Cannabis Security Regulations and Physical Security Plans

For those that are venturing into the Cannabis industry in New York State, there are certainly many start-up costs and facets of the business that one must consider and anticipate.  Two of those key areas will be meeting Security Regulations (the minimum standard New York State will require) and delivering a Master Physical Security plan, which we will define as illustrating your business approach to loss prevention, NY Regulations, and hardening of your cannabis site & operation all wrapped into one.  Physical security and the aforementioned items can certainly be viewed as a box check OR they can be used to strengthen and drive your business model.  

✅ NY will require cameras.   

✅ NY will require an alarm system.   

✅ NY will require these systems to be installed by a licensed security professional.  

✅ For some soon to be business owners, security will be just an obstacle to overcome, a financial obligation, or checking that box for the minimum standard. 

I would argue the adage “Nothing ventured, nothing gained” is spot on when applied to a security model. Unfortunately, far too many take a reactive approach to their physical security, addressing their vulnerabilities after an incident takes place. As a new cannabis operation, there is a true opportunity to take a proactive approach and save on future headaches and unexpected expenses that can easily be avoided with some forward thinking. That begins with carefully choosing a security and technology partner that understands your business model, your budget, and how to address any unique challenges presented by your operating location.

In many instances, the correct technology will be added value to any operation, and this should be the norm, not the exception.  Since New York state has not yet released its specific regulations with regards to security, let’s jump right into the physical security discussion (we can revisit this portion of the blog later against our overall Master Physical Security plan discussion, then fill in the blanks with some specific regulations). Ultimately, the lack of confirmed regulations should not stop you from building your own plan now, so you can forecast the costs and procedures into your business model.

Physical Security Plans Cannot Be Derived from A Book

While books provide philosophies, healthy internal discussion, insights and ideas, they also only provide a one-way stream of communication and thinking. Books do not necessarily “update” on their own over time. They do not listen to the end user, they do not provide feedback, they do not adapt to new challenges or changing environments, and certainly don’t discuss the dozens of new concepts and solutions that become available after its publishing.  Our team at Chimera recently attended a cannabis trade show, and I observed dozens of potential cannabis business owners purchasing “books” that offered physical security plans. I would offer the following question: How can someone offer an effective physical security plan without seeing the actual location or understanding the vertical growth plans in the cannabis market for the end user?  

Location, Location, Location

Locations can be affected by many factors including population density, area crime rates (burglaries and robberies should be on your radar), rural versus metro, foot traffic, structure type (greenhouse, retail, or warehouse etc), hours of operation, access points, and most importantly how you give the impression of control.  Every physical security plan should be customized to fit the needs of the business and its surrounding environment.  

Ongoing dialogue between a security integrator and the end user is critical, as this partnership drives the business so that both parties are pulling in the same direction and have the same end goal. By extension you should also never just hand over your physical security job without interviewing multiple integrators.  This should be a lifelong business partnership!  Interview them, talk philosophies, technologies, budgets, and make sure they understand what your expectations are up front. Additionally, understand where your security partner is located and their familiarity with the communities you plan to serve and operate in. If there is an unforeseen issue with your security technology, how quickly can your security partners’ technicians address it? What is their emergency service response plan? If you are working with an advisory group from outside of your city or state, who are the subcontractors they are hiring to install or service your facility? What are their qualifications?

Your security partner should know what your business model is today and what it could be in the future, so that as your business grows the technology you are investing in today can be scaled without having to purchase an entirely new system.  Building your physical security plan like bricks (and in phases in some cases) is crucial to your business.

Monitored Alerts & Analytics

Physical security solutions should have built-in alert capabilities through a variety of methods–texts, email, mobile app push notifications, phone calls etc. Burglar and Fire alarms will require monitoring by a 24/7 UL-approved Central Station Monitoring Center. Additionally, video surveillance systems, IoT devices, access control systems, GPS tracking devices, and POS reporting are all examples of technology that has alert capability with many manufacturers and software providers. Business owners at the various levels of the cannabis supply chain need real time alerts so they can protect their business and make critical decisions at a moment’s notice. 

Consider areas of your business where adding monitoring into your plan could be beneficial, knowing that your business is being protected 24-7-365. This does not simply apply to the security of your facility, but the integrity of all your physical assets and safety of your employees. You can have the temperature in your grow facilities monitored just as easily as your intruder alarm system. Monitoring can be conducted internally where you receive alerts yourself, or via a professional monitoring service that can keep an eye on your business for you and contact you or emergency responders based on your instructions. 

It is important to discuss and plan ahead for features you may need later and discuss any future “visions” you have for your business so you can invest and spend your money wisely, knowing future purchases and investments will integrate.

SME

When developing a plan, it is important you have a Subject Matter Expert (SME) weighing in on the areas we discussed above.  Even being new to the Cannabis vertical, a good partner can offer from past professional experience in similar environments to predict and prevent critical events that can affect your business based on prior knowledge in their area of expertise. 

Yes, in today’s world of evolving technology there are certainly more self-install or DIY types of systems out there that may seem like enough security to meet the minimum requirements set forth by the State. Based on our interpretation of what is to come, we do not believe this will be accepted as part of a professional cannabis business Master Physical Security Plan. 

Furthermore, there are several events that can negatively impact a business’s bottom line that a Subject Matter Expert can offer their perspective on. Let’s take employee theft for example.  In many instances, people can project on how they may handle internal and external theft, but a business needs to have a model, as well as policies and procedures in place for these types of instances.  When theft occurs, it not only impacts on-hand inventory negatively, it also will impact the total number of sales available which directly impacts your bottom line. If this is an area you have not had to deal with before, consider the added value of working with a security partner that can advise you on how to address this. If you can find an integrator business partner that also offers loss prevention and asset protection consulting as part of their offerings, you can then blend many of the needs in the physical security program, state regulations, analytics, and profitability all in one.  Doing this with one business partner can be advantageous as it should make all these elements cohesive.

Conclusion

Certainly, there is a lot to consider in just the regulations and physical security space.  While we didn’t provide the ‘secret sauce’ above, we lay out a blueprint so you can anticipate and be proactive in a critical area, as well as lead the conversation in discussions.  Find the right partner.  Even if you “know someone” have meaningful conversations and interview integrators to ensure you have done your due diligence.  Your business depends on your business plan, decision making, business partners, and execution.