cases:

• One or two doors, few users, low turnover. A standalone keypad lock on a single interior door, or even a good key system with a restricted keyway, can be the sensible choice. Paying monthly licensing to manage five people on one door rarely pencils out.
• A working on-premise system with in-house IT. If your panel is still supported, your server is on a current operating system, and someone on staff keeps it patched, the cheapest year is usually the one where you keep it. Plan the move for when the software or hardware reaches end of life, not before.
• Buildings where nobody will use the remote features. A lot of cloud's value is remote unlock, instant revocation, and managing from a phone. If your doors are managed by one person sitting next to the server and staff never change, you are paying for capability you will not use.

Cloud tends to come out ahead in the opposite situations: more than one location, frequent hires and departures, no IT staff, or an existing server that is about to need replacing anyway. IT teams weighing the security and network side of that decision should read our cloud access control guide for IT directors.

Hidden costs that show up in year three

• License tier creep. The entry tier may not include visitor management, advanced reporting, or the integration you wanted. Price the tier your must-have features live in, not the entry tier.
• Multi-year price escalators. Some licensing renews at a higher rate after the first term. Ask what year four costs.
• Per-user mobile credential fees. Some platforms include mobile credentials; others bill per user. At 60 people that adds up.
• Permits and code work. Anything that changes how an exit door releases touches California Building and Fire Code egress rules. Budget $500 to $1,500 in permit-related cost on code-touching doors, and expect it again if you add doors later.
• Full controllers. A panel sized exactly to today's doors turns the next door into a new controller.
• Operating system end of life. On-premise software that only runs on an older version of Windows forces a server replacement on Microsoft's schedule, not yours.
• Cloneable credentials. Staying on 125 kHz prox cards saves money until someone copies one. Replacing a whole card population later costs more than choosing a better format at install.

Questions to get a real TCO from a bidder

Hand these to every contractor bidding your project. The answers turn an install quote into a ten-year number you can compare.

If you are replacing an older system rather than starting fresh, part of your ten-year cost is already sunk into wiring and locks that can be reused. Our guide to replacing legacy access control explains what usually carries over.

The simplest way to use all of this: ask for the install price and the ten-year recurring costs on the same page, from every bidder, including us. When we write up a proposal from a free on-site survey, the licensing, service terms, and expansion costs sit next to the install number so you can run the comparison yourself.