Overview

A cannabis security plan is an indispensable tool for every marijuana business. Security plans are an important part of running any business but the cannabis industry needs them more than most because of the increased security needs and risks that come with operating a cannabusiness.

A well-written cannabis security plan is not only critical to business success and longevity but is generally one of the major requirements that must be met to acquire an operating license. Security plans hold one of the highest point values and play a significant influence in determining whether an applicant will be granted a license. When there is a high level of competition for a limited number of licenses, having a competent security plan may make or break your chances of getting placed at the top of the list.

We have prepared a comprehensive guide with everything you need to know about cannabis security plans. 

What Is a Cannabis Security Plan?

The cannabis security plan is a comprehensive guide to help you address all your security concerns in one place. It covers everything from building security and employee security to business continuity and disaster recovery plans.

A cannabis security plan is a written document that outlines how your business will mitigate risk, handle any threats or emergencies, and protect staff and assets. It can include things like who has access to which areas of the facility, how often they have to check in with security personnel, who they are allowed to interact with, what personal items they can bring to work, and so on.

Why Your Cannabis Business Needs a Security Plan

A security plan for your cannabis company should be in place for a variety of reasons.

Here are a few reasons:

• Protecting the health, safety, and welfare of personnel and the general public as well as preventing the unlawful diversion of cannabis material are the primary goals of the security plan. You have a responsibility to ensure the well-being of your staff and your clients at all times.

• It is essential that you keep cannabis and cannabis-related products out of the reach of minors and that you take measures to deter the theft of products from your facility. Your security plan may include measures to limit access to users who are legally allowed to possess cannabis, as well as measures to prevent trespassing and the theft of cannabis or cannabis goods. This can be especially helpful if there are multiple locations where people can purchase marijuana products from one company.
• Security plans help protect against lawsuits. If someone gets injured on your property, whether they’re an employee or a customer, there is a chance they could sue you for negligence if proper security measures weren’t implemented. If this happens, having a security plan in place could help prove that you took all reasonable precautions to ensure their safety while on your property.
• When applying for a cannabis license, applicants are required to provide a detailed security plan. Also, when looking for financing, having a comprehensive cannabis security plan helps demonstrate your expertise and dedication.
• Cannabis businesses are an attractive target for criminals due to the nature of the industry being a cash business. In fact, a cannabis business burglary may result in losses that can run anywhere from the low tens of thousands to well into the six figures. 
• Cannabis businesses are also especially appealing targets for cybercriminals because they handle sensitive personal information and they operate in a young, quickly developing market where many businesses have not yet implemented established cyber-security standards. IBM and the Ponemon Institute reported that the global average cost of a data breach across all industries in 2021 is $4.24 million. 

What Do Regulators Want to See in a Cannabis Security Plan? 

The use and possession of cannabis are both against the law at the federal level. However, the regulation of cannabis is left up to each individual state. A great number of states have enacted regulations that stipulate the criteria for video surveillance, such as the required minimum resolution of the camera, the number of frames it must record per second, the fact that it must be operational at all times, and the amount of time it must be kept on file. 

Your state can demand that you secure the entrances in order to prevent anybody from gaining unlawful entry and that you meet certain storage criteria for the marijuana. To determine the level of security that is necessary, you will need to do research on the particular rules that apply in your state or territory.

When regulatory bodies ask for a security plan for cannabis businesses as part of the pre-licensing process, there are two primary considerations that they have in mind.

First, they are interested in seeing your security schematics. These are floor plans of your business that highlight all its security features including video cameras, alarms, sensors, lighting, and other elements.

Second, they want a narrative description of the safety precautions that are being taken. This explanation brings to light everything that is shown in your security diagram and the procedures that are associated with the equipment.

Cannabis Security Best Practices

As marijuana becomes legal across the US, there are many things to think about when making a security plan for your business.

Here are some important considerations when developing a cannabis business security plan:

Security Locks

Security locks are one of the issues that security plans will address. The following are some of the typical requirements for security locks in cannabis businesses.

• Most states mandate the installation of non-residential door locks of a commercial standard on all access and exit points.
• Commercial doors and non-residential locks must be used to secure restricted areas.
• Dispensary kiosks and fixtures, such as hinged cabinet doors, drawers, and display cases, may be equipped with security locks.

The inclusion of the lock brands and model numbers in your cannabis dispensary’s security plan is likely to be required by most regulatory agencies. It’s possible that you’ll also need to give the name of the firm that’s installing the security and evidence that they’re authorized.

Video Surveillance

Each state has rules for the number of surveillance cameras, image quality, camera location, remote video access, and video storage duration. Some jurisdictions require 90 days of video storage, but the industry norm will likely follow California’s 1-year minimum. All cameras must be active 24/7 and identify people from above and at eye level.

Include in your security plan the cameras and network video recorder (NVR) you want to employ; security rules on who may access your security cameras’ data and how; networking and cabling schematics for the cameras; and a map of your cameras’ estimated range.

Alarm Systems

Basic security measures, such as intrusion (or burglar) alarms that trigger while you are not in the facility, should also be in place. As it is unlikely that someone will be there 24 hours a day, you should have an alarm system that will warn you and the police if someone breaks in or tries to break in.

Access Control 

A complete cannabis security plan must include access control in order to prevent unauthorized people from accessing restricted areas. Developing an access control system is critical to the safety and security of your cannabis operation. Local host access control, access control methods, role-based access control, discretionary access control, and mandatory access control are all types of access control systems.

In your cannabis business plan, you may include a method for validating new customers or patients, a method of preventing entry to unauthorized individuals, a floor layout depicting your shop floor and waiting area, and the limit on store customers, if any.

Cybersecurity

As cannabis companies are vulnerable to a variety of cyberattacks, it is prudent to implement security precautions in order to reduce the likelihood of unfortunate outcomes. There is a broad range of options available to meet the unique requirements of your company. This may include the following:

• Security risk assessments 
• Dark web monitoring
• Security configuration
• Data loss prevention
• Software & hardware security updates
• Incident response plan
• System hardening
• Firewalls
• Intrusion detection systems
• Access management
• Mobile device security management
• Endpoint detection & response
• Monitoring for malicious activity and policy violations

Background Checks

Since staff theft is the most prevalent cause of revenue loss in the marijuana sector, a marijuana security plan should always contain procedures for conducting background checks on all the company’s workers. This is especially critical for a contentious market like the selling of marijuana, especially considering that the commodity was banned up until quite recently. A background check might make it less likely that you’ll let someone with bad intentions into your dispensary by accident.

Integrating All Components

The majority of thefts in the cannabis sector occur inside the business itself. Discount misuse is an example of a kind of employee theft. By connecting your video and point-of-sale (POS) systems, you can find and stop this kind of manipulation, as well as cash refunds and several other POS-related scams.

What Your Security Plan Should Cover

Facility Security

This is where the development of the security plan can become difficult. In this section, you will describe the exact location and design of your dispensary, as well as all security measures, equipment use, and implementation. Below are the following topics you must clarify in your facility security plan. 

Physical Security

• Provide your physical address. Describe your property, the neighborhood, and its culture in detail. 
• Include a site plan and a floor plan that show a layout of your facility’s security features and where they are located on the property.
• Give detailed descriptions of all lights on the property, their locations, and the function each light serves in the overall security plan.
• Provide a detailed account of the company employing security guards at your facility—describe screening procedures as well as the duties of each guard.
• Explain all the components of your perimeter security, including specs of fences, doors, walls, etc.
• Give a detailed account of how authorized staff and guests will access your facility. Include specifics on everything from parking, entrances, and exits to keycards & passcodes, deliveries, how visitors will be navigating the building, and the process taken to verify the identification of guests and employees.
• Detail procedures for other site visitors other than patients and caregivers, such as law enforcement officers, first-responders, political officials, and members of the media.
• Explain how movement throughout facility access points will be monitored or controlled.

Electronic Security System

• Provide detailed information about your video surveillance equipment and its functions.
• Justify how break-ins and motion sensors will be used and monitored.
• Explain your emergency alarm system and its features, testing and maintenance, protocols, and procedures.

Policies and Procedures for Facility Security

A thorough set of security-related rules and processes is essential for cannabis businesses. Standard operating procedures help guarantee cannabis businesses operate properly and consistently. The rules and processes for how things should be done should be clearly outlined in detail in a thorough policy and procedure manual. This written document will explain to workers how they should act and behave, as well as what they can expect from your company’s policies.

• Give detailed accounts of how emergencies, breaches, and other incidents will be managed. Be creative and think of those “what if” situations. Those are the ones you want to cover.
• Present policy for training your staff to respond to emergencies.
• Explain the process for notifying authorities and maintaining your own record of these incidents.
• Describe the procedures for opening and closing the dispensary.
• Define any and all measures taken to prevent theft and diversion. Include storage safes, cages, locks as well as the location of all products, and purchasing procedures.
• Explain how you plan to prevent on-site consumption.
• Tell how suspicious activity and loitering will be reported and managed.

Operational Security

In this section, your goal is to prove that your daily operations and management support the physical security measures. Here you will convey how you will vet prospective employees, train staff, and maintain records.

Workforce Security

• Outline staffing procedures. Detail your entire staffing process by explaining how you plan to advertise the positions, run background checks, conduct interviews, etc. 
• For hired staff, define the training and drills that are required to ensure employees are proficient with procedures for product safety, patient registration, crime prevention, and emergency response. 
• Explain how you will ensure patient records remain private and confidential.
• Explain how you will measure your staff’s competency in security and how often these evaluations will take place.
• Cover how you plan to take and store records of both employees and customers.

Inventory Security

• Detail your transaction procedures and provide your inventory control and tracking plan. Define the point of purchase software you will implement. 
• Give a detailed description of your product storage system and what equipment you will use for safes, sprinkler systems, and the storage area.
• Provide an extensive outline of the transportation procedures. Include details about tracking, truck security (is it bullet-proof and is the transporter armed?), and how deliveries will be protected. Additionally, describe how your transport process will protect both the people and product involved. 
• You need to have a specific plan for the disposal and record-keeping of unused, surplus, lost, or stolen products.
• Describe your meticulous record-keeping system. What will it look like, and how will you maintain it?

Information Systems Security

• Describe the measures you will implement to keep your data and information systems secure. These include procedures for virus protection and digital breaches. 
• Be thorough about how your patient’s health records are kept secure in your systems.
• Include relevant and necessary forms that detail your data security.

Essential Security Strategies for Cannabis Businesses

Perform Regular Security Audits

• Conduct routine inspections to identify vulnerabilities in physical and cybersecurity measures.
• Work with security professionals to update protocols as threats evolve.

Invest in Professional Security Services

• Hire security personnel trained in cannabis industry regulations.
• Partner with a security firm specializing in dispensary and cultivation facility protection.

Develop Emergency Response Plans

• Create protocols for robbery, cyberattacks, and natural disasters.
• Train employees on proper emergency procedures.

You can watch our full presentation on Security Plans for Cannabis Businesses, where we cover security risks, compliance and licensing considerations and more here: