Last updated: October 16, 2026. This Virginia dispensary setup checklist now reflects HB 30, the CCA’s Sept. 9 draft rules, the retail license lottery, and the 18-month window to open.
Virginia’s adult-use cannabis sales begin July 1, 2027. But for most new stores, opening day will come later. Retail licenses aren’t in the first application round. And once you’re picked, you get 18 months to open. This Virginia dispensary setup checklist covers what to set up in that window: your IT, your security, and your compliance systems.
When Does the Clock Start on Your Virginia Dispensary Setup Checklist?
It starts the day the CCA tells you that you’ve been picked.
Here’s how it works. First, you have to qualify. If more qualified people apply than there are licenses, the CCA picks winners by lottery. Being picked gives you early approval, not the right to open. You then have 18 months to:
- Lock in a site that meets state and local rules
- Get local zoning approval
- Pass a CCA site inspection
- Pay your license fee
You can ask for one 6-month extension. Your local government also gets 30 days to object before the CCA grants your final license.
Key dates to know:
- December 2026: final rules expected, then published in January 2027
- By Feb. 1, 2027: first applications open for some microbusinesses and for hemp and medical conversions. Retail comes in a later round.
- July 1, 2027: retail sales begin
Eighteen months sounds like a lot. It isn’t. Cabling, cameras, network gear, and a cannabis POS all take time to plan, order, and install. So start your wiring plan, network closet, and camera and door access design as soon as you have a site. If your plan to open a dispensary in Virginia doesn’t include IT and security, it has a gap.
For what to build first, and in what order, see Virginia’s 350-store rollout.
How Do Virginia Rules Shape Your Dispensary Setup Checklist?
The Virginia Cannabis Control Authority (CCA) runs the state’s cannabis market. Adult-use rules are still drafts. But Virginia’s medical cannabis rules (3VAC10-40) show what the state already expects. Adult-use rules will likely match them or go further.
What the law and draft rules already say:
- Every customer must be 21 or older
- Each sale is capped at two ounces, or the same amount in other products
- No drive-thru windows, and no vending or automated dispensing machines
- No orders through third-party apps or websites
- Every product must be tracked in Metrc, the state’s seed-to-sale system
- Stores must be at least 1,000 feet from schools, colleges, hospitals, and daycares
- Retail floor space is capped at 2,500 square feet
- Product labels need QR codes (draft rules)
For which tech choices are safe to make now, see our guide to Virginia’s draft rules and dispensary tech decisions.
Localities can’t ban stores. But they control zoning, business licenses, and sales hours. So your setup has to fit both state and local rules.
Note: Final rules may change some details. Talk to a Virginia cannabis lawyer before you lock anything in.
What’s on the Virginia Dispensary Setup Checklist?
Every item comes back to three foundations:
- IT and data: your network, POS, and tracking
- Security: cameras, alarms, door access, and cash safety
- Compliance: written steps, training, and records that are ready for inspection
The full checklist at a glance:
- Site checked for zoning, buffer distance, power, and internet
- Written security plan
- Cameras that meet Virginia’s rules
- Alarm and door access systems
- Licensed security company (if you use guards)
- Secure, split network with backup internet
- Cannabis POS connected to Metrc
- Cash handling steps and safes
- Cybersecurity basics
- Training and written procedures
- Ongoing checks and tests
Each section below covers one part.
What Goes in Your Dispensary Security Plan?
Your security plan is the first big item on your Virginia dispensary setup checklist. It shows how you’ll protect products, cash, data, staff, and customers. It should be clear enough for CCA inspectors, insurers, and police to follow. Start with a risk check so you know your weak spots.
Your security plan should cover:
- A floor plan that marks restricted areas
- A camera map, and how long you keep video
- Who can enter which areas, and how you remove access when someone leaves
- Alarm and panic button setup, plus who monitors it
- Cash handling: drawer limits, safe drops, vault steps, and armored pickup
- Opening and closing checklists, including stock counts
- What to do in a robbery, break-in, data breach, or system outage
- Your security vendors and their Virginia license numbers
Plan for outside threats like robbery and break-ins. Plan for inside threats too, like employee theft or discount abuse. Present security as a way to protect staff and customers, not to spy on workers.
Write it in plain language. Link it to your procedures and training so managers can use it every day.
What Cameras Does a Virginia Dispensary Need?
Cameras are one of the biggest lines on any Virginia dispensary setup checklist. Virginia’s current medical rules (3VAC10-40-140) set a clear baseline. Expect adult-use rules to match them or go further.
Under the medical rules, your video system must:
- Cover every area with cannabis, plus every entry and exit
- Point at every safe, vault, and sales area
- Capture clear faces at entrances and exits
- Alert you within 5 minutes if any part fails
- Produce a clear color still photo from any camera, live or recorded
- Stamp the date and time on every recording
- Keep running during a power outage
- Keep recordings for at least 30 days (longer if there’s an investigation)
- Let the state view recordings right away when asked
Many stores keep video longer than 30 days to help with insurance claims and investigations. That’s a choice, not a rule. But plan your storage for it.
Smart setup choices for your camera system:
- Cameras at the ID check, every POS counter, vault doors, back rooms, receiving, and the network closet
- Outdoor cameras and good lighting (the rules require a well-lit outside area)
- On-site recording plus an off-site or cloud backup
- All cameras set to the same clock
Plan camera spots while the space is being designed, not after the walls go up. Blind spots from posts or poor lighting are easy to prevent early. Cure8 sets up camera systems so you can pull any clip an inspector asks for, fast.
What Alarms and Door Access Does a Virginia Dispensary Need?
Virginia’s medical rules also require an alarm system that:
- Covers the whole store
- Is monitored to industry standards
- Has backup power and still sends alerts if the phone or internet line is down
- Includes a duress alarm, a panic alarm, and an automatic voice dialer
- Is turned on whenever the store is closed
Products must be kept in an approved safe or vault. It stays locked except when staff are moving products in or out. Keys and codes are limited to approved staff. The camera room must stay locked and can’t be used for anything else.
Door access checklist:
- Keycards, fobs, or phone access by role, with extra checks for vaults and network closets
- Automatic logs of every door opening, with the time and the user
- Visitor sign-in, escorts, and temporary badges
- A fast way to shut off lost or old badges
Tie it all together. When door events, alarms, and cameras feed into one view, your team can match a door alert with the right camera in seconds. That also makes inspection reports easy.
Do You Need Security Guards, and What Licenses Do They Need?
Virginia’s current rules don’t require armed guards at every store. Still, many busy or higher-risk stores hire guards for peak hours and cash pickups. Base the choice on a risk check.
Things to weigh:
- Local crime and police response times
- Store hours and foot traffic
- How much cash you handle, and how often you deposit it
- What your insurer asks for
If you hire a security company, it must hold a Virginia DCJS business license. Each guard must be registered with DCJS. Armed guards need extra training and approval before they can work. An unlicensed security company is breaking state law, and that can put your license at risk too.
Cure8 makes sure your cameras, alarms, and door access work with your guard team.
How Should You Set Up Your Network, Wi-Fi, and Hardware?
If your network goes down, you can’t make sales, report to Metrc, or pull video. That’s why the network is a core part of your Virginia dispensary setup checklist.
Network checklist:
- Firewall: business-grade, with secure remote access
- Managed switches: so you can split traffic and lock down ports
- Separate networks: keep POS and Metrc traffic, cameras, office systems, and guest Wi-Fi apart
- Backup internet: a main line plus a cellular or wireless backup, so sales and tracking stay online
Wi-Fi checklist:
- Strong passwords that change regularly
- Hidden staff networks customers can’t see
- A separate guest network with limited speed
- Full coverage at every POS and check-in spot
Check your network on a regular schedule to find weak spots early.
Typical hardware in a Virginia dispensary:
| Category | Examples |
| Point of sale | POS terminals, ID and barcode/QR scanners, receipt printers, label printers |
| Displays | Menu screens, check-in or browsing kiosks |
| Back office | Computers, laptops, printers |
| Security | Video recorders, door access panels, alarm panels |
| Storage | Temperature and humidity sensors |
A quick note on kiosks: Virginia law bans selling through vending or automated dispensing machines. Kiosks can help with check-in or browsing the menu. Check final rules before you plan anything more. For more, see Kiosk Compliance 101 for Virginia dispensaries.
Cure8 handles buying, setup, and standard builds for every device. For multi-store operators, that saves time and makes support simpler.
What POS and Seed-to-Sale Setup Does a Virginia Dispensary Need?
Virginia law requires stores to track every product from delivery to sale. The CCA chose Metrc as the state’s tracking system, so your POS must connect to it.
What to look for in a POS:
- Built for cannabis: with Virginia’s tax setup (a 6% state cannabis tax, regular sales tax, and a 1% to 3.5% local tax)
- A direct Metrc connection: so sales sync on their own instead of through manual uploads
- Strong stock tools: lot tracking, expiration dates, and recalls
- ID scanning and limits: a hard stop at the 2 oz limit
- Reliable uptime: with fast, clear support promises
- Your own online ordering: run through your website and POS, since third-party ordering apps are banned
Your POS system should also control returns, discounts, and voids. When every exception shows up in reports, theft is harder to hide. For more on tracking, see our guide to seed-to-sale software.
Cure8 helps Virginia stores compare POS and tracking options, test them, and connect them to cameras and door access.
How Do You Protect Cash and Stop Inside Theft?
Banks are still careful with cannabis, so many Virginia stores will handle a lot of cash. That makes cash rules a big focus for inspectors, insurers, and police.
Cash checklist:
- Bolted-down, high-security safes and drop safes in the vault
- Two people for every vault entry, both on camera
- Low cash limits in each register
- Regular cash pulls from registers to the safe during shifts
- Armored pickup for bank deposits, on a set schedule
Tech helps too. Set POS permissions by role, so only certain staff can give discounts, void sales, or take returns. Use reports that flag odd patterns, like one person voiding several sales per shift. Match POS totals with Metrc and physical counts so gaps show up early. And point cameras so they capture both the employee and the cash.
Daily habits:
- No one closes alone
- Two people count when the safe opens
- Managers do surprise drawer checks
- Staff know how to spot and report anything odd
What Cybersecurity Does a Virginia Dispensary Need?
Customer data, payment info, and video archives are all targets for hackers. A ransomware attack can shut a store down for days.
Basics every store needs:
- Two-step login (MFA) on email, POS, Metrc, and cloud apps
- Security software on every computer and tablet, kept up to date
- Encrypted backups, with a test restore every month
- Each person gets only the access their job needs
For your website and online ordering:
- SSL certificates on every site
- A web firewall to block bad traffic
- Security scans at least every quarter
- Tools that stop customer data from being copied out
Train staff to spot phishing emails, fake calls asking for logins, and strangers plugging devices into your network. One stolen password can expose stock data, customer records, and video.
Cure8 offers managed cybersecurity for cannabis stores, with 24/7 alerts and help when something goes wrong.
What Training and Written Procedures Should You Have?
The best tech still fails without trained people. Inspectors will want proof that staff know ID checks, cash rules, door access, and emergency steps.
Written procedures to create:
- Opening and closing checklists (alarm, camera spot-check, safe count)
- Visitor and vendor steps (sign-in, escort, badge return)
- Daily stock and cash matching
- Emergency steps for robbery, fire, medical events, and outages
- How to report problems to managers, the CCA, and police
Training plan:
- Training for every new hire on all procedures
- Lessons by role: budtenders on POS and ID checks, managers on safe access and reports, guards on patrols and incident notes
- Refreshers every quarter, with sign-off sheets
- Practice drills (robbery, alarm test, network outage) at least twice a year
Training records are some of the first things inspectors ask for. And when staff see security as something that keeps them safe, they’re more likely to follow it.
How Do You Keep Your Virginia Dispensary Setup Checklist Going After You Open?
Compliance doesn’t end on opening day. Expect inspections, rule updates, and extra checks after any incident or stock gap. Virginia’s medical rules already require testing all security equipment at least every six months.
Ongoing checklist:
- Internal security checks (every quarter)
- Camera and alarm tests with written logs (at least every six months)
- Access reviews to remove old badges and codes
- Stock checks that match POS, Metrc, and physical counts
- Updated documents whenever systems, vendors, or layouts change
- Video checks to confirm recordings are saved and complete
Good IT makes inspections faster. Central logs, automatic reports, clear names for every camera and device, and cloud copies of signed procedures and training records all help. You can answer an inspector in minutes, not days. Staying compliant costs less than fixing problems an inspector finds.
Where Does Cure8 Fit Into Your Virginia Dispensary Setup Checklist?
Cure8 handles cannabis IT, security, and compliance across North America. We’re now helping Virginia licensees get ready to open.
Where we help:
- Security plan and diagrams: floor plans, camera maps, door access zones, and alarm setup
- Wiring and network design: cabling, split networks, firewalls, and backup internet
- Equipment: sourced, set up, and delivered on your build schedule
- POS and Metrc: choosing, connecting, testing, and staff training
- 24/7 monitoring and help desk: network, cameras, and alarms
- Ongoing compliance reports: automatic checks and inspection-ready records
Think of Cure8 as part of your founding team. We handle the tech and security, so you can focus on funding, hiring, and building your brand. See how we help with launch planning.
Ready to start? Book a Virginia readiness call to walk through your site, timeline, and Virginia dispensary setup checklist. The stores that plan early are the ones that open on time.