Cannabis dispensary security and compliance rules

A dispensary is a retail store holding high-value inventory, taking a lot of cash, under a license a regulator can pull. That is what separates cannabis dispensary security from every other retail contract. A failure here can cost the business its right to trade.

Why does the regulation come first?

Cannabis is still federally illegal, so every legal market is a state construction with its own rulebook. A camera plan that satisfies one regulator can be short in the next state by a frame rate, a retention period or a single uncovered doorway.

California's requirements give you the shape. Surveillance sits in the all-licensee part of the rules, and the Department of Cannabis Control publishes self-inspection checklists for cultivators and manufacturers but not retailers, so the clearest plain-English statement of the standard is on the manufacturer checklist.

The system records continuously 24 hours a day at a minimum of 15 frames per second. Recordings display the time and date accurately. Footage is kept for a minimum of 90 days. And the licensee has to demonstrate they can retrieve and play back footage from up to 90 days before an inspection, which is a separate requirement from merely storing it.

Coverage is enumerated rather than left to judgment. Areas where product is weighed, packed, stored, loaded or unloaded for transport, prepared or moved. Limited-access areas. Security rooms. The room holding the surveillance storage device itself. Every entrance and exit.

The full rule set sits in Title 4 of the California Code of Regulations, and the DCC checklist points at sections 15042, 15042.1 and 15044 for the surveillance requirements. Read yours the same way: find the section numbers, then design to them.

Retail-specific rules sit elsewhere and shape the security schedule as much as the camera plan does. DCC restricts California retail sales to between 6:00 a.m. and 10:00 p.m., which fixes when your staffed hours end and when the building becomes an unoccupied cash-and-inventory target.

Two further requirements travel with most state frameworks. On-site personnel during operating hours, sometimes armed, sometimes only above a defined inventory or location threshold. And transport security for product moving between cultivation, processing and retail, usually with GPS tracking and specified vehicle conditions. Product in transit is concentrated, valuable and away from every fixed control you built.

What does a dispensary guard need that a retail guard does not?

State licensing is the entry ticket, not the qualification. Three things sit on top of it.

Regulatory literacy. The guard has to know what a compliance violation looks like, because they will see one before anyone in the office does. A customer filming inside the limited-access area. A delivery signed for by the wrong person. A back door propped during a restock. On an ordinary retail site those are annoyances. Here they are findings.

A cleaner background than the industry standard. Operators screen harder for these posts, for practical reasons rather than moral ones. The license is the asset, and anything that gives a regulator a reason to look harder threatens it.

Customer-facing composure. A lot of the traffic is nervous. Older customers, medical patients, people who spent thirty years being told this was a crime. A guard who reads as a bouncer costs the client repeat business. A guard who reads as staff earns it. That is not a soft skill on this site, it is the deliverable, and it belongs in the post orders rather than in a pep talk.

Where the state or the city requires armed coverage, the firearm adds a training and requalification calendar that has to be tracked per officer. It also narrows rather than widens what the guard may do. Use of force rules for a private officer are the same here as anywhere: they are not law enforcement, and the training has to say so out loud. In California the requalification cadence alone is four range qualifications across a two-year permit.

How do you handle a business that runs on cash?

The banking problem is federal and it is not going away quietly. FinCEN's guidance is explicit that the obligation to file a suspicious activity report is unaffected by any state law legalizing marijuana, and that a bank taking on a dispensary must verify its licensure with the state and monitor it on an ongoing basis. Some institutions do it. Many decline. So a lot of dispensaries still hold serious cash on site.

That reality drives four controls, and they matter more than anything on the camera side.

The pattern worth noticing: none of these stop a robbery. They cap what a robbery yields, which is a more achievable goal and a much better one for the person behind the counter.

How do you protect the product itself?

Inventory is both value and evidence. State seed-to-sale systems expect the count to reconcile, and a discrepancy is not written off as shrink. It is investigated, and the investigation lands on the license.

Three controls do most of the work.

1. Access logging on secure storage. When the tracking system flags a gap, the log tells you who could have been responsible. That alone deters most of what it would otherwise have to detect.
2. Minimal product on the retail floor. Display cases restocked from the back mean a grab-and-run takes what is in one case rather than what is in the building.
3. End-of-day reconciliation, every day. Same-day means memories are fresh and the footage is one click away. A weekly count means investigating something nobody remembers, on video you have to go hunting for.

How should access be zoned?

In layers, because that is what both the regulator and the threat model want.

Reception. ID and, in medical markets, patient card verification. It is a regulatory gate, and it is also the first look at everyone who comes through the door. The person who is going to be a problem in ten minutes usually shows it here.

The retail floor. Where the customers are and where most incidents happen. Guard positioning that covers the room, camera coverage without blind corners, and a clear line of sight from the counter. Most retail theft is opportunistic, and opportunity is a geometry problem.

Storage and the vault. The tightest control in the building. Electronic access that logs every entry, dual authorization on the vault, and an authorized list short enough to recite. The DCC checklist also expects the ordinary physical layer alongside it: an alarm system, commercial-grade locks, sign-in and sign-out procedures, and perimeter security. The wider principles are the same ones in access control beyond badge readers.

What documentation will actually be asked for?

An inspector can ask for months of records, and an insurer will ask for the incident file. Neither accepts a recollection.

Guard logs need to be worth reading. "All quiet" repeated for eight hours documents nothing except that someone was holding a pen. What earns its place is who entered, when, what was unusual, and what was done about it. Writing reports people actually read covers the craft, and the DAR template gives you the structure.

Footage archives need verifying, not assuming. The failure mode is always the same: someone asks for day 74 and the system has been silently overwriting at 30 because a drive failed in March. Check retention and playback on a schedule. In California, being able to retrieve and play back is its own requirement, and it is the one that fails first.

And keep the credential file current for every officer on the site. A regulator who finds an expired permit on an armed post has found two problems, and the second one is yours. That is a tracking discipline rather than a legal one.