Meeting security requirements is a key part of getting a cannabis business licensed and launched, and Minnesota is no exception.
At the time this is being written in June 2024, the state’s requirements are in an interesting situation. The recreational cannabis law contains few details on specific security requirements, and the rec program’s rules and regulations are still in the process of being drafted. We will attempt to update this article once we know more.
One form of licensing that is moving forward at the moment is preapproval licensing. Because recreational rules aren’t yet ready, pre-approval license applicants will have to show compliance with Minnesota’s current medical cannabis regulations.
Applicants will have to show in a security plan how they intend on meeting these requirements and protecting their business. If they receive a license, they will also have to implement this plan and pass an inspection.
Let’s take a look at the state’s current medical cannabis security regulations. Note that these regulations refer to cannabis cultivators as manufacturers, since medical licensing included the right the cultivate, process, package, and distribute cannabis.
Also note that this article is meant to be an introduction and to cover the key cannabis security requirements of the state, not to be a comprehensive list of all security requirements or as a replacement for support from a security professional.
Electronic Controlled Access System
See: https://www.revisor.mn.gov/rules/4770.0700/#rule.4770.0700.2
Most states leave it up to the operator on whether locks need to be simple mechanical locks or electronic, centrally-manageable one. Minnesota’s medical rules require electronic locks with full recordkeeping and central, remote management. Workers at these facilities will therefore likely need individual keyfobs or cards to gain entrance.
2. Restricted access areas. A medical cannabis manufacturer must use an electronic controlled access system to limit entrance to all restricted access areas of its manufacturing facility and its distribution facilities.
A. An electronic controlled access system must:
(1) limit access to authorized individuals;
(2) track personnel entry and exit times;
(3) lock down the facility in the event of a security threat;
(4) store data for retrieval;
(5) remain operable in the event of power failure; and
(6) enable remote administration.
Surveillance Requirements
See: https://www.revisor.mn.gov/rules/4770.0900
These requirements are all fairly straightforward. Most commercial-grade surveillance systems include all of these features like timestamps and the ability to export videos and images. The 90 day retention period is a bit long and will require a lot of storage either onsite on NVRs or in the cloud.
One interesting requirement here is that the rules require you to continue recording during a power outage, but don’t stipulate for how long. You’ll probably want to look into the reliability of your facility’s power source and how long the typical power outage lasts and err on the side of caution, relying on battery backups and possibly diesel generators to keep you going in an emergency.
Full text:
4770.0900 MONITORING AND SURVEILLANCE REQUIREMENTS
Subpart 1. 24-hour closed-circuit television. A medical cannabis manufacturer must operate and maintain in good working order a closed-circuit television (CCTV) surveillance system on all of its premises, which must operate 24 hours per day, seven days per week, and visually record:
A. all phases of production;
B. all areas that might contain plant material and medical cannabis, including all safes and vaults;
C. all points of entry and exit, including sales areas;
D. the entrance to the video surveillance room; and
E. any parking lot, which must have appropriate lighting for the normal conditions of the area under surveillance.
Subp. 2. Camera specifications. Cameras must:
A. capture clear and certain identification of any person entering or exiting a manufacturing facility or distribution facility;
B. have the ability to produce a clear, color, still photo either live or from a recording;
C. have an embedded date-and-time stamp on all recordings that must be synchronized and not obscure the picture; and
D. continue to operate during a power outage.
Subp. 3. Video recording specifications.
A. A video recording must export still images in an industry standard image format, including .jpg, .bmp, and .gif.
B. Exported video must be archived in a proprietary format that ensures authentication and guarantees that the recorded image has not been altered.
C. Exported video must also be saved in an industry standard file format that can be played on a standard computer operating system.
D. All recordings must be erased or destroyed before disposal.
Subp. 4. Additional requirements. The manufacturer must maintain all security system equipment and recordings in a secure location to prevent theft, loss, destruction, corruption, and alterations.
Subp. 5. Retention. The manufacturer must ensure that 24-hour recordings from all video cameras are:
A. available for viewing by the commissioner upon request;
B. retained for at least 90 calendar days;
C. maintained free of alteration or corruption; and
D. retained longer, as needed, if the manufacturer is given actual notice of a pending criminal, civil, or administrative investigation, or other legal proceeding for which the recording may contain relevant information.
Alarms
See: https://www.revisor.mn.gov/rules/4770.1000
These requirements are actually fairly lenient compared to other states for a medical program. In subpart B it suggests but doesn’t require various types of alarm systems.
Full text:
4770.1000 ALARM SYSTEM REQUIREMENTS
A. A medical cannabis manufacturer must install and maintain a professionally monitored security alarm system that provides intrusion and fire detection of all:
(1) facility entrances and exits;
(2) rooms with exterior windows;
(3) rooms with exterior walls;
(4) roof hatches;
(5) skylights; and
(6) storage rooms.
B. For purposes of this part, a security alarm system means a device or series of devices that summons law enforcement personnel during, or as a result of, an alarm condition. Devices may include:
(1) hardwired systems and systems interconnected with a radio frequency method such as cellular or private radio signals that emit or transmit a remote or local audio, visual, or electronic signal;
(2) motion detectors;
(3) pressure switches;
(4) a duress alarm;
(5) a panic alarm;
(6) a holdup alarm;
(7) an automatic voice dialer; and
(8) a failure notification system that provides an audio, text, or visual notification of any failure in the surveillance system.
C. A manufacturer’s security alarm system and all devices must continue to operate during a power outage.
D. The commissioner must have the ability to access a medical cannabis manufacturer’s security alarm system.
E. The manufacturer’s security alarm system must be inspected and all devices tested annually by a qualified alarm vendor.
Security SOPs
See: https://www.revisor.mn.gov/rules/4770.0400/
Minnesota requires several different categories of required standard operating procedures (SOPs) including:
- security measures to deter and prevent theft of medical cannabis
- unauthorized entrance into areas containing medical cannabis
- plans for responding to a security breach at a manufacturing or distribution facility, or while medical cannabis is in transit to a manufacturing or distribution facility
A security company can help you draft these SOPs or provide you with boilerplate-style text that you can customize to your unique situation, or you can try to put them together yourself. These should be fairly extensive and cover all the angles you can think of.
How Cure8 Can Help
Cure8 is a leading cannabis security and networking services company. We can help you plan and install your security system from start to finish, including helping with the technical aspects of the security plan for your application. Contact us today for a chat or quote.
