Physical security measures for cannabis licences: Standard cultivation, standard processing, sale for medical purposes with possession of cannabis

Physical security measures for standard cultivation, standard processing and sale for medical purposes with possession of cannabis licences.

Head of security

The head of security is responsible for the compliance to the physical security requirements of your licence. They're also responsible for the organizational security plan.

Measures by area

You must implement your physical security measures in a way that they work together to secure the site and prevent unauthorized access. This applies to all areas within the defined site perimeter.

Physical security requirements

Site
- Designed to prevent unauthorized access
Site perimeter
- Visual monitoring
Storage and operations areas
- Surrounded by a physical barrier
- Access restricted to those who are required to be present
- Visual monitoring
- Intrusion detection

Site

You need to design your site in a way that prevents unauthorized access.

Restricted access measures control who has access to your site. Only specific people are meant to have access to your site.

Principles and practices for site design

Principles and practices for restricted access

Site perimeter

The site perimeter is the first hurdle that will delay or stop unauthorized access. Your site perimeter will give an added sense of security to discourage unauthorized intruders. The site perimeter needs to include all areas of the site. Your perimeter must meet the requirements in section 64 the Regulations:

visual monitoring system and recording devices

Visual monitoring system and recording devices

Visual recording devices must monitor the site perimeter to detect any attempted or actual unauthorized access to the site.

Cameras at the site perimeter are capable of recording the presence of a person at all times.
System covers the entire perimeter, and there are no blind spots due to lapses in coverage.
The area near the perimeter doesn't have any objects that may obstruct camera views of the perimeter.

It can be difficult to get full visual coverage of a site perimeter in certain scenarios. Here are some principles and practices for specific scenarios.

Shared wall with another business

If your site perimeter is a shared wall and can't be monitored from the outside, the cameras must monitor from the inside of the building. The visual coverage of that wall is necessary regardless of the requirements for the area it's in.

If the shared wall is on multiple storeys, the cameras must monitor from the inside of all storeys of your defined perimeter.

Building with multiple storeys

If you have multiple storeys, and the site perimeter is the building envelope, cameras must monitor the storeys with access points (even if locked). This may include the rooftop. For example, if there are exterior stairs to the second storey, cameras need to monitor both storeys. If there are no access points on the second storey, the cameras only need to monitor the first storey.

Principles and practices for visual monitoring systems and recording devices

Storage and operations areas

Physical barrier

Physical barriers need to entirely surround each storage and operations area (including outdoor grow areas).

Outdoor grow areas

A physical barrier must surround outdoor grow areas. A common physical barrier for outdoor grow areas is a chain-link fence. If used, the fence should be taut and firmly secured to rigid posts. You could use your site perimeter as all or part of the physical barrier for an outdoor grow area. Refer to Figure 3 for an example of a site with an outdoor grow area.

Principles and practices for physical barriers

Restricted access

Only specific people should have access to storage or operations areas as required by their job duties.

Access control devices are placed on the doors immediately leading into the storage or operations area. If you use a vestibule, air lock or mantrap, the access control device is located at the access point of the storage or operations area.

A door between 2 operation areas with the same level of restricted access may not need an access control device.

They also may not be necessary for doors to a non-operations area if it has no other access points. For example, the door between an operations area and a walk-in closet wouldn't require restricted access.

Principles and practices for restricted access

Visual monitoring system and recording devices

Your visual monitoring system needs to capture all of your operations and storage areas without any blind spots. The system must monitor each:

storage area at all times
operations area when cannabis is present and when activities with cannabis are occurring

You can use 1 camera for multiple areas as long as long as you meet the requirements. Grow areas have different requirements.

Grow areas

Visual recording devices only need to cover the entries and exits of a grow area when in use.
There's at least 1 device that monitors each access point (for example, a door or gate), either from inside or outside the area.
A camera could monitor more than 1 grow areas if it clearly captures each access point.
Visual monitoring isn't required when grow areas aren't in use, and there's no cannabis present. If your cameras are also being used to monitor your site perimeter, they must continue to function.

Principles and practices for visual monitoring systems and recording devices

Intrusion detection system and devices

Your intrusion detection system needs to cover all of your operations and storage areas. The system must monitor each:

storage area at all times
operations area when activities with cannabis are occurring and when cannabis is present

Grow areas have different requirements.

Grow areas

Intrusion detection devices only need to cover the entries and exits of a grow area when in use.
The intrusion detection system doesn't need to monitor the access points of a grow area that isn't in use, and doesn't have cannabis present.

The system doesn't need to detect unauthorized movement in the grow area.

Principles and practices for intrusion detection systems and devices

Monitoring

Someone must monitor your intrusion detection system at all times.

Principles and practices for monitoring

Appropriate measures

You must develop appropriate measures for when a visual monitoring or intrusion detection system detects any unauthorized incidents.

Principles and practices for appropriate measures

Records of detected occurrences

You must maintain records of all unauthorized incidents detected by your visual monitoring or intrusion detection system.

Principles and practices for records of detected occurrences

Retention of records

You need to retain records of:

records of detected occurrences: minimum 2 years
visual recordings: minimum 1 year
- if the recording is made using a device that isn't activated by motion, you must retain all recordings
- if the recording is made using a device that's activated by motion, you only need to retain the recording showing the movement

Principles and practices for retention of records

Examples of compliant sites

There are many ways to meet the physical security requirements for a cannabis site. The following figures are only examples of how you can implement physical security measures at a site. They only include the physical security measures for specific areas. Do not copy these examples.