Many states require you to submit a formal dispensary security plan as part of the cannabis dispensary application process. These security plans should address whatever requirements are listed in state or local laws and regulations, including those related to:
- Physical security systems (door locks, alarms, etc.)
- Surveillance systems
- Security guards
- Security training
- The safe storage and delivery of cash and products
An in-depth security plan can also show your professionalism and dedicated when trying to get funding.
Beyond meeting requirements or impressing investors, of course, the point is to keep you, your employees, and your business safe and secure, so keep those end-goals in mind – 1) compliance and 2) actual safety, which don’t always go hand and hand – when you’re drafting your security plan.
Why Dispensaries Need Security
Dispensaries are a natural target for crime. They carry a decent amount of cash and an expensive, lightweight product that’s easy to resell on the black market.
Clear dispensary crime statistics are somewhat difficult to come by, and often focus on crime in the surrounding area rather than crimes committed against the dispensaries themselves. This 2014 article reported a burglary and robbery rate of about 50% in Colorado. This more measured article suggests a burglary and robbery rate of around 15-20%, similar to liquor stores and a lower rate than banks.
Regardless, cannabis dispensaries are still relatively high-risk businesses, so having a security plan is important – at the very least until federal legalization occurs and eliminates both the need to run dispensaries as all-cash businesses and the black market that makes reselling stolen products relatively easy and profitable.
Formatting Your Dispensary Security Plan
California and other states have a standard format for their security plans. Others leave it up to you.
If your state mandates a certain format for your security plan, obviously follow it. If not, just do your best to represent your security plan in as comprehensive and professional-looking way as possible. We’d suggest addressing all rules/requirements on a point-by-point basis.
Include professional-looking diagrams as necessary, and generally make it easy for the people reviewing your plan to get the info they need.
One good thing – many parts of your security plan aside from location-specific digrams can be reused when applying for new dispensaries, especially if it’s in the same state. Even across states there’s a lot of overlap, so regardless once you do your first security plan the next ones are a lot easier.
What Level of Detail Do I Need?
You can include as much detail as you want. It may depend somewhat on the level of competition for licenses in your state. If it’s high you want your security plan to be as thorough and detailed as possible to show you’re a responsible company. If you have an open application process, regulators will redact the public version of your security plan for safety.
Can I Just Buy a Pre-Made Security Plan?
Certainly there a few security plan templates you can buy out there on the internet. We haven’t seen them and can’t really say much about them.
There are a couple reasons why you might not want to go this route though:
- Using a template for your security plan may look unprofessional to regulators
- You still have to customize it according to your state and city requirements, and things like diagrams can’t be taken from a template
- You shouldn’t treat your security plan as a formality. It should be a comprehensive and well-thought-out plan to keep your products, employees, customers, business, and surrounding community safe.
- Not taking security can reflect poorly on both you and the entire legal cannabis industry.
If you want outside help, consult with a lawyer that specializes in cannabis law or a cannabis business consultant/cannabis security consultant. We can recommend a few.
You probably want a lawyer/expert to review your documents for you at some point anyway – why not get them involved from the start and have them draft your plan for you? It’s much less work for them – they’ve been through the process before, can interpret some of the legalese for you, and can probably reuse a lot boilerplate they used with other clients.
What Your Dispensary Security Plan Should Cover
1) Locks and Alarm Systems
Except from Illinois’s cannabis law covering alarms
What Your Security Plan Should Include:
- Details on the locks and alarms you intend on installing
- Relevant diagrams
- Details on the installer and security company including licenses/accreditations
Most states require you to install commercial-grade locks on all your external doors and to install an alarm system, usually one monitored and managed 24/7 by a company like ADT and/or sends alerts to your local authorities.
Some states have other alarm requirements including silent panic alarms, and Illinois, for one, requires alarms that trigger based on the smashing of windows.
We have lock and alarm system companies that we’ve worked with and can recommend if you want to contact us. Your construction company probably will also have some good connections and recommendations too.
2) Surveillance Systems
These cameras from Hikvision, Axis, and Hanwa work for most dispensaries.
What Your Security Plan Should Include:
- The cameras and NVRs you intend to use
- Proof that your cameras will be remotely accessible as required
- Map of your cameras with their approximate range
- Networking and cabling diagrams for the cameras
- Security policies surrounding who gets to access your security cameras and their data and how
Most states require you to install security cameras covering all the important areas of your business, including entrances and exits, POS stations, restricted areas, and anywhere you have cannabis products – so basically everywhere but your bathrooms and break rooms.
Most states require these cameras to be useful, so they have to be clear enough to identify people. Some list specific requirements for resolution and frames per second.
In addition, some states require you to provide remote access to your surveillance systems or records, either on a continual or as-needed basis, to authorities.
Many states require you to retain your video footage for a minimum of 30-90 days, and some even require you to maintain backup copies of this data for a certain period of time.
Plus, you have to make sure your surveillance equipment and data can only be accessed by authorized employees or outside regulators/law enforcement. This means doing things like putting your NVRs and backup drives in locked racks and implementation strong passwords and 2FA on your surveillance software.
3) Delivery and Transportation Security
$145,000 in cash being stolen from a marijuana distributor at a gas station in Santa Ana, CA, in January 2020.
What Your Security Plan Should Include: detailed delivery and transportation policies showing you understand and comply with state and local law
You’ll probably have to submit a separate plan for performing safe and compliant deliveries of cash and cannabis to and from your dispensary, but just in case we’ll discuss the security aspects of deliveries here anyway.
The requirements in your state may include:
- Using only company vehicles to make deliveries
- All vehicles have to be unmarked, with no company signage
- Your vehicles may need cameras pointing inside and outside
- Your vehicles may need a GPS tracker installed
- Many states require at least two people in the vehicle
- Cannabis products have to be stored in a secure non-descript container
- Logging all deliveries
- Never performing deliveries on the entrance, street-facing side of your business; always doing it from an area in the back
4) Access Control and Security Guards
Example of a check-in area from South Coast Safe Access, a dispensary in Santa Ana, CA.
What Your Security Plan Should Include:
- A plan for verifying new customers or patients and restricting access to unapproved patrons
- Floor plan showing your waiting area and your shop floor
- Background and certification of any security guards or companies you’ve hired/contracted with
Many states require you to verify that someone is 21 years or older or a registered patient (if it’s a medical marijuana dispensary) before you let them into any areas where there’s cannabis. So you’ll need to have a check-in area near the door or a doctor’s office-like waiting room.
You may or may not need to hire security guards, unless you’re in a state like California that requires one. It’s up to you. Their presence may make some patrons more comfortable about shopping at your store; others may feel less comfortable. Armed guards can be intimidating to robbers and law-abiding potential customers alike. There’s lots of trade-offs to consider.
In general, you want the person or persons at your front door to be friendly, welcoming, and efficient. At the same time, you also don’t want them to be pushovers or scofflaws that let anyone go through.
Check your state regulations. Pretty much all prohibit loitering of any kind both inside and outside the business, and some even limit the total number of allowable people in a dispensary at once to a certain customer/patient ratio.
5) Restricted Access Areas
What Your Security Plan Should Include: details on how you plan to protect your back office areas, handle visitors/vendors, and keep even employee access to a minimum
In addition to restricting access to your sales floor, you should also have areas in the back that aren’t visible or easily accessible from the sales floor where you keep your cannabis and cash supplies, your NVRs and switches/routers, any growing or processing areas if you’re vertically-integrated, and other sensitive stuff.
Access should be restricted to a small number of employees that need to access these areas.
Visitors, including vendors, need to be issued identifying badges, be escorted by an approved employee at all times, and have all their information and visits logged.
Common ways to restrict access to these areas include keycard-locked doors, and safes and vaults for cash and cannabis products.
6) Security Training
What Your Security Plan Should Include: copies of security training documents and internal policies and procedures
You should make your employees aware of all the security policies, procedures, and measures that are relevant to their role during their training. Test them on it to make sure they understood, since 1) you have a genuine concern for their safety and 2) just because you have records of training someone might not be enough to absolve you if they forget or neglect their training and violate a state or local law.
Since cannabis is a relatively high-risk business, train your employees what to do in the event of robbery, including the locations of any panic buttons and what to say or do if the robbers demand access to the back areas or cash drawers. Some states require this sort of training.
Also make sure your employees understand the importance of reporting any theft or unexplained inventory loss immediately. Many states require you to report any such loss (in some cases, once it reaches a certain threshold) to law enforcement and regulators within 24 hours.
Don’t Forget IT Security
Many state laws for cannabis dispensaries don’t really focus on IT security, aside from requiring you to do your due dilligence to protect your surveillance video data and all your records (financial, inventory, patient files, deliveries, etc.). They don’t really go into detail about the reasonable steps you should take to protect your IT.
For personalized advice on how to secure your dispensary’s IT, which varies widely depending on your business, go ahead and contact us. Security measures you should consider implementing in general include:
- Locking down your POS tablets and terminals to protect them from hacking and malware
- Segmenting your network to keep insecure data like public wifi away from secure data like POS and surveillance data
- Implementing 2FA on all your devices and services
- Installing antivirus on all your PCs
- Implementing strong password policies
- Installing and monitoring a firewall appliance
- Educating employees about cyber security, including how to spot phishing emails
Protecting Your Corporate Office
Also, don’t forget that your corporate office (if you have one, or plan to have one) can be a target too. You might not have any cash or cannabis there, but your systems can still be hacked and held for ransom or exploited like any other business.
Or – just as bad – someone could hack your corporate IT and gain access to things like delivery schedules and procedures, or hack into your cameras and see where your safes are and how much money or product are in them, and leak or pass on that info.
Another consideration – with the coronavirus epidemic still going on, and the future of the corporate office somewhat in question, for many the corporate office is their home. It’s important for remote workers to follow security best practices at home, too, including:
- Not leaving their PCs logged in when they’re away from their desks
- Using secure Wi-Fi
- Installing and updating antivirus on their personal machine
- Using strong passwords and 2FA on all their devices
How Cure8 Can Help
We’re an IT company that specializes in supporting cannabis companies. We’ve helped dispensaries, cultivators, distributors, and manufacturers to design, plan, implement, and manage their IT for them.
There’s often a lot of overlap between physical and IT security and compliance, so we’re very familiar with all the different state security regulations and how to comply with them.
Plus, while other consultants can only advise on planning and design, we have the on-the-ground experience actually implementing these security and compliance controls – so we know what actually works and what doesn’t, what only works out on paper but doesn’t really work out in reality.
We can help with:
- Planning and design, including design of secure IT systems, security camera location and orientation, and network and cabling design
- Installing and managing your surveillance system
- Managing and monitoring your IT, including firewalls and POS/ERP systems
- Procuring the best IT hardware for you at affordable rates via the e-commerce store at our new venture Cure8
- Analyzing your current environment for security and compliance