Commercial Security for Cannabis Facilities
Cannabis is the most heavily regulated industry in commercial security. Every state that has legalized cannabis imposes detailed, prescriptive security requirements — specifying exactly where cameras must be placed, what resolution they must record at, how long footage must be retained, how vaults must be constructed, and who can access which areas. Failure to comply does not just result in fines — it can mean license revocation and business closure. This guide covers the security technologies, state compliance frameworks, and decision criteria that cannabis operators need to build and maintain security systems that satisfy regulators while protecting a uniquely high-value operation.
Unique Security Challenges in Cannabis
Cannabis facilities face a security burden unlike any other commercial operation. While most businesses design security systems to protect against reasonably foreseeable threats, cannabis operators must design systems that satisfy highly specific regulatory mandates written into state law. A cannabis dispensary's security system is not merely a business decision — it is a licensing requirement. The security plan is reviewed during license application, verified during pre-operational inspection, and audited during ongoing compliance checks. A camera that goes offline, a gap in video retention, or an unlogged access event can trigger regulatory action.
The cannabis industry encompasses several distinct facility types, each with its own security profile. Dispensaries (retail) are the public-facing storefront where customers purchase cannabis products — they combine the security challenges of high-value retail with cash-intensive operations and strict regulatory oversight. Cultivation facilities (grow operations) are agricultural operations that may span tens of thousands of square feet of indoor grow rooms or acres of outdoor canopy, requiring comprehensive camera coverage in challenging lighting conditions. Processing and manufacturing facilities handle extraction, infusion, and product manufacturing — often involving hazardous materials like butane or CO2 — adding safety requirements to the security mandate. Distribution and transport operations move cannabis products between licensed facilities, requiring vehicle tracking, chain-of-custody documentation, and secure transport protocols. Many operators are vertically integrated, operating all four facility types under a single license or related licenses, and need a unified security platform that spans the entire operation.
The financial dynamics of cannabis security are shaped by two forces: the high value of the product and the cash-intensive nature of the business. Cannabis products can be worth $1,000–$4,000+ per pound at wholesale, making even small facilities high-value targets. Because cannabis remains federally illegal, many operators have limited access to banking services and handle large volumes of cash — dispensaries may process $10,000–$100,000+ in cash daily. This combination of high-value product and on-site cash creates an extraordinary theft and robbery risk that demands robust physical security, cash handling protocols, and armed robbery response procedures.
Modern cloud-based security platforms are increasingly the preferred solution for cannabis operators because they address the industry's core challenges: scalable cloud storage handles the massive data volumes generated by 90-day retention mandates at high resolution; centralized management enables multi-facility operators to monitor compliance across all locations; and automatic system health monitoring ensures cameras and access points remain operational — critical when a system failure can trigger regulatory non-compliance. Integration with seed-to-sale tracking platforms creates a unified compliance record that correlates physical security events with inventory movement, dramatically simplifying the audit process that every cannabis operator faces on an ongoing basis.
Security Technologies That Matter Most for Cannabis
Cannabis security is compliance-driven: every technology decision must satisfy state regulatory requirements first and business needs second. These are the core solution categories that cannabis operators must evaluate.
High-Retention Cloud Video Surveillance
IP cameras with cloud storage capable of retaining 90+ days of continuous, high-resolution footage across every room, entry point, and transaction area. Cloud platforms eliminate on-site server failure risk and provide the remote access regulators may require during investigations. AI analytics for motion detection, person tracking, and anomaly detection add proactive monitoring to compliance-driven recording. Camera selection must account for grow room lighting conditions.
Comprehensive Access Control
Cloud-managed access control for every limited-access area — cultivation rooms, processing areas, vault, cash handling rooms, and inventory storage. Every access event is logged with employee identification, timestamp, and duration. Badge and credential management tracks which employees are authorized for which zones. Integration with seed-to-sale tracking correlates access events with inventory movement for compliance audits.
Intrusion Detection & Central Station Monitoring
Commercial-grade intrusion detection with door/window contacts, motion sensors, glass-break detectors, and vault-specific sensors — all monitored 24/7 by a UL-listed central station. Most state regulations mandate central station monitoring as a licensing requirement. Alarm verification using video verification reduces false alarm dispatches while ensuring rapid response to genuine intrusions. Documented alarm response protocols are required for compliance.
Vault & Safe Room Systems
UL-rated vault doors with Group 1/1R locks, reinforced construction meeting state specifications, and dedicated alarm sensors on door, walls, and ceiling. Time-delay locks provide forced-entry deterrence. Interior cameras provide continuous vault monitoring. Integration with access control creates complete chain-of-custody documentation for all vault access events. Dual-authorization requirements enforced through the access control system when mandated by state regulations.
Video Analytics for Compliance Monitoring
AI-powered analytics that detect security events and potential compliance violations: unauthorized individuals in limited-access areas, doors propped open, cameras obscured or offline, and unusual activity patterns outside business hours. Automated system health monitoring alerts operators when cameras go offline or storage thresholds are approached — preventing the compliance gaps that occur when equipment fails silently.
Badge & Visitor Management
Employee credentialing systems that track state-issued cannabis worker badges, manage access authorizations by zone, and log all employee movements throughout the facility. Visitor management platforms register authorized visitors (inspectors, contractors, vendors) with check-in/check-out timestamps, escort assignments, and limited-area access restrictions. Visitor logs are a standard item during regulatory inspections.
Regulatory Framework for Cannabis Security
Cannabis security compliance is primarily governed by state-level regulations that vary significantly between jurisdictions. Unlike most industries where security decisions are primarily business decisions, cannabis security requirements are codified in law and enforced through the licensing process. Non-compliance can result in fines, license suspension, or permanent revocation.
State Cannabis Regulatory Authorities
Each state that has legalized cannabis establishes a regulatory authority — such as the Colorado Marijuana Enforcement Division (MED), the California Department of Cannabis Control (DCC), or the Illinois Department of Financial and Professional Regulation (IDFPR) — that writes and enforces security rules. These regulations are detailed and prescriptive, specifying camera quantities, placement locations, resolution minimums, retention periods, access control requirements, vault specifications, alarm monitoring mandates, and record-keeping obligations. Operators must study their state's specific regulations thoroughly before designing a security system. Regulations are updated frequently as agencies refine their rules, and operators must maintain ongoing awareness of changes that could affect their compliance status.
Video Surveillance Mandates
Video surveillance requirements are the most detailed and technically demanding component of cannabis security regulations. Common state mandates include: continuous 24/7 recording (not motion-activated) at minimum 1080p resolution with 15–20+ fps frame rates; camera placement at every point of sale, every entry/exit, every room containing cannabis, every vault approach, and the exterior perimeter; retention periods ranging from 30 to 90+ days with footage available to regulators upon request within a specified timeframe (often 24 hours); recording systems with backup power (UPS) capable of maintaining recording during power outages; and tamper-proof storage that prevents footage deletion or alteration. These requirements drive enormous storage demands that traditional on-premise DVR/NVR systems struggle to handle — a primary driver of cloud video adoption in the cannabis industry.
Access Control and Limited-Access Area Requirements
State regulations define "limited-access areas" as any space where cannabis is cultivated, processed, stored, or sold. Access to these areas must be restricted to employees who hold valid state-issued cannabis worker permits or badges, and to authorized visitors who are logged and escorted. Electronic access control with individual credentials for each employee is required or strongly recommended by most states — shared keys or codes do not provide the individual-level audit trail that regulators expect. Access logs must be retained for a specified period (often matching the video retention requirement) and made available to regulators on request. Some states require that limited-access areas be identified with specific signage visible to security cameras.
METRC and BioTrack Integration Requirements
Most states mandate the use of a specific seed-to-sale tracking platform — METRC is the most widely used, with BioTrack and other platforms used in some states. While the seed-to-sale system is not technically a security system, state regulators increasingly expect integration between physical security (video and access control) and seed-to-sale records. When an inventory discrepancy appears in METRC, regulators want to review video footage and access logs from the exact time and location of the discrepancy. Security systems that integrate with seed-to-sale platforms — allowing event-correlated video search, for example — significantly streamline this audit process.
Alarm System and Monitoring Requirements
Virtually all state cannabis regulations require commercial-grade intrusion detection systems monitored 24/7 by a UL-listed central station. Specific requirements typically include: sensors on all perimeter doors, windows, and accessible openings; motion sensors in all interior areas containing cannabis; vault-specific sensors including door contacts and vibration/seismic sensors; panic/duress buttons at point-of-sale stations and cash handling areas; immediate notification to local law enforcement upon confirmed alarm activation; and documented alarm response procedures including staff notification protocols and law enforcement contact information. Some states require that the alarm monitoring company hold a specific state license and that monitoring agreements be submitted to the regulatory authority.
What Cannabis Operators Should Look For
Selecting a security platform for a cannabis operation is a compliance exercise first and a business decision second. The wrong platform choice does not just create security risk — it creates licensing risk. The following framework helps operators evaluate technology through the lens of regulatory compliance.
Evaluation Checklist
- State regulation compliance: Has the vendor demonstrated successful deployments in your state that passed regulatory inspection? Can they document compliance with your state's specific camera, retention, access control, and alarm requirements?
- Retention capacity: Can the cloud platform handle 90+ days of continuous, high-resolution video from your camera count without performance degradation? What is the per-camera monthly cost for this storage volume?
- Regulator access: Can you provide state regulators with remote or on-site access to live and recorded video within the timeframe your state requires (often 24 hours)?
- Seed-to-sale integration: Does the platform integrate with METRC, BioTrack, or your state's mandated tracking system? Can you search video by seed-to-sale event?
- System health monitoring: Does the platform automatically alert you when cameras go offline, storage thresholds are approached, or access control devices lose connectivity? System failures that go undetected create compliance gaps.
- Grow room camera capability: Do the recommended cameras handle the spectrum and intensity of grow lights (HPS, LED, CMH) without image degradation? Standard cameras often fail in grow room environments.
- Multi-facility management: For operators with multiple licenses or vertically integrated operations, does the platform support centralized management across all facilities?
- UL-listed monitoring: Is the alarm monitoring provided by a UL-listed central station as required by most state regulations? Is the monitoring company licensed in your state?
- Documentation and reporting: Does the platform generate compliance reports suitable for regulatory inspections — access logs, video retention verification, alarm event histories, and system health records?
- Scalability for expansion: If you plan to add facilities or expand into new states, can the platform scale across locations with different state requirements?
Questions to Ask Vendors
- How many cannabis facilities have you deployed in our state, and have they all passed regulatory inspection?
- What is the total monthly cost for cloud storage to retain 90 days of footage at our camera count and required resolution?
- How does your platform integrate with METRC/BioTrack for event-correlated video search?
- What cameras do you recommend for grow rooms, and how do they handle HPS and LED lighting spectrums?
- What happens if a camera goes offline — how quickly are we notified, and is the gap documented for compliance?
- Can state regulators access our video system remotely if required during an investigation?
- What vault door and alarm sensor packages do you offer that meet our state's specifications?
- Can you provide references from cannabis operators in our state with similar facility types?
What Cannabis Security Buyers Get Wrong
Cannabis security mistakes carry higher stakes than in any other industry because they directly threaten the operator's license. These are the most common — and most costly — errors.
Operators who design security systems to barely meet the minimum regulatory requirements leave no margin for error. When a camera fails (and cameras do fail), the facility immediately drops below compliance. When an access control reader loses connectivity, the compliance gap begins accumulating. Systems should be designed with redundancy — overlapping camera coverage, backup recording paths, and system health monitoring — so that a single point of failure does not create a compliance violation.
The storage demands of cannabis video compliance are extraordinary. A facility with 40 cameras recording at 1080p, 20 fps, 24/7 for 90 days generates roughly 100–200 TB of video data. Operators who budget based on standard commercial video storage costs (30-day retention, motion-only recording) face sticker shock when they calculate actual cannabis compliance storage costs. Get exact storage cost quotes from cloud providers based on your specific camera count, resolution, frame rate, and retention requirements before committing to a platform.
Standard IP cameras are designed for typical commercial lighting conditions. Grow rooms use high-intensity discharge (HID), high-pressure sodium (HPS), or LED lighting that emits spectrum ranges that confuse standard camera sensors — resulting in purple-tinted, washed-out, or unusable footage. Cameras deployed in grow rooms must be specifically rated for horticultural lighting environments, with adjustable white balance, wide dynamic range (WDR), and infrared capability for dark-period recording. This is a common audit finding that forces expensive camera replacements.
Cannabis security has significant recurring costs: cloud video storage subscriptions, alarm monitoring fees, access control software licensing, camera maintenance, and system upgrades as regulations evolve. Operators who budget only for initial hardware and installation are unprepared for monthly costs that can run $3,000–$15,000+ depending on facility size and camera count. These recurring costs should be included in the business plan from the license application stage.
A camera that fails silently on a Tuesday and is not discovered until Friday's walk-through creates a 3-day compliance gap that may be impossible to explain to regulators. Access control readers that lose connectivity, alarm sensors with low batteries, and network switches that drop packets all create compliance exposure when they go undetected. Cloud platforms with automated system health monitoring — real-time alerts for offline devices, storage warnings, and connectivity issues — are essential for maintaining continuous compliance.
What's Changing in Cannabis Security
Cannabis security technology is evolving rapidly as the industry matures and regulatory frameworks become more sophisticated. These trends are shaping the next generation of cannabis security platforms.
Purpose-built cloud platforms designed specifically for cannabis compliance are emerging, combining video surveillance, access control, alarm monitoring, and seed-to-sale integration into unified dashboards with built-in compliance reporting. These platforms understand cannabis-specific requirements like retention mandates, camera placement rules, and regulatory access protocols — reducing the configuration burden on operators and integrators.
Video analytics are evolving from basic motion detection to compliance-aware monitoring. AI systems can now detect potential compliance violations in real time: an unauthorized badge accessing a limited area, a camera with degraded image quality, a door propped open in a limited-access zone, or inventory movement that does not match seed-to-sale records. This proactive monitoring shifts operators from reactive compliance (discovering violations during audits) to continuous compliance assurance.
As cannabis banking access expands through initiatives like the SAFE Banking Act and state-level programs, the security landscape is shifting from cash-dominated to increasingly electronic. This reduces but does not eliminate cash handling security requirements and creates new PCI-like compliance obligations for electronic payment processing areas. Security systems must evolve to address both cash and electronic transaction security.
As multi-state operators expand across jurisdictions, they need security platforms that support different state requirements from a centralized management layer. Cloud platforms that allow operators to configure state-specific retention policies, camera placement compliance profiles, and regulatory access protocols per location — while maintaining corporate-level visibility — are becoming essential for MSO operations.
Security platforms are converging with environmental monitoring to create unified facility management dashboards. Temperature, humidity, CO2, and light-cycle sensors that protect crop value are being integrated alongside security cameras and access control, giving operators a single platform for both compliance and cultivation operations. This convergence reduces operational complexity and creates data correlations that benefit both security and agricultural operations.
Frequently Asked Questions
Expert answers to common questions about cannabis facility security and compliance.
What are the cannabis security compliance requirements by state?
Cannabis security requirements vary significantly by state because cannabis remains federally illegal and each state creates its own regulatory framework. Most state programs share common mandates: continuous video surveillance of all areas where cannabis is cultivated, processed, stored, or sold; access control restricting entry to limited-access areas; intrusion detection with 24/7 central station monitoring; and vault storage for inventory during non-business hours. Key differences include video retention periods (30 to 90+ days), camera resolution requirements, specific placement mandates, and vault specifications. States like Colorado, California, Michigan, Illinois, and Massachusetts have among the most detailed security regulations. Operators expanding to new states must conduct thorough reviews of each state's requirements, as configurations that pass in one state may fail in another.
What are the video retention requirements for cannabis dispensaries?
Video retention requirements for cannabis dispensaries are among the most demanding in any industry. Colorado requires 40 days minimum. California mandates 90 days. Illinois requires 90 days. Massachusetts requires 90 days with two years for point-of-sale footage. These retention periods apply to all cameras throughout the facility, and footage must be immediately available to regulators upon request. A 20-camera dispensary at 90-day retention generates 50–100+ TB of data. Cloud-based platforms are increasingly preferred because they scale storage automatically and eliminate on-site server failure risk. Operators must verify their cloud provider can meet their state's specific resolution, frame rate, and retention requirements.
What camera resolution and placement mandates apply to cannabis facilities?
Most states specify minimum 1080p resolution, with some requiring higher resolution at point-of-sale and entry/exit areas. Placement mandates typically require coverage of every POS terminal, all entry/exit points, all areas where cannabis is present, all storage and vault areas, loading docks, limited-access area entries, parking lots, and exterior perimeter. Many states require overlapping fields of view to eliminate blind spots. Entry cameras must capture clear facial images. Cameras must operate in all lighting conditions, including IR-capable cameras for nighttime. Recording must be continuous 24/7 at minimum 15–20 fps. Grow rooms require cameras rated for horticultural lighting environments.
How do you secure a cultivation or grow facility?
Cultivation security starts with perimeter enclosure and controlled entry. Interior access control should create zones — propagation, vegetative, flowering, drying, trimming, packaging — restricting employees to authorized areas and supporting seed-to-sale tracking. Video must cover every room with cannabis and all entry/exit points. Grow room cameras must handle challenging grow light spectrums — standard cameras often produce unusable footage under HPS or LED lighting. Environmental monitoring for temperature, humidity, and CO2 integrates with the security platform. Intrusion detection with 24/7 monitoring is universally required. The unique challenge is scale: large grow facilities may need 100+ cameras to eliminate blind spots across extensive floor plans.
What are the best practices for dispensary security?
Dispensary best practices include a controlled entry vestibule for customer ID verification before sales floor access; comprehensive camera coverage of every POS terminal, display case, and customer area at resolution sufficient for facial identification; locked product displays with staff-assisted retrieval; vault-grade overnight storage for inventory and cash; time-delay safes and dedicated cash counting rooms with camera coverage; panic buttons at every POS terminal connected to central station monitoring; well-lit parking with camera coverage; and bollards or barriers to prevent vehicle-based attacks. All security events should be logged for regulatory inspection readiness.
How much does a compliant cannabis security system cost?
Cannabis security costs are among the highest in commercial security. A small dispensary (1,500–3,000 sq ft) typically invests $50,000–$150,000 for a compliant system with 15–30 cameras, access control, intrusion detection, vault, and visitor management. Mid-size cultivation or processing facilities (5,000–20,000 sq ft) range from $100,000–$400,000. Large vertically integrated operations can exceed $250,000–$1,000,000+. Monthly costs are significant: cloud storage for 90-day retention runs $50–$200+ per camera; monitoring costs $200–$1,000+. Operators should budget 3–8% of total buildout costs for security and plan these costs during the license application phase.
What are the vault and safe room requirements for cannabis?
Most states require vaults with reinforced construction (concrete, steel, or equivalent), UL-listed vault doors with TL-15 or TL-30 burglary ratings and Group 1/1R locks, no windows or alternative entry points, continuous interior video surveillance, intrusion sensors on door/walls/ceiling, and access control restricted to authorized individuals. Some states require dual-authorization. Time-delay locks are increasingly recommended or required. Vaults must accommodate both product and cash. State regulators inspect vault construction during licensing and compliance audits. Environmental monitoring may be required for product integrity.
How does seed-to-sale tracking integrate with security systems?
Seed-to-sale platforms like METRC and BioTrack track every cannabis plant and product from cultivation through sale. Integration with security correlates physical events with inventory movement. Access control integration logs employee entry to rooms where inventory is present, enabling investigators to identify who accessed areas where discrepancies occurred. Video integration allows searching footage by seed-to-sale events — finding the exact video of a specific inventory transaction. POS integration correlates each sale with video footage. Some platforms offer direct API connectors that auto-bookmark video at seed-to-sale events. This integration dramatically simplifies regulatory audits.
Ready to Evaluate Cannabis Security Solutions?
Tell us about your facility and compliance needs. We'll help point you in the right direction.
Explore a Solution