How to Write a Cannabis Security Plan that Gets Approved 100% of the Time
Cannabis businesses deal in high-value products and cash-heavy transactions. It makes these operations attractive targets for diversion and theft.
Recognizing that legal cannabis operations still attract the criminal element, legislators have established a complex set of rules and regulations for growing, distributing and selling cannabis. If a would-be cannabis operation does not meet these standards to the letter, the government denies the licensing request.
Investors must navigate the requirements for licensure to capitalize on the opportunities cannabis presents. They have one chance to get it right; state regulatory agencies are not very forgiving with incomplete or illegible cannabis applications.
Before growing the first plant, producing the first product, or making the first sale, every cannabis operation requires a state-approved license. Many municipalities require a local permit too.
We designed the following guide to help you write a winning cannabis security plan that gets approved the first time.
What is a Cannabis Security Plan?
A cannabis security plan is a living document that includes a security management plan, security operations plan and a security technology plan. Ideally, it is a strategy created by a third-party security professional with a keen understanding of the cannabis space, local and state regulations, and best practices.
The plan also embodies the culture and goals of the business operator.
Further, a properly designed security plan addresses the following key concerns: robbery, burglary, internal theft, off-site operations, life safety, and nuisance abatement. The plan does so through a comprehensive strategy rooted in crime prevention through environmental design (CPTED), operational security, target hardening, technology, training, compliance, auditing and testing, and supporting policies and procedures.
Plans may differ by operation, be it grower, manufacturer or dispenser. But overall, Matt Carroll, who as Compliance Director of Seed To Sale Security has developed over 400 cannabis security plans, says the plans are largely the same. He explains, “While each licensed activity has specific risk factors, there should be little variance in security planning.”
The goal is to prevent crime and keep people and profits safe. The mechanisms that reach these goals are the same across all cannabis operations.
Who Regulates Cannabis Businesses?
Know the regulatory bodies in your local municipality before putting pen to paper. This is different for every state.
The State of California operates three governing bodies for cannabis. Each oversees a different area.
- California Department of Food and Agriculture (CDFA) oversees cultivators. It does not require cultivators to submit a security plan with their application.
- California Department of Public Health (CDPH) Manufactured Cannabis Safety Branch has set security requirements for cannabis manufacturers. The CDPH outlines its requirements in the California Code of Regulations, starting with §40200 Security (page 44).
- Bureau of Cannabis Control (BCC) regulates commercial cannabis licenses for medical and adult-use cannabis. The BCC issues licenses to retailers, distributors, testing labs, micro-businesses and temporary cannabis events.
Both the CDPH and the BCC require a written security plan that addresses how the applicant will prevent unauthorized access, protect the safety of employees, guard against theft, secure records, and use video surveillance, alarms and access control technologies.
Oregon, meanwhile, offers seven types of recreational marijuana licenses or certificates: Producer, Processor, Wholesaler, Retail, Laboratory, a Certificate for Research, and a Hemp Certificate.
- Oregon Environmental Laboratory Accreditation program (ORELAP) issues and accredits operations for laboratory licenses.
- The Oregon Department of Agriculture (ODA) registers operations to transfer hemp and products to Oregon Liquor Control Commission (OLCC) licensed processors.
- The Hemp Certificate allows persons that are registered with the Oregon Department of Agriculture (ODA) to transfer hemp and products made from hemp to OLCC-licensed processors who hold an industrial hemp processor endorsement, as well as to OLCC licensed wholesalers, and retailers.
- The OLCC accepts license applications for recreational marijuana but will not be processing new producer applications as part of Senate Bill 218.
The Washington State Liquor and Cannabis board accepts license applications for the production, processing or retailing of marijuana.
What are the Security Requirements to get a Cannabis Business License?
Though the requirements differ by state, in most cases state licensure application includes a section that describes the work the company will perform. It also offers a complete and detailed diagram of the proposed premises. This diagram shows boundaries, dimensions, entrances and exits, interior partitions, walls, rooms, windows and doorways, and includes information on security camera placement and access control systems.
Applying for a license, whether cultivating, manufacturing or distributing, requires operators to develop an SOP (standard operating procedure). But this document isn’t just important for getting a license, it’s also essential for protecting a cannabis operators’ assets.
The SOP must include information on the alarms, access control systems, surveillance cameras, lighting and perimeter security being put in place. It should share your recordkeeping processes, employee background screening process and employee identification procedures, and ingress and egress security procedures. And, it should include how you will control access to specific areas and who will be allowed within them.
How to Write a Cannabis Security Plan that Gets Approved in 5 Steps
Learn how to create a cannabis security plan that gets approved 100% of the time by following these steps:
- Know the Law.
- Outline and Write Your Cannabis Security Plan.
- Security Floorplans and Policy Considerations.
- Avoid Common Mistakes.
- Go Above and Beyond.
Step 1: Know the Law
The law also differs in most municipalities. Do your homework before you put words to paper. Review local permitting standards after first checking state licensing requirements. These rules may change and increase what the state requires.
Carroll explains, “Cannabis businesses are susceptible to crime given the cash aspect attract to robbers and the easy access to black market retailing of ill-gotten gains through robbery and burglary. Both robbery and burglary are Part One crimes that police agencies must report to the FBI for crime reporting. Municipalities take an interest in preventing Part One crimes because they impact property values and a community’s ability to attract (and keep) residents and businesses.”
Those same municipalities also see the positive impact of allowing cannabis, according to Carroll. Cannabis businesses bring high tax contributions and employment opportunities to the community.
By developing cannabis security plans for local licensing, communities balance the risks and rewards of allowing cannabis businesses to move in.
“A comprehensive security plan shows to a municipality that an applicant knows the threats and the legitimate concerns of the municipality and is willing and able to be a productive partner in mitigating the risks while enhancing the rewards. A poor security plan shows quite the opposite to the municipality,” Carroll says.
Most municipalities post local licensing regulations on their websites or, at the very least, provide a link to city or county ordinances for cannabis operations. Potential investors also can call the local police department or sheriff’s office to learn more.
“If a local municipality permits commercial cannabis, you can bet your bottom dollar that local law enforcement is involved and expects you to meet certain standards,” Carroll says.
These rules differ from city to city and town to town, adds Tim Sutton, a senior security consultant with Guidepost Solutions. The cannabis community knows Sutton for his work landing cannabis licenses for Revolution Enterprises’ former CEO, Tim McGraw.
Sutton says, “Too often people cut and paste something from another company’s license application, which is not good and not recommended. You must educate yourself on the rules in the area where you plan to work.”
He recently completed an application for a client seeking a medical cannabis license in Missouri. Here, the state requires storing security video for 30 days, but local ordinances in St. Louis require 90 days. Had he not checked the rules in advance, his client would have specified 30 days of storage, which the state would approve but the municipality would deny.
“It is paramount that applicants establish an open, honest dialogue with their municipality and its police/sheriff’s office,” he says.
Many municipalities offer application assistance. The Sacramento and Oakland police departments, for example, hosts cannabis business training sessions several times a year. Law enforcement officials in charge of cannabis regulation provide the training. The education spells out what the city expects in security plans, offers examples of security plans, and provides free CPTED training and site walks for operators.
Step 2: Outline and Write Your Cannabis Security Plan
There are three main parts to a security plan: An introduction, facility security description and plan, and operations security description and plan. You must describe each section in great detail, outlining the problem and your security solution.
Introduction. In the introduction, define your aim and clarify that the document will outline a comprehensive security plan to meet application requirements. It should include the names of any vendors or consultants helping you and the role they play. It should also summarize the proposed operation and how you plan to structure it.
Physical Security. Describe the property and the neighborhood. Include a site plan and floorplan that shows security features and where they are located. Describe the lighting; the perimeter security, including the specs of fences, gates, doors, walls, etc.; and provide details on how employees will access the facility, listing things like parking, personnel entrance/exits and access control systems.
Detail how customers will access the facility. Where will they park? How will you screen them? What credentials will they have to show?
Finally, explain how you will monitor and control movement throughout the facility. This includes describing video surveillance equipment, its location and its function; providing vendor information if there will be third-party monitoring; information on intrusion and motion detection capabilities; a description of the burglary alarm system, its features, testing and maintenance; and how you will secure the building in a fire.
This section should also explain how you will handle incidents, breaches or other emergencies. Be very thorough in describing how you will manage various events.
Operations Security. This section encompasses workforce security, inventory security and data security. Here, you must describe how you will hire and train staff, keep and maintain personnel records, perform background checks, etc. Outline your procedures for keeping cash, company records and products secure.
List how you plan to track and control inventory. Give a detailed description of storage procedures, equipment specs, and security for storage areas. Outline transportation procedures and how you will accept deliveries. And, describe how you will keep meticulous records.
Finally, share how you plan to keep data and information systems secure. Show that you will have virus protection, data backups and encrypted servers, and highlight where and how you will store video surveillance footage.
A well-written cannabis security plan develops strategies that protect lives and property in an environment ripe for crime. The plan also protects an operator’s business interests. Finally, these plans ensure the business complies with local and state regulations.
Step 3: Security Floorplans and Policy Considerations
Every application needs a security floorplan. This document includes more than a drawing depicting security cameras, alarms and electronic access control systems. It also includes information on elevations, riser diagrams and schedules, cut sheets, system capabilities and specifications and how often you plan to maintain these systems.
Sutton reports he’s seen many installations rely on a single indoor/outdoor camera. Others, he says, put a single 360-degree camera in the middle of a room and consider that sufficient. He’s seen operators use consumer-grade locks for access control. He’s encountered policies that let any employee in anywhere and give remote access to workers outside the security department.
Sometimes plans are approved, even with these errors. Sutton says once actual operations begin, later inspections identify problems. A state examination might reveal the views from the 360-degree cameras do not cover the room. Or, the inspection may find employees are sharing keys and key fobs.
“Your floorplan might show a dot here and a dot there, where you plan to install a camera and the area it will cover,” Sutton says. “But the camera prevents nothing. All it does is record activity in its scope of view. You need to combine your technology plan with a strong security management plan and security operations plan to have a total security solution.”
Step 4: Avoid Common Mistakes
There are common mistakes that get applications thrown out. If that happens, you may not get a chance to reapply. By following these key steps you can avoid many issues.
- Be honest. Know what you are talking about or don’t put it in your application, Carroll says. “In my years reviewing plans as a contractor on the other side of the table (working for police departments), I saw security plans that made promises that ranged from the ridiculous to misinformed and illegal,” he says.
- Read the state and local requirements. Ask questions if you have them.
- Hire a consultant to guide the application process. “A consultant can be worth their weight in gold but do your homework,” states Carroll. “Just because someone is a cop, served in the military or was a security guard does not qualify them to consult on your project. Check references and make sure they align with approved projects in the past.”
- Be thorough in each section and include a realistic budget. “I have seen security plans that have a $50,000 security budget for years one, two and three. Let’s assume that budget is just for people. How many people are you going to have for $50,000 a year?” Sutton asks. He adds, “As a rule of thumb you should budget for $100,000.”
- Submit proper premise diagrams. Applicants often rely on architects to design their security component placements. “This is problematic,” Carroll says. “State regulations are very clear regarding what you must identify on a premise diagram, yet these requirements are rarely met.” The diagrams must show DVR locations, cameras within 20 feet of doors at inbound and outbound loading areas, product storage, cannabis waste areas, chemical and fertilizer storage areas, secure records areas and more.
- Look at the complete picture. Too often, Carroll finds plans focus on exterior threats but pay little attention to internal threats. “I frequently see no commitment to routine staff screening, nor sufficient strategies for staff training,” he says.
- Install the best technology. Carroll reports applicants often select the lowest bidder for technology design and installation. To that, he says, “You get what you pay for.”
Step 5: Go Above and Beyond
Want to hit it out of the park with your cannabis application? Go above and beyond what is required.
Checking off state and local requirements is not enough, warns Sutton. This might get your application approved but it may not secure your facility. “To get your application approved, check every box they tell you to check, but if that’s all you’re doing, it’s not enough,” he says. “You need to add boxes and expand upon the boxes to develop a plan that goes beyond compliance.”
California law requires that surveillance cameras have a minimum camera resolution of 1280 x 720 pixels, 720p resolution and a minimum of 15 frames per second. That is required, but what you need is slightly different. Carroll explains, a 1-megapixel camera meets state standards but when mounted within 20 feet of the doors it means “absolutely nothing in terms of video quality.”
He adds, “You need to be more concerned with pixels per foot at the focus point of the camera. The camera may be positioned to view a door in the viewing frame, but the viewing angle is much wider and much broader. That 1-megapixel rating will be spread across the entire side of the building.”
If cannabis operator is interested in having high quality video footage of people and property entering and leaving a facility, Carroll advocates for 8 megapixels per foot at the point of focus. “This provides enough detail to identify a person,” he says.
For Those That Don't Want to DIY
There are many licensed consultants qualified to write a plan for you. This gives operations the benefit of working alongside a professional who specializes in writing cannabis licensing applications. They will learn the ins and outs of your operation to prepare a document that gets approved.
It also can prevent problems down the road.
“Even if you check all the boxes and get approved, it doesn’t mean you will stay approved,” Sutton says. “The state can revoke your license if it identifies problems during recurring inspections. But if you develop a reasonable plan and then follow that plan, you will keep your license. And, you will protect your people and your assets. These plans are for the safety and security of everyone involved with your facility and your operation. But they also are in place to protect the entire industry.