10.9.20 – SIW –
Highlights from the ongoing SecurityInfoWatch.com series include Alaska, California, Illinois, Maryland, Massachusetts, Michigan, Missouri and Pennsylvania
This article originally appeared in the October 2020 issue of Security Business magazine. When sharing, don’t forget to mention @SecBusinessMag on Twitter and Security Business magazine on LinkedIn.
This overview is an excerpted compilation of a series of feature articles highlighting state cannabis regulations and licensing security requirements throughout the United States as published on SecurityInfoWatch.com by integrator Patrick Chown, owner and president of California-based integrator Safe and Sound Security. Chown is also the president of Seed to Sale Security, a national security brand serving the cannabis industry.
To get the full overview of each state’s complicated laws and regulations, visit the link at the end of each section.
Alaska
Alaska became the first in the nation to license cannabis consumption sites in March 2019. Regulations allow licensed pot shops to seek a special endorsement that permits on-site consumption in a segregated room or outdoor space.
Alaska ruling AAC 306.720 specifies that video surveillance systems cover: Restricted access areas and every entrance to restricted access areas; exterior entrances; all point of sale areas; and the interior and the exterior of every entrance. Licensees must house all recording equipment and video surveillance records in locked and secure areas that are accessible only by the licensee, authorized employees or law enforcement.
The law allows using an offsite monitoring service or offsite storage of video footage if security requirements at the offsite facility are at least as strict as the security at the cannabis business. Video footage must be stored for 40 days in an easily viewable format with time and date stamped and archived in a format that can indicate any attempted alteration.
Alaska law 3AAC 306.715 also requires exterior lighting to facilitate surveillance, alarms on all exterior doors and windows, and policies and procedures to prevent diversion and limit loitering.
Access control should include commercial-grade, non-residential door locks on all exterior entry points.
Read the full overview of Alaska’s regulations at www.securityinfowatch.com/21153376.
California
Conflicting standards come from California’s three regulatory bodies: The California Department of Food and Agriculture (CDFA) oversees cultivators and does not require operators to submit a security plan to get a state license; the California Department of Health (CDPH) Manufactured Cannabis Safety Branch sets security requirements for cannabis manufacturers; and the Bureau of Cannabis Control (BCC) regulates commercial cannabis licenses for medical and adult-use cannabis retailers, distributors, testing labs, micro-businesses and temporary cannabis events.
CDPH: Requires cannabis manufacturers to develop and implement a written security plan that includes: Preventing access by unauthorized persons; protecting physical safety of employees; preventing theft or loss of cannabis products; securing and backing up electronic records; and installing and operating a video surveillance system.
BCC: Applicants must submit a detailed facility diagram that shows boundaries, dimensions, entrances and exits, interior partitions, walls, rooms, windows, and doorways. The diagram must show the location of security cameras. It also requires a description of activities carried out on-site.
CDFA: CalCannabis Cultivation Licensing, a division of the CDFA, licenses cultivators of medicinal and recreational cannabis and manages a track-and-trace system that records cannabis as it moves through the distribution chain.
State regulatory agencies establish a limited security framework, then allow local jurisdictions to draft additional regulations. The varied security regulations surrounding just surveillance cameras illustrates how complicated things can get. The state requires 1-megapixel cameras, while some local regulations set the bar at 8 megapixels.
Local task forces that regulate cannabis growers get little guidance from CDFA on security and are forced to adopt their own regulations. Since an agricultural environment is inherently complicated due to a lack of power and the internet, growers tend to have the lowest level of security amongst the different license types. Operators and security industry people are waiting to see what happens when the new Department of Cannabis Control takes over and regulates all license types.
Licensing a cultivating, manufacturing, or distributing operation requires a security Standard Operating Procedure that covers alarms, access control, surveillance cameras, lighting and perimeter security, among others.
Read the full overview of California’s regulations at www.securityinfowatch.com/21145001.
Illinois
The State of Illinois requires a security plan that includes a security system designed to prevent and detect diversion, theft, loss of cannabis or currency, and unauthorized access. Regulations require surveillance cameras to monitor all areas, except bathrooms. This includes entrances and exits, lobbies, elevators, employee breakrooms, point-of-sale areas, and the building and property’s perimeter. Illinois operators can extend coverage by employing security officers to monitor video feeds.
Illinois requires cameras be continuously recorded for 90 days at eight frames per second – a lower frame rate than most states. Unlike other states, Illinois specifically calls for the clear identification of license plates, faces and even POS monitors. The system must be able to produce a still photo from recorded footage and all recordings must be time and date stamped.
State regulations require testing cameras monthly to ensure they continue to operate as intended. All camera systems must connect to the internet and enable access by Illinois State Police. A failure notification system must provide audible and visual notification of any failure of the video monitoring system.
As for access control, Illinois regulations only require “electronic door locks on the limited or restricted areas.”
Read the full overview of Illinois’s regulations at www.securityinfowatch.com/21146317.
Maryland
Maryland made sweeping changes to cannabis security on Sept. 1 that no longer require licensees to store video surveillance recordings at both the licensed premises and at an off-site location – enabling licensees to choose whether to store video on-site or off-site. It also mandates keeping video surveillance footage for 90 days instead of 30.
The laws going into effect also set new surveillance coverage requirements for growers, processors, and dispensaries. All of them must maintain video surveillance at the entrance to and within each area where the business trims (or processes), packages, stores and/or dispenses medical cannabis.
Maryland law requires a high-quality HD video system capable of capturing facial details. The state expects security cameras that record by motion detection to ensure cameras record and store any movement within range. The regulations get specific about camera placement, areas to cover, continuous recording, recording on motion, etc. Licensees must operate the surveillance camera system at all times without interruption, with accurate date and time stamps.
Maryland requires an alarm system for the building and a separate alarm system in video storage areas. It also requires panic alarms throughout the facility. The law requires backup power to keep alarm systems operational for 48 hours during a power outage.
Maryland requires licensees to track people entering and leaving the building by badging agents and scanning visitor driver’s licenses. The state does not require escorts for visitors, but licensees should track them by a video camera.
Read the full overview of Maryland’s regulations at www.securityinfowatch.com/21150894.
Massachusetts
The Massachusetts Cannabis Control Commission regulates licenses for dispensaries, cultivators, manufacturers, delivery and transport, micro-businesses, and retail establishments.
The words access control system never appears in Massachusetts licensing requirements; however, the state requires securing all entrances and limited access areas, keeping product in a secure vault, and locking doors housing video storage devices. The locking mechanisms can be numbers, passwords, electronic or biometric, but the state does not mandate the use of specific access control software. Cannabis business owners must keep a daily log of access to secure areas and badge all visitors.
The law also requires business owners to have a third party perform a security audit annually. The auditor will check visitor logs and access to secure areas – all of which are much easier to provide when access control software is used.
Massachusetts requires marijuana businesses have an adequate security system to prevent and detect diversion, theft, or loss of marijuana or unauthorized intrusion. All entrances, exits, and windows require a perimeter alarm, as well as a failure notification system for the alarm system within five minutes of a failure. The state also requires a duress alarm, panic alarm, or holdup alarm connected to a central alarm system monitoring company that can notify local law enforcement.
With every license, the State of Massachusetts requires surveillance cameras that continuously record any area that contains marijuana, all points of entry and exit, and in any parking lot, which must be well lit to capture clear images. Businesses must store time- and date-stamped video footage for at least 90 days and make it available to police upon request.
Read the full overview of Massachusetts’s regulations at www.securityinfowatch.com/21149404.
Michigan
After pre-qualification, applicants must include a technology plan that covers security cameras and alarm systems, but not access control.
Every marijuana licensee must keep the facility securely locked. The mandate requires locking interior rooms, windows, points of entry, and exits with commercial-grade, non-residential door locks that meet local fire code and Michigan building codes.
Michigan rules also call for an alarm system; however, that is as specific as the recommendations get. The state is more specific for video cameras, stating, “A licensee shall have a video surveillance system that, at a minimum, comprises digital or network video recorders; cameras capable of meeting the recording requirements, in the rule; video monitors; digital archiving devices; and a color printer capable of delivering still photos.”
The state requires permanently mounted cameras to record continuously at a minimum of 720p resolution and storing time- and date-stamped footage for a minimum of 30 days. Business operators must position security cameras where they can clearly record activity within 20 feet of all points of entry and exits. Cameras must allow for the clear and certain identification of any person, including facial features, and activities, including sales or transfers, in all areas. The state recommends installing sufficient lighting to ensure clear identification in outdoor spaces.
Read the full overview of Michigan’s regulations at www.securityinfowatch.com/21148522.
Missouri
The Missouri Department of Health and Senior Services has awarded 192 licenses for medical marijuana dispensaries, 60 cultivation licenses and 86 manufacturing licenses. All licensing is done at the state level. Missouri’s cannabis regulations (19 CSR30-95.040) include an extensive and detailed security requirement that draws from similar regulations in states such as Colorado and Oregon.
The state mandates that facilities install and maintain security equipment designed to prevent unauthorized entrance into limited access areas and to prevent diversion and inversion of medical marijuana. Security cameras top this list. Video cameras must provide a recording resolution of at least 1920×1080 pixels and record a minimum of 15 frames per second. The cameras must be able to identify people and activities in monitored spaces, in all lighting levels. All video footage must be date- and time-stamped. Missouri requires camera systems allow law enforcement to remotely access cameras in real-time.
Cameras must provide views of entrances and exits, including windows and limited access areas. Cameras must view the perimeter and exterior areas of the facility, including at least 20 feet around the perimeter of outdoor grow areas. Cameras also must cover point-of-sale locations, vaults and safes, and provide views from at least two angles wherever workers cultivate, cure, trim, process, render unusable, and dispose of medical marijuana.
The state requires businesses to store video footage for at least six months in a secure on-site or off-site location, or through a service or network that provides on-demand access to the recordings. The storage system must provide recording copies upon request and at the expense of the facility.
Businesses must protect the entire video surveillance system with a failure notification system that provides an audible and visual alert of any failure in the electronic monitoring system. They also must provide enough battery backup for video cameras and recording equipment to support at least 60 minutes of recording during a power outage.
Missouri requires businesses to control entry to limited access areas with electronic card access systems, biometric identification systems or other equivalent means. In addition, businesses must equip access doors with a locking mechanism for use during power failures.
Missouri also requires access control systems to immediately and automatically notify local law enforcement agencies in an unauthorized breach. The state requires that manual, silent alarms tie to law enforcement agencies at each point-of-sale, reception area, vault and electronic monitoring station.
The state also requires a ratio of one facility agent per five visitors at dispensaries. By tying security cameras to analytic suites, the system counts people and sends an alert when the facility falls outside this ratio.
Read the full overview of Missouri’s regulations at www.securityinfowatch.com/21147363.
Pennsylvania
The Keystone State’s the most significant requirement of cannabis companies is that they keep all records – including video archives – for four years. Consider the storage implications of this mandate. Video footage from a single 2-megapixel camera operating at 10 frames per second eats up 1.87 TB of storage a year. Now multiply those storage needs times 100 video cameras operating continuously, and the amount of hard drive space needed is tremendous.
Beyond the four-year storage requirement, Pennsylvania requires licensees to install a professionally monitored security and surveillance system that operates at all times and records all activity in images capable of revealing facial detail. The state expects licensees to install a professionally monitored security alarm system that covers all facility entrances and exits; rooms with exterior windows and walls, roof hatches and skylights; storage rooms; and the perimeter.
Every licensed cannabis business needs a silent security alarm signal, known as a duress alarm, as well as a silent alarm signal, known as a holdup alarm, generated by manual activation.
The law also requires a failure notification system that alerts key individuals within five minutes of a system failure, smoke and fire alarms, and auxiliary power sufficient to keep the systems operational within 48 hours following a power outage.
Read the full overview of Pennsylvania’s regulations at www.securityinfowatch.com/21154372.