Security Plan (Cannabis Retail)
Every cannabis retailer must maintain a written security plan that protects cannabis, cash, staff, and the public. The plan must be current, followed in daily operations, and available for OCM review at any time.
Security failures are treated as compliance failures.
What This Covers
- Required elements of a written security plan
- Video surveillance standards
- Alarm system requirements
- Access control rules
- Secure cannabis storage
- Incident reporting obligations
Core Security Plan Requirements
Your written security plan must meet baseline regulatory standards.
- Be formally approved by the licensee
- Address risks including theft, diversion, loss, and emergencies
- Define staff roles, responsibilities, and reporting procedures
- Include procedures for securing:
- Cannabis
- Cash
- Sensitive and restricted areas
- Be updated when material changes occur, including:
- Staffing changes
- Store layout changes
- Equipment or system changes
The plan must reflect how the store actually operates.
Video Surveillance Requirements
Continuous video monitoring is required.
- 24/7 coverage of:
- All areas where cannabis is stored, sold, or handled
- All cash-handling areas
- Entrances, exits, and sensitive locations
- Surveillance footage must:
- Record continuously
- Be stored securely for at least 30 days
- Be accessible during inspections
- Show clear, unobstructed views
- Blind spots are not permitted
Alarm System Requirements
A functional alarm system is required.
- Alarm coverage must include:
- Store perimeter
- Cannabis storage areas
- Cash storage areas
- Product access points
- Alarms must:
- Detect intrusion, tampering, or unauthorized access
- Be monitored or self-report in real time
- Every alarm activation must generate an incident log entry, including:
- Date and time
- Staff response
- Outcome or resolution
Access Control Standards
Access to secure areas must be restricted.
- Only trained, authorized employees may enter secure areas
- Access controls may include:
- Keys
- Badges
- Codes
- Biometric systems
- Systems must:
- Log every entry and exit
- Record names, times, and purpose
- Public and employee-only areas must be clearly separated
Customers may never access storage or back-of-house areas.
Secure Cannabis Storage
Cannabis must be stored in locked, compliant areas.
- Use safes or restricted-access rooms appropriate to product value
- Limit access to licensed employees only
- Log all storage activity in the inventory tracking system
- Storage must protect against:
- Theft and diversion
- Damage or contamination
- Spoilage or environmental exposure
Incident Reporting
All security incidents must be logged immediately.
- Incidents include:
- Theft, diversion, or loss
- Break-ins or attempted break-ins
- Alarm activations
- Equipment failures affecting compliance
- Incident logs must include:
- Date and time
- Individuals involved
- Description and outcome
- Corrective action taken
- Inventory discrepancies must be updated in METRC
- OCM must be notified if reporting thresholds are exceeded
What Operators Usually Miss
- Security plans must match real operations
- Alarm activations always require documentation
- Blind spots are not allowed
- Incident logs are reviewed during inspections
When This Comes Up
- Pre-opening inspections
- Security audits
- Theft or loss events
- License renewal
- OCM compliance reviews
What Happens If You Ignore This
- Violations or fines
- License suspension or conditions
- Mandatory corrective action
- Increased inspection frequency
Related Pages
Source Material
