How to Create a Cannabis Dispensary Security Plan in Massachusetts

Posted on 4/14/2022

In the five years since Massachusetts residents voted to legalize recreational cannabis in the state, marijuana sales have surpassed the $2 billion mark—generating millions in tax revenue, creating new jobs, and attracting young entrepreneurs. Now that the benefits are apparent, new vendors and cultivators are jostling for dispensary licenses and real estate.

Something new retailers might not expect, however, are stringent security requirements in place for dispensaries. In Massachusetts, a cannabis security systems plan is a required part of the licensure application, must be updated annually as part of the license renewal process, and must be included in your dispensary’s written operating procedures. Dispensaries can only open their doors after putting “sufficient security measures” in place to prevent theft, unauthorized access, and risks to employees, customers, and the general public (935 CMR 500.110, Security Requirements for Marijuana Establishments).

So what security system technologies would be considered “sufficient” under Massachusetts law? Let’s take a closer look at the requirements.

Alarm Systems

Massachusetts law states that cannabis dispensaries must use an alarm system with “commercial grade equipment” (935 CMR 500.110(5)(a)), establishing that this is not a DIY task for business owners. At minimum, the alarm system must include three components:

1. A perimeter alarm on all building entry and exit points and perimeter windows. This system will transmit an audible alarm if someone breaks a window or tries to force a door open.
2. A duress, panic, or holdup alarm that is connected to local law enforcement. Triggered in the event of a robbery or other emergency, this could be a silent or audible alarm.
3. A failure notification system that provides notification of any failure in the security system.

While perimeter alarms and failure notifications don’t necessarily need to alert law enforcement, any activation of an alarm must be reported to them within 24 hours.

The law approaches dispensary alarm systems with an abundance of caution for having complete, continuous coverage. It specifies that your alarm system must remain operational during a power outage for at least four hours, so a battery backup is a must. Any alarm system that goes down, whether due to a loss of power or malfunction, for more than eight hours must be reported to law enforcement as soon as possible (within 24 hours of discovery).

Moreover, dispensaries must also have “a back-up alarm system, with all the capabilities of the primary system, provided by a company supplying commercial grade equipment, which may not be the same company supplying the primary security system” (935 CMR 500.110(5)(c)). This means that you will need to contract with two separate security vendors to ensure adequate compliance with the law.

Security Cameras

Cannabis dispensaries are required to use video surveillance to deter theft and help identify criminals. Cameras must monitor all areas where marijuana is stored, areas where there is a safe or vault for cash, all entry and exit points, and the parking lot.

Your security cameras must be in use 24 hours a day, although they don’t need to start recording until prompted by motion detection sensors. Captured video must be in color, date and time stamped, and clear—so you may need to add more lighting to facilitate this. All footage must be kept for at least 90 days.

Preventing Unauthorized Access

Massachusetts law requires that unauthorized access must be prevented to the entire dispensary, and that “limited access areas” be established for a minimal number of authorized employees. Any areas where marijuana and cash are stored must be securely locked, with access to keys limited to select personnel. For these purposes, traditional locks and keys are adequate—access control systems are not mandated. However, this technology can streamline dispensary operations, so you may want to incorporate it into your security system.

Regular Testing & Auditing

After establishing relationships with security vendors, investing in monitoring technology, and developing security protocols, your job is still not done. Massachusetts law requires that dispensaries’ security equipment be inspected and tested at least every 30 days.

A larger security system audit must also be performed annually (and at your own expense) by an approved vendor. The report from this audit is to be submitted to the state’s Cannabis Control Commission, along with plans to mitigate any issues that are found during the audit.