Kentucky’s medical cannabis market is no longer theoretical. Senate Bill 47 was signed on March 31, 2023 to legalize medical cannabis, the medical cannabis program officially took effect on January 1, 2025, and in 2026 operators are dealing with real inspections, real buildouts, and real compliance risk.
If you are building a compliant cannabis security plan in Kentucky in 2026, your plan has to do more than describe cameras and locks. It must connect facility design, employee procedures, video retention, seed-to-sale tracking, cash handling, transport, cybersecurity, and documentation into one system regulators can actually inspect.
What Does a “Compliant Cannabis Security Plan” Mean in Kentucky in 2026?
Kentucky’s medical cannabis program requires every licensed cannabis business to submit and follow a written security plan as part of its cannabis license application. That plan should be specific to the physical location, license type, daily operations, employees, vendors, and products handled on-site.
“Compliant” means your plan aligns with Senate Bill 47, KRS Chapter 218B, Kentucky cannabis laws, and Office of Medical Cannabis rules for security and surveillance systems, video coverage, alarms, access control, transport, and records. The Kentucky Office of Medical Cannabis (OMC), operating through the Cabinet for Health and Family Services, has published regulations and resources that operators should review directly on the state’s medical cannabis laws and regulations page.
In 2026, regulators are actively inspecting Kentucky cannabis businesses, including dispensaries, cultivators, processors, producers, and safety compliance facilities. A weak or missing security plan can lead to remediation, fines, suspension, denial of a dispensary license, denial of another cannabis business license, or an administrative hearing.
This article is meant to be practical. It is not legal advice, but it is a field guide for cannabis businesses that need to ensure compliance before opening, expanding, or updating their security measures.
How Do Kentucky Cannabis Laws Shape Security Requirements in 2026?
Kentucky legalized medical cannabis through Senate Bill 47, signed March 31, 2023, and the law took effect January 1, 2025. By 2026, health and family services regulators and the OMC have issued detailed rules that define how medical cannabis businesses must secure licensed facilities, employees, cannabis products, and records.
The licensing process for cannabis businesses in Kentucky was open from July 1, 2024, to August 31, 2024, allowing applications for cultivator, processor, dispensary, and safety compliance facility licenses. Applicants for cannabis licenses in Kentucky must be at least 21 years old, be residents of Kentucky, and not have any disqualifying criminal convictions.
Key regulatory drivers include:
- Senate Bill 47 and KRS Chapter 218B, which created the Kentucky medical cannabis framework.
- OMC regulations in 915 KAR Chapter 1, including rules for cultivators, processors, dispensaries, safety compliance, and transport.
- Local governments, zoning ordinances, building codes, signage rules, and fire code requirements.
- Separation rules, including restrictions near secondary schools, elementary schools, and daycare centers.
- Data privacy and recordkeeping rules for patient information, employee files, visitor logs, camera footage, and incident reports.
- OMC technical advisories, which continue to evolve in 2026 and should be monitored through the state’s business resources page.
As of 2026, recreational cannabis remains illegal in Kentucky, with no current plans for legalization. Adult-use marijuana remains illegal, home cultivation remains illegal, and medical marijuana is only available through the state’s medical program for qualified patients with a written certification from a medicinal cannabis practitioner.
That matters for security. Kentucky’s regulations mandate a proactive approach to prevent theft and diversion in the cannabis industry, especially because medical cannabis sales are limited to registered patients and caregivers. Medical cannabis will be available for purchase by registered patients in Kentucky starting January 1, 2025, with specific purchase limits set by the state.
Kentucky rules also affect business structure. A proposed cannabis business must disclose ownership interest, financial interest, parent company relationships, and enough information to show the applicant has a viable business plan, financial plan, and sufficient capital. Kentucky requires cannabis business applicants to prove they have sufficient capital of $150,000 to qualify for a license.
For dispensary applicants, the application fee for a cannabis dispensary license in Kentucky is $5,000, with a licensing fee of $30,000 and an annual renewal fee of $15,000. Kentucky cannabis licenses require a one-time application fee of $5,000, a licensing fee of $30,000, and an annual renewal fee of $15,000, along with proof of sufficient capital of $150,000. Cannabis businesses in Kentucky do not qualify for traditional funding options like SBA loans due to federal legality issues, but they can explore private funding, partnerships, and personal loans.
Which Cannabis Businesses in Kentucky Need a Formal Security Plan?
Every Kentucky cannabis business that touches plant material, raw plant material, medical cannabis products, or medicinal cannabis products must document security procedures as part of its operating plan. That includes the medical cannabis supply chain from cultivation through processing, testing, transport, dispensing, and destruction.
You need a site-specific security plan if you operate or apply for:
- Dispensary: A Kentucky dispensary must secure the lobby, sales floor, point-of-sale area, product displays, storage rooms, delivery workflows, patient data, and cash.
- Cultivator: Tiered cultivators must secure grow areas, harvested plant material, perimeter areas, access doors, irrigation and chemical rooms, and transfer points.
- Processor: Processors must secure extraction rooms, production areas, packaging areas, raw material, finished cannabis products, and waste.
- Producer: A producer must combine cultivator and processor controls where applicable.
- Safety compliance facility: Labs and safety compliance facilities must secure samples, testing areas, chain-of-custody records, lab data, and retained materials.
- Transport or delivery activity: Dispensaries can operate a delivery service, drive-thru window, and curbside pickup service, but must submit detailed written plans and procedures for these operations to the Kentucky Office of Medical Cannabis for approval.
Transport rules deserve special attention. Emergency protocols must be in place for transporting cannabis products, which includes secure communication and protocols for vehicle malfunctions. Dispensaries and transporters should also document chain of custody, manifests, route controls, locked compartments, driver identification, and incident reporting under Kentucky’s transport rules, including 915 KAR 1:080 as summarized by Justia’s regulation listing.
Security obligations extend beyond employees. Owners, managers, authorized agents, contractors, vendors, volunteers, and authorized employees must follow written procedures, wear proper identification, and avoid workarounds that could create violations under cannabis laws.
What Core Elements Must a Kentucky Cannabis Security Plan Include?
A Kentucky-compliant plan should cover facility design, video surveillance, alarms, access control, inventory control, transport, cybersecurity, cash, training, and incident response. The goal is to show regulators that the business can prevent unauthorized entry, detect suspicious activity, preserve evidence, and maintain compliance every day.
- Site description:
- Floorplans showing public areas, limited access areas, vaults, secure rooms, storage rooms, loading areas, camera locations, alarm panels, and server areas.
- Exterior layout showing fencing, lighting, parking, gates, bollards, and the 20-foot perimeter area where applicable.
- Proof that the facility is enclosed, locked, and designed around the license type.
- Video surveillance:
- 24/7 high-resolution surveillance that captures facial features in all lighting conditions.
- Cameras must monitor all limited-access areas, security equipment rooms, entrances, exits, and a 20-foot perimeter beyond the facility’s exterior.
- Security systems for cannabis operations in Kentucky must include 24/7 high-resolution surveillance that captures facial features in all lighting conditions.
- All security recordings and image data must be stored in a limited-access area to prevent tampering.
- Systems should easily export video recordings for regulators or law enforcement.
- Alarms and access control:
- Intrusion alarms, fire alarms, panic devices, silent alarms, door contacts, motion sensors, and monitored alerts.
- Facilities must utilize dual-layer access control to secure limited-access zones, combining commercial-grade locks with electronic access control systems.
- Limited access areas (LAAs) must be clearly marked, with access reserved for authorized individuals who possess proper identification.
- Product and inventory security:
- Receiving, storage, vault access, transfers, waste destruction, recalled product controls, and daily reconciliation.
- Compliance with seed-to-sale tracking requirements is essential for cannabis operations, detailing every movement of cannabis products.
- All Kentucky cannabis license holders are required to implement an electronic monitoring system and a seed-to-sale tracking system, along with maintaining comprehensive employee records, visitor records, and compliant security measures.
- Records and updates:
- Visitor logs, employee records, incident records, maintenance reports, camera checks, training signoffs, and access logs.
- Many Kentucky rules require long retention periods. Operators should keep at least five years of logs where required and plan for secure retention of video for at least the regulatory minimum, often 60 days, with many operators choosing 90 days or more.
- Written security standard operating procedures (SOPs) must be tailored to specific business categories such as cultivators, processors, and dispensaries.
- Plans should explain how the business will update procedures when OMC guidance changes.
What Are the Kentucky-Specific Video Surveillance Standards for 2026?
Continuous video surveillance is one of the most heavily enforced parts of Kentucky cannabis compliance. If cameras miss a vault door, storage shelf, sales counter, lab sample area, or loading dock, regulators may treat that blind spot as a serious weakness.
Kentucky rules generally require surveillance of entrances, exits, limited access areas, security equipment rooms, storage areas, and other points where medicinal cannabis is handled. For safety compliance facilities, regulations expressly require broad coverage and retention, and operators should design their systems to exceed minimums rather than barely meet them.
Your plan should cover:
- Camera placement:
- Entrances and exits.
- POS areas and cash-handling points.
- Vaults, safes, storage rooms, and product display areas.
- Cultivation rooms, processing lines, lab spaces, sample storage, and loading docks.
- Exterior areas, including the 20-foot perimeter beyond the facility exterior where required.
- Rooms containing surveillance, alarm, network, or recording equipment.
- Technical standards:
- HD or better image quality.
- Clear facial and product identification under normal lighting conditions.
- Date and time stamps.
- Synchronized system clocks.
- Exportable footage and still images in standard formats.
- Secure storage with access restricted to authorized personnel.
- Operational practices:
- Daily or weekly camera checks.
- Kentucky cannabis businesses are required to conduct monthly maintenance inspections of their security alarm and surveillance systems to ensure proper operation and compliance with state regulations.
- Monthly third-party or internal system tests.
- Logs for viewing, copying, exporting, or releasing footage.
- Incident bookmarking when theft, diversion, patient disputes, or inventory discrepancies occur.
All security system malfunctions lasting longer than 8 hours must be reported to the relevant authorities, and alternative security measures must be deployed. That means your plan should already say who notices the outage, who calls the vendor, who notifies OMC, who posts temporary guards if needed, and how the event is documented.
How Should You Design Physical Security for Different Cannabis Facility Types?
Kentucky expects licensed facilities to be enclosed, locked, and appropriate for their license category. Good physical design starts before the cannabis license application, because security floorplans, camera layouts, storage areas, and limited-access zones can affect permits, cost, construction, and inspection readiness.
Dispensaries face public access risk. Cultivators face perimeter and plant diversion risk. Processors face product, extraction, chemical, and batch-control risk. Labs face sample integrity and chain-of-custody risk.
| Facility type | Main security focus | Practical design notes |
| Dispensary storefront | Patient access, POS, cash, product storage | Separate lobby, sales floor, secure vault, monitored access doors, cameras over POS, protected delivery and curbside pickup service workflows |
| Cultivation facility | Plant protection and perimeter control | Fencing, gates, lighting, grow-room access control, camera coverage, harvested material storage, restricted utility areas |
| Processor or producer | Extraction, production, finished goods | Controlled production rooms, chemical storage, fire code coordination, batch security, waste documentation |
| Safety compliance lab | Samples and data integrity | Secure intake, locked sample storage, visitor controls, camera coverage, chain-of-custody documentation |
Kentucky also has site rules. Dispensaries must generally be at important least 1,000 feet from schools and daycare centers, and dispensaries cannot share the same office space or physical location with cultivation or processing operations or a medical practice. A medicinal cannabis practitioner should not be colocated in a way that creates prohibited conflicts or an undue burden on compliance expectations.
Site selection is not just a real estate decision. It affects camera costs, lighting, parking, delivery movement, local approvals, insurance, and whether the business can operate without needing prior written approval for future material changes.
What Alarm, Access Control, and Monitoring Systems Are Required?
Kentucky cannabis regulations expect layered electronic security, not a single alarm keypad near the front door. Your security plan should describe intrusion alarms, panic or duress devices, controlled access, electronic monitoring, backup power, and response steps.
Alarm systems are required to cover all entrances and exits, must notify personnel of failures within five minutes, and include a 24-hour auxiliary power backup. Dispensaries in Kentucky must have a security alarm system, including both audible and silent alarms, to protect against unauthorized entry and theft.
Include these components in the plan:
- UL-listed or commercial-grade intrusion panel.
- Door and window contacts.
- Motion detectors.
- Glass-break sensors where appropriate.
- Audible sirens and strobes.
- Silent holdup alarms near POS and cash-handling areas.
- Smoke detection and fire alarms.
- Backup power for alarm, surveillance, network, and access systems.
- Professional 24/7 monitoring with documented response protocols.
Access control should be role-based. A budtender does not need the same permissions as a general manager, lab director, inventory lead, or IT administrator. Badge systems, PINs, biometrics for high-value zones, and audit logs should all connect back to written procedures.
Access doors into limited-access areas should remain locked, and electronic systems should fail secure during power interruptions. Visitor access should require sign-in, temporary badge issuance, escorting, time-out, and record retention.
How Do You Secure Cannabis Inventory, Cash, and Sensitive Data?
Kentucky’s medical program is designed as a closed and trackable system. Security plans must connect physical inventory controls, seed-to-sale tracking, POS systems, patient privacy, video storage, and cybersecurity into one workflow.
Here is a simple way to organize it:
| Asset type | Physical controls | Procedural controls | Technical controls |
| Inventory | Vaults, locked cages, restricted storage | Daily counts, monthly reconciliations, discrepancy investigations | Seed-to-sale tracking, POS permissions, audit logs |
| Cash | Safes, smart safes, limited drawers | Cash drops, dual counts, armored transport | POS reports, camera review, restricted accounting access |
| Data | Locked server rooms, restricted devices | User onboarding/offboarding, incident reporting | Firewalls, segmented Wi-Fi, endpoint protection, backups |
All Kentucky cannabis license holders are required to implement comprehensive and compliant security and surveillance systems, including electronic monitoring and seed-to-sale tracking systems. Metrc or other state-designated inventory platforms should match actual physical counts, and discrepancies should be investigated quickly.
Cannabis businesses must implement strict cash-handling policies to address banking restrictions. Those policies should cover limited on-site cash, dual-person cash counts, cash drops, vault access, transport to financial institutions, and camera coverage over each cash movement.
Cybersecurity belongs in the security plan too. POS systems, inventory platforms, access control software, cloud video, and patient records all need secure networks, segmented Wi-Fi, firewalls, endpoint protection, regular patching, and role-based access. Training programs for staff must focus on recognizing suspicious activities, preventing internal diversion, and preserving digital audit logs.
What Are the Step-by-Step Phases to Build a Kentucky-Compliant Security Plan?
A structured process helps Kentucky cannabis entrepreneurs move from concept to inspection-ready operations. It also keeps architects, contractors, legal counsel, IT vendors, and security integrators working from the same plan.
| Phase | What to do | Key deliverables |
| 1. Review rules | Read OMC rules, local ordinances, zoning, fire code, and advisories | Compliance matrix, licensing checklist |
| 2. Assess the site | Evaluate doors, windows, parking, crime risk, transport paths, and public access | Risk assessment, site notes |
| 3. Design systems | Plan cameras, alarms, access control, vaults, lighting, and networks together | Security floorplan, camera matrix |
| 4. Draft SOPs | Write procedures for daily and emergency operations | SOP manual, incident plan |
| 5. Procure hardware | Select compliant cameras, alarms, locks, servers, UPS, and network gear | Equipment list, installation schedule |
| 6. Train staff | Train employees, managers, agents, contractors, and volunteers | Training records, signoffs |
| 7. Test systems | Test cameras, exports, alarms, backup power, access logs, and failover | Test logs, maintenance records |
| 8. Prepare inspection | Walk the facility before OMC inspection | Corrective action list, final binder |
Dispensaries in Kentucky must have full and complete standard operating procedures (SOPs) before they can begin selling products, which include detailed operational plans outlining daily operations, financial viability, and timelines for becoming operational. This is why SOP drafting should happen during buildout, not after the shelves are stocked.
Cure8 can support cannabis businesses in several phases: early risk assessment, camera and alarm design, hardware procurement, installation support, network setup, POS and inventory integration, documentation workflows, and long-term monitoring.
How Do Kentucky Dispensary Security Requirements Differ from Cultivator or Processor Rules?
The core principles are similar across licensed cannabis businesses: restrict access, monitor activity, protect inventory, document exceptions, and prevent diversion. But the actual security plan should match the risks of each license type.
For dispensaries, focus on:
- Lobby and sales-floor control.
- ID verification for qualified patients.
- Privacy for patient consultations and purchases.
- Secure product displays.
- POS monitoring.
- Back-of-house vaulting.
- Delivery service, drive-thru, and curbside procedures.
- Purchase limits and procedures for patients who purchase cannabis.
For cultivators, focus on:
- Greenhouse or indoor grow containment.
- Perimeter fencing and controlled gates.
- Restricted access to grow rooms.
- Environmental system monitoring.
- Harvest security and storage before transfer.
- Controls for raw plant material.
For processors and producers, focus on:
- High-value concentrates and cannabis products.
- Extraction equipment safety.
- Secure chemical storage.
- Production room access.
- Batch documentation.
- Waste destruction and recalled product handling.
For a safety compliance facility, focus on sample security. Safety compliance facilities need evidence-style chain of custody, secure sample storage, visitor controls, data integrity, and records that can withstand scrutiny during Kentucky medical cannabis investigations. Applicants pursuing safety compliance facility licenses should also pay close attention to lab-specific retention, signage, and camera coverage rules.
How Should You Document SOPs, Training, and Incident Response in Your Plan?
Kentucky regulators expect written standard operating procedures that are actually used. A polished binder is not enough if staff cannot explain how to arm the alarm, receive product, escort a visitor, respond to a camera outage, or report suspected diversion.
Your SOPs should include:
- Opening and closing procedures.
- Alarm arming and disarming.
- Visitor check-in, escorting, and log retention.
- Product receiving and rejection.
- Vault access.
- Cash drops.
- Inventory counts and discrepancy review.
- Waste handling and destruction.
- Transport emergencies.
- Robbery, theft, diversion, fire, flood, power outage, and system failure response.
Training should include onboarding, annual refreshers, role-specific instruction, and drills. Staff should understand suspicious behavior, internal diversion red flags, digital audit logs, privacy expectations, patient eligibility basics, and emergency escalation.
A simple incident report should capture:
- Date and time.
- Location.
- People involved.
- Product or cash affected.
- Video reference.
- Immediate action taken.
- Notifications made to law enforcement, OMC, insurers, or management.
- Corrective action.
- Manager approval.
Qualifying conditions such as chronic pain, post traumatic stress disorder, seizure disorders, multiple sclerosis, and chronic nausea are part of the patient side of the medical program. Dispensary staff do not diagnose patients, but they should understand how written certification and registry verification affect secure access to medicinal cannabis.
What Common Security and Compliance Mistakes Do Kentucky Cannabis Businesses Make?
Early compliance reviews often expose the same problems: blind spots, weak documentation, poor access discipline, and systems that were installed but not tested. Fixing these issues before inspection is far cheaper than defending them later.
Common mistakes include:
- Camera dead zones at vault doors, loading docks, POS areas, or storage rooms.
- Video systems that cannot easily export video recordings.
- Cameras that fail under normal lighting conditions.
- Alarms that are not professionally monitored.
- Missing silent alarms in cash-handling areas.
- Badge sharing among employees.
- Access logs that are incomplete or never reviewed.
- Visitor logs with missing times, names, or escorts.
- Seed-to-sale entries that do not match physical inventory.
- Informal delivery, drive-thru, or curbside pickup service procedures.
- SOPs that are not updated after a layout change or OMC advisory.
- Missing maintenance reports, training records, or incident logs.
Regular audits and routine internal inspections are necessary to maintain compliance with security regulations. A quarterly walkthrough should test camera views, alarm response, access permissions, exports, lighting, vault procedures, and inventory reconciliation.
The best way to avoid violations is to build review into the calendar. If your team only looks at the security plan when inspectors arrive, it is already too late.
Ready to build a compliant, inspection-ready cannabis security plan that protects your business and meets Kentucky’s strict regulations? Partner with Cure8, the industry leader in cannabis IT and security solutions. Our expert team will guide you through every step, from risk assessment and system design to installation, staff training, and ongoing monitoring, ensuring your operation stays secure and fully compliant.
Don’t wait for an inspection to catch you off guard. Contact Cure8 today to schedule your personalized security consultation and safeguard your cannabis business’s future in Kentucky’s evolving market.