Member Blog: Cannabis Business Security – Going Above and Beyond

By Patrick Chown, president, Seed To Sale Security

In 2018, Sacramento CBS reported crooks stole $80,000 worth of cash and cannabis products from TotalLeaf Inc. after circumventing the facility’s alarm system and video surveillance technology. 

Christopher Cohen, owner of the Sacramento-based cannabis manufacturing and distribution company, told the news outlet his security plan passed muster with state and local authorities, but noted the company upgraded its security after being robbed. The edibles-to-oils manufacturer has added steel doors, additional security cameras, alarm systems, fences and bolted-down safes. The firm also hired a private security company to watch over the property 24 hours a day, seven days a week.

Commercial cannabis businesses, like TotalLeaf, are prime targets for burglary, robbery and internal theft. This is not surprising in a cash-based industry with a flourishing black market. Commercial cannabis business operators must maintain stringent and customized security strategies that go beyond state and local minimums to fully protect their businesses from crime.

In states where cannabis is legal, the first step toward acquiring a commercial cannabis license is meeting state standards. However, a growing number of local communities are expanding on these bare minimums and applying a wide-ranging set of additional security requirements for commercial cannabis businesses. Emerging local regulations incorporate specific design elements, lighting standards, manpower requirements, and heightened camera and alarm standards. 

Regulations vary by municipality. Regarding design elements, local entities typically require the use of door-redundant screening areas, internal/secure loading areas, and reinforced product storage rooms. A minimum exterior lighting standard of 1.5-foot candles of LED, white luminance, and prohibitions against up-lighting and light trespass are also common. Some localities even demand one or more armed, or unarmed, security guards on the premises, during business hours and sometimes around the clock. 

Gaps remain though local regulations are more stringent, says Matt Carroll, President of Carroll Consulting and Director of Compliance for Seed to Sale Security. Carroll, who develops security plans for cannabis operations, finds, “There is little value in meeting state (and local) standards just to check a box for compliance. Operators seeking to enjoy peace of mind and asset protection will approach security planning from two different perspectives: technical compliance and actual security. Existing regulations do nothing substantive to deter burglary, robbery, or to protect the safety of those working within or visiting a commercial cannabis business.”

But what does going beyond security requirements actually look like? This article investigates how cannabis operations can better harden their security by voluntarily meeting additional requirements for security cameras, access control and alarms. 

More Security Camera Coverage

State-level cannabis regulatory bodies typically demand a basic level of surveillance coverage for access points and limited access areas, which are spaces where operations process, store or transfer cannabis goods. Most local authorities expand this requirement to include security camera coverage on all sides of the building, adjacent thoroughfares, and more thoroughly throughout the interior. 

States also set a minimum resolution for security cameras. For instance, California requires a minimum resolution of 1280×720 pixels (e.g. 1 megapixel). Herein lies the problem: Any minimum megapixel standard predisposes operators to meet the minimum standard and little else. But, doing so may not achieve the goal of “certain identification” as expressed in the regulations.

Security camera megapixel ratings mean virtually nothing. For certain identification to take place, companies must also factor in the distance of the targeted viewing area from the camera placement, and the camera angle, lens quality and compression rates. 

For positive identification in idyllic lighting conditions, security cameras must meet a minimum standard of 60 pixels. For night mode, positive identification demands up to 90 pixels per foot. This is what matters: pixels per foot (PPF) at the target, not the camera resolution. IPVM, an independent research group, has developed a great video to drive these points home.

Regulatory agencies hoping to get footage of value from crimes in cannabis settings would be wise to adopt a PPF standard over an overly simplistic megapixel standard.

Better Access Control

With access control, state regulations typically require walls, doors and commercial-grade locks. They also expect operators to maintain a log of visitors and those accessing video surveillance systems. More stringent access control regulations are few and far between. 

Though reasonably priced biometric and electronic key systems are readily available, hand-written logs meet most state and local regulations. However, manual logging is unreliable. Using a manual system, coupled with PPF-ignorant video standards, puts access control on the honor system.

Responsible operators fill the gaps regulations ignore. These business owners reinforce storefronts and roll-ups with K4 or better rated bollards to deter vehicular intrusion. They install solid-core doors at all exterior access points and at internal doors leading to limited access areas. They equip doors with pry-resistant latch covers and automatic closing devices. They reinforce shared walls to prevent tunneling and they fortify product/currency storage rooms. 

They also use electronic access controllers that limit staff to areas of relevant roles and to the days and hours when employees work. They reduce opportunities for human complacency to override their access control strategies from initial design, to technology, to supporting and enforcing policies.

Improved Alarm Systems 

Short of mandating that operators install an alarm system that is operational after hours, most states establish no standards for monitored intrusion alarms at commercial cannabis businesses. This is another area where applicants can fill in the gaps. 

Some jurisdictions mandate a specific Underwriter’s Laboratory (UL) standard for intrusion detection and robbery alarms. 

Beyond meeting UL standards, it’s also important to extend the focus of an intrusion alarm system beyond exterior access points. Offenders can come in the form of stowaways concealing themselves inside until closing. They may be employees accessing areas they shouldn’t or third parties who find less expected ways to access the premises, such as tunneling through walls or ceilings and misappropriating ventilation shafts.

A properly designed alarm strategy protects against these situations by establishing various partitions, allowing for “home” and “away” modes, and setting aside areas for management-only access. Even while occupied by workers, certain areas of the premises, such as product or currency storage areas, should remain under alarm monitoring. 

Finally, a thorough alarm system abides by UL Standard 681, incorporating contact points at every door; sufficient motion detectors to detect movement in any direction, in any area of any room; glass break sensors; ventilation protection; and panic alarms at vulnerable positions, such as the entrance, loading areas, product/currency storage areas and the management office.

What more can you do?

Responsible cannabis operations also seek to elevate the safety and security of the entire industry. 

This includes lobbying at the state level for severe criminal penalties against those engaged in the black-market trade. Public acceptance of cannabis often leads prosecutions to fall flat as jurors shrug about black-market activities. Black-market operators also view the limited penalties as a cost of doing business. But, as long as the government handles black-market cannabis retailing with kid gloves, criminals will target legitimate operators for their stockpiles of Grade-A product.

It also includes lobbying at the local level for more stringent security standards. Offenders who reap the rewards time after time an area will continue to target that area. But if cannabis business owners’ partner with local authorities to tighten up safety and security standards, their businesses become an environment where the juice is not worth the squeeze for offenders, ultimately driving their crimes to regions with less formidable targets.

Finally, it includes teaming with proven security experts who work in the cannabis space; following their best practices, developed based on real-world experiences; and teaching others in the industry to do the same. 

Patrick Chown, is the Founder and President of Seed To Sale Security, a national cannabis security company offering security consulting, security plans, and security system installation to customer’s in 30 states. With cannabis-specific technology and a proficiency with regulatory compliance state by state, Seed To Sale Security makes sure your cannabis business stays safe, secure, and compliant.