Virginia’s adult-use cannabis sales begin July 1, 2027. But the final rules won’t be published until January 2027 (CCA). That means you’re building a Virginia cannabis security plan for rules that could still change. And in every other state, security rules kept changing after launch too.
The answer isn’t to wait. It isn’t to guess, either. Instead, build on what’s already known, leave room where rules tend to change, and set up a simple way to handle updates.
What Should a Virginia Cannabis Security Plan Start With?
Start with Virginia’s medical cannabis security rules in 3VAC10-40-140. In fact, the CCA already enforces these. So it’s safe to assume adult-use rules will start from a similar place.
| Medical rule today | What it requires |
| Camera coverage | Cameras in every area with cannabis and at every door in or out. Regulators can view recordings right away. |
| Video storage | Recordings kept at least 30 days, and longer if you know of an open investigation or legal case |
| Failure alerts | An alert within 5 minutes of a camera system failure, by phone, email, or text |
| Backup alarm | A backup alarm that keeps working during a power outage, plus duress and panic alarms |
| Equipment tests | All security gear tested at least every six months |
| Camera room | Kept locked, used only for security, with a current list of who can enter |
| Reporting | Alarm failures expected to last more than eight hours must be reported to the state by the next business day (3VAC10-40-150) |
The draft adult-use rules add a few more things to plan around. Winners get about 18 months to open, and they must update their security information during that time. Drive-thrus are banned, but delivery is allowed (Marijuana Herald). For the full licensing process, see our guide on how to open a dispensary in Virginia.
Which Security Rules Are Most Likely to Change?
Some rules are almost certain from day one. However, others are the ones most likely to get stricter or more detailed over time.
| Very likely from day one | Most likely to change or get more detailed |
| Cameras in every cannabis area | How many days of video you must keep |
| Seed-to-sale tracking in Metrc | How sharp camera images must be |
| Products locked up when closed | Rules for delivery vans and drivers |
| Failure alerts and backup power | Rules for data and hacking risks |
| Limits on who enters cannabis and camera rooms | Local rules added on top of state rules |
The right column isn’t a prediction. It’s simply where state rules usually shift after launch. So that’s where your plan needs room to grow.
How Do You Build a Virginia Cannabis Security Plan That Adapts?
Use these five steps. Each one makes a future rule change cheaper and faster to handle.
1. Leave Extra Room Where Rules Usually Tighten
Build past today’s minimum in the places where rules tend to grow: storage, camera capacity, and cabling.
- Storage: plan video storage for well over 30 days. Then, if the rule gets longer, you change a setting instead of buying a new system.
- Camera capacity: pick a recording system with spare slots and licenses. That way, adding cameras doesn’t mean replacing the core system.
- Cabling: run extra cable to likely camera spots during construction. After the walls close, adding it costs far more.
2. Write Your Virginia Cannabis Security Plan in Layers
Split your plan into the parts that rarely change and the parts that will. Your security zones, restricted areas, and response steps are the stable core. Equipment, settings, and how long you keep video go in an appendix. As a result, a rule change means updating one section, not rewriting the whole plan.
3. Make Changes a Setting, Not a Project
Choose systems where common rule changes are just a setting. For example, you should be able to change video storage time, alert lists, user access, and reports. None of that should need new hardware. Ask every vendor: “If the state changes this rule, what do I have to buy?”
4. Build Flexibility Into Vendor Contracts
Your vendors need to keep up with rule changes too. Your contracts should say how fast your POS, camera, and alarm vendors will support new rules. They should also say what it costs. Also, anyone who sees your security design should sign an NDA, a promise to keep it private.
5. Keep Proof Ready
After all, inspectors want proof, not promises. So make sure you can quickly pull video with time stamps, door logs, and test records. Before opening, run a practice inspection. Ask for a clip from three weeks ago, a door log for the vault, and proof of your last alarm test. Then time how long it takes.
How Should You Handle Rule Changes After You Open?
Rule changes are easier with a routine. You don’t need a big team. Instead, you just need one clear owner and a few habits.
- Know your triggers. Watch for final CCA rules, new CCA guidance, and local law changes. The General Assembly also meets each January.
- Review after each one. What changed? Does it affect cameras, storage, alarms, door access, or procedures?
- Update the right layer. Most changes should only touch your equipment and settings appendix.
- Keep a log. Write down the date, what changed, what you did, and your proof (screenshots, invoices, or settings exports).
The first big trigger is coming soon. Final rules are expected in December 2026 and published in January 2027. Plan a full review of your Virginia cannabis security plan then.
What Should You Do Now, and What Can Wait?
Design now, but buy most of it later. Put your zones, camera spots, and cable plan into your building drawings now. Meanwhile, hold off on final camera counts, models, and storage settings until final rules are out. Spreading out your build also helps you avoid the 2027 rush, which we cover in Virginia’s 350-store rollout.
For the full list of tech choices to make now, prepare for, or hold, see our guide to Virginia’s draft rules and dispensary tech decisions. For everything else to set up before you open, see our Virginia dispensary setup checklist.
If you plan to deliver, your plan also needs to cover vans, drivers, and handoffs. See our guide to Virginia cannabis delivery tech.
How Can Cure8 Help With Your Virginia Cannabis Security Plan?
Cure8 designs, installs, and supports security and IT for cannabis businesses. We build systems that can handle rule changes. For Virginia stores, that means a plan based on today’s rules and gear with room to grow. We’ll also help you update both when the CCA makes changes. Talk to Cure8 about your Virginia security plan.
Frequently Asked Questions
What should a Virginia cannabis security plan cover today?
Start with Virginia’s medical rules. They require cameras in every area with cannabis. They also require at least 30 days of video and alerts within 5 minutes of a camera failure. Add a backup alarm that works in a power outage, and test your gear every six months.
Will Virginia’s adult-use security rules match the medical rules?
Final adult-use rules are expected in early 2027. Until then, the medical rules are the best guide. However, adult-use rules could add more.
How long do Virginia cannabis businesses need to keep security video?
Under current medical rules, at least 30 days. You must keep it longer if you know of an open investigation or legal case. The final adult-use rules will set the adult-use number.
When should I finalize my Virginia security plan?
Design it now. Then lock in equipment and settings after the CCA publishes final rules, expected in January 2027.