There’s no denying it: cannabis is a rapidly growing industry. Here’s what you need to know about cannabis security.The signs of growth are many. Legalization is continuing its advance across North America; in 2018, Canada became the first industrialized country to allow recreational use at a federal level and the United States seems poised to inevitably follow suit, with Michigan (most recently) joining a host of existing states that have already legalized. In the wake of changing policies, business has boomed. Estimates on the total size of the market vary, but a survey by the Cowen Group predicts $75 billion in global sales by 2030, with the vast majority of market growth coming from adult-use cannabis.
- What are the federal regulations for cannabis security?
- What are the state compliance regulations for cannabis security?
- How much security does a cannabis business need?
- What are the penalties for lack of compliance?
- How are cannabis security systems different from standard security systems?
- What digital security systems are needed for cannabis?
- What physical security services are needed for cannabis?
- Do you need access control for cannabis security?
- What are the video surveillance requirements for cannabis companies?
- How can cannabis businesses prevent employee theft?
- What equipment is needed to securely store cannabis?
- How can I take the first step toward cannabis security?
We’re only starting with a focus on regulations and compliance because those considerations will influence the subject as a whole; we’re not doing so in an attempt to provide specific legal advice.With that said, we are experts in comprehensive security systems and technology solutions, and the rise of cannabis security concerns represents an increasingly-common application of our expertise. All right – ready to work through the implications of cannabis security for your business? Let’s get started.
What are the federal regulations for cannabis security?When it comes to federal compliance regulations for cannabis security, there’s good news and bad news for cannabis businesses. The good news is that cannabis security isn’t regulated at a federal level – but the bad news is that the lack of federal regulation is only due to the fact that cannabis hasn’t been legalized at the federal level (as of June 2019). This seems likely to change. The passing of the 2018 Farm Bill descheduled some cannabis products from the Controlled Substances Act for the first time, but, according to the American Farm Bureau Federation, “while the law expands the potential for hemp production, it does not create a system in which producers can grow it as freely as other crops. The bill outlined actions that would be considered violations of the law, such as producing a plant with higher than 0.3 percent THC content or cultivating hemp without a license; it even goes into potential punishments and what happens to repeat offenders.” Nevertheless, it’s certainly a step toward decriminalization. And as legalization continues and becomes more comprehensive, it’s nearly certain that federal compliance standards will be updated as well.
What are the state compliance regulations for cannabis security?Because cannabis legalization has been enacted primarily at a state level, state cannabis security regulations do exist, and they’re fairly comprehensive. To make things more complex, they vary from state to state – so the security requirements in Michigan differ from those in, say, California. While we won’t comprehensively cover the compliance
regulations for every state (California’s Text of Regulations alone, under the Bureau of Cannabis Control, takes up 138 pages), here are some of the most common requirements:
- Businesses must take sufficient safety measures to deter and prevent unauthorized entrance into areas containing marijuana (in other words, building access control).
- In order to apply for marijuana licensing, documentation of security operations is needed. This often entails both system specifications (like the details of the video surveillance systems in use) and operational procedures (such as hours of access, security personnel, etc.).
- Appropriate regulatory agencies must be notified in the event of an incident such as a theft, loss of product, or breach. In California, reporting must be carried out within 24 hours of the incident.
- A variety of records must be kept (such as personnel information, inventory information – often from seed to product – and purchase information, etc.) and stored in a secure environment.
- Licensed premises must have a video surveillance system. Many states specify that video quality must be at least 1280x720 pixels, and functional, unobstructed cameras are required universally in any areas where cannabis is handled. Commonly, visual records must enable audit trails for all inventory.
- There must be adequate monitoring and storage of video surveillance recordings.
- Storefront businesses typically require security personnel during at least the hours of operation, and, in some circumstances, 24/7.
- There must be a functional alarm system.
- Storage systems must be secure. Often, this requires integration with the alarm system so that unauthorized access triggers an alert.
state where (as of June 2019) recreational marijuana usage is legal:
- Alaska Marijuana Regulations
- California Marijuana Regulations
- Colorado Marijuana Regulations
- Maine Marijuana Regulations
- Massachusetts Marijuana Regulations
- Michigan Marijuana Regulations
- Nevada Marijuana Regulations
- Oregon Marijuana Regulations
- Vermont Marijuana Regulations
- Washington Marijuana Regulations
How much security does a cannabis business need?With all of that said, it should be obvious that the majority of cannabis businesses need a fair amount of security. While the specifics of necessary systems and protocols will vary depending on location and type of business (breeders, dispensaries, cultivators, and manufacturers often face different regulations depending on how they’re handling cannabis), generally, compliance standards require security systems that ensure:
- Marijuana access is regulated.
- Product is secure (during handling, storage, and transportation).
- Inventory is tracked (meaning even plants that are defective or destroyed need to be under surveillance).
- Notifications are sent in the event of a security incident.
- Digital records are kept and protected.
What are the penalties for lack of compliance?Cannabis security is important because it improves the safety of the people at the business, much in the same way that security at a bank or jewelry store does. Additionally, though, cannabis security is crucial because a lack of security leads to compliance penalties. Like compliance regulations themselves, the specifics of penalties vary from incident to incident and from state to state. But on the
more severe side of the spectrum, a lack of proper security can lead to business shutdown (typically through the revocation of a marijuana license) and even jail time if sufficient negligence or willful misconduct leads to criminal charges being pressed.
How are cannabis security systems different from standard security systems?Cannabis security systems aren’t necessarily different from standard security systems in terms of their hardware or software components – they’re really only distinguished by their purpose, which is often to protect against theft while ensuring compliance. In practical terms, that often results in cannabis security systems having:
- More comprehensive surveillance capabilities than standard security systems (with more cameras, higher video quality, and more stored footage).
- More robust building access control. Regulated access is a major component of compliance, which typically means that cannabis businesses end up with robust versions of these systems.
- More system documentation. This, too, is a typical result of alignment with compliance standards.
What digital security systems are needed for cannabis?Based on generalized compliance regulations, here are the types of digital security systems that are most often needed for cannabis security, along with an example for each.
Video Surveillance SystemsAn example of a cannabis video surveillance system:
An Axis video surveillance solution. Axis provides cutting-edge technology that ensures the safety of facility premises through motion activation, live streaming capabilities, and highest-quality footage.
Building Access Control SystemsAn example of a cannabis building access control system: A pdk.io access control solution. These industry-leading door controllers make building access easier and more effective through a truly cloud-based system, and there’s no need to use wireless hubs or specialized devices.
Alarm and Notification SystemsAn example of a cannabis alarm and notification system:
Axis door stations. These promote visibility, negate the risk of key duplication, and enable high-security monitoring capabilities.
Network Systems (Digital Storage and Data Transfer, etc.)An example of a cannabis network security system: Watchguard Total Security. This solution offers a variety of features that boost data security, including intrusion protection service, Webblocker URL filtering, and Gateway Antivirus.
What physical security services are needed for cannabis?In addition to digital security systems, some regulations require physical security services, as well – in other words, cannabis businesses often need security personnel. Most commonly, security personnel are needed at retail establishments. For example, in California, based on Section 5045 of the Bureau of Cannabis Control’s Emergency Regulations: “A retail licensee or microbusiness licensee that is engaged
in retail sale shall hire and contract for security personnel to provide security services for the licensed retail premises. All security personnel hired or contracted for by the licensee shall comply with Chapters 11.4 and 11.5 of Division 3 of the Business and Professions Code.” And this regulation (as specified by the BCC) doesn’t just apply to operating hours – it actually requires the presence of a guard at any retail site 24/7. Not all businesses will require this level of security, but if you’re selling cannabis on your premises, you’ll certainly want to research the requirements for your region.
Do you need access control for cannabis security?This question’s an easy one: yes, you almost certainly need access control for cannabis security. Every state requires the regulation of access to cannabis, along with documented standards for how that’s maintained. Additionally, access control adds security – so, compliance aside, it’s probably necessary just to keep your product safe.
What are the video surveillance requirements for cannabis companies?The specifics of video surveillance requirements, unsurprisingly, vary from state to state and locality to locality – but the general requirement of surveillance is universal. Typically, cannabis video surveillance requirements include stipulations around the following considerations:
- Visibility of cannabis (in many cases, cannabis is required to be videoed at all stages of business processes). This is often stipulated through regulations around the number and placement of cameras.
- Quality of video footage. In Oregon, for example, interior video footage must be a minimum of 1.3mp per camera at 10fps, and exterior footage must be at least 5fps.
- Length of time recorded footage is stored for. For example, in Ohio, regulations require that footage is stored for at least 30 days.
- Hours that video feed is recorded. Many states require that feeds are continuous (meaning that they aren’t turned off outside of operational hours).
- Monitoring of video feed. Many states require that video feeds are monitored 24/7.
strict accordance with state and local regulations, as reiterated
by industry veteran Christopher Dunn in an interview given to Security Magazine: “The regulations for video surveillance are very stringent and specific. Even defective plants that are disposed and destroyed need to be under surveillance. Overall, video surveillance and storage is an entire process, from the seed to the trimming, any movement, to the disposal process.”
What are some additional examples of cannabis video surveillance solutions?
How can cannabis businesses prevent employee theft?According to the Marijuana Retail Report, “up to 90% of losses reported by dispensaries are due to employee theft.” This is a major cannabis security issue that business owners must consider seriously. Fortunately, many of the same systems that protect outsider theft and ensure compliance can also serve to minimize the risk of employee theft. Building access systems and video surveillance systems, specifically, can be configured to restrict access and record unauthorized access. Additionally, cannabis businesses should be particularly thorough in HR functions to mitigate the likelihood of issues in the first place. Many of these functions are actually compliance requirements. They often include:
- Performing due diligence during hiring processes and ensuring thorough background checks.
- Clearly documenting operating procedures (especially around the handling of product)
- Limiting employee (and employee friends and family) discounts
- Offering comprehensive trainings on operational security
What equipment is needed to securely store cannabis?In addition to the various systems and networks that we’ve discussed so far, cannabis security necessitates the secure storage of the product. Again, compliance regulations vary, but common standards include:
- Locked retail containers for cannabis (display cases, cabinets, etc.)
- Locked storage containers for cannabis (safes, cabinets, etc.)
- Access control at entry points where cannabis is present or stored (locked and monitored doors)