Note: This post was updated on August 2023 with new information on cannabis threats and effective solutions to counteract them.
This is a comprehensive guide to the inherent risks associated with the cannabis sector and the efficacious ways in which they can be counteracted.
Find a topic covered in this blog:
Legality of marijuana by U.S. jurisdiction
The U.S. cannabis industry is rapidly growing and expanding. Yet, it remains illegal at the federal level, for any purpose, as dictated by the 1970 Controlled Substances Act (CSA), which classifies it as a Schedule I substance.
Schedule I drugs, substances or chemicals are defined as drugs with no currently accepted medical use, a high potential for abuse, and a lack of accepted safety for use of the drug under medical supervision. No prescriptions can be written for Schedule I substances.
Heroin, lysergic, acid diethylamide (LSD), marijuana (cannabis), methylenedioxymethamphetamine (ecstasy), methaqualone, and peyote are drugs in this category.
However, in the United States, the regulatory environment for cannabis is decentralized and requirements vary by state. As stated in the Rohrabacher-Farr Amendment, a historic win in the legal protection for medical marijuana patients, the U.S. Justice Department is prohibited from spending any funds on actions designed to interfere with the implementation of state-level medical cannabis laws, including the prosecution against private individuals or entities.
Although the amendment has become a central component of the defense of cannabis producers, processors, retailers, transporters, and others in the legal cannabis industry, it does not change the legal status of cannabis and must be renewed each fiscal year in order to remain in effect.
The exponential growth of the cannabis industry has been, in part, provoked by its mass legalization across the country. Today, the medical use of cannabis has been legalized in 40 states. The recreational or adult use of cannabis has been approved in DC and 22 states.
By the same token, some cannabinoids or cannabis-derived compounds have been approved by the FDA for prescription use, including Marinol (THC), Syndros (THC), Cesamet, and Epidiolex (CBD).
The infographic below lists the states that have legalized marijuana for medical use and recreational use.
As the Green Rush becomes more profitable and popular, security is a crucial consideration for facility owners, managers, and consultants. Choosing the wrong security system or provider, unskilled in the distinctive needs of the marijuana businesses, can generate devastating consequences.
A poor security environment
An effective, robust security system is capable of supporting breeders, cultivators, manufacturers, and dispensaries and helping them address important pain points by:
- Eliminating security vulnerabilities and increasing strategic protection against crime.
- Helping the marijuana sector comply with unique state and local policies.
A high-risk tolerance level from managers and entrepreneurs is common and can lead to a weak security environment that welcomes crime.
Lawbreakers are attracted to the high-value product and the large amount of cash often available in dispensaries and cultivation sites. Without the appropriate security system, the most valuable assets, which can be either the plants or the dry storage, are left unprotected.
For instance, even when your business has a video surveillance system in place, cameras often cover just a portion of the building and not the entirety of the site, plus, they might be obsolete. Unmonitored areas unnecessarily expose your operations to criminal activity and theft.
The professional integration of IP-based video surveillance, access control, and intrusion detection solutions can mitigate multiple threats and deter people from committing a crime.
A comprehensive security solution should:
- Regulate access to marijuana products with sophisticated access control systems.
- Improve monitoring by having a smart, and strategically placed, video surveillance system.
- Use RFID tags, integrated with video, to track inventory during the handling, storage, and transportation of marijuana.
- Provide real-time notifications to owners and managers.
- Offer physical perimeter protection advice: fences, concrete bollards, and strobe lights.
- Utilize the strategy of Crime Prevention Through Environmental Design (CPTED) to support the above measures.
One of the most important threats to eliminate is theft. Both internal and external.
According to the Marijuana Business Daily, about 90% of financial and product losses in the marijuana industry can be attributed to employee theft. Without the correct technology, businesses will be destined to fail.
In order to avoid that, it is essential to hire personnel carefully and make sure every employee is vetted, and their background checked. In addition, access control should be professionally integrated with video surveillance to guarantee unauthorized access is impossible.
Moreover, by using a cloud-based system, wireless hubs, and specialized devices, access to the building can be safer and more effective. Other solutions and best practices include improved trash handling and employee verification protocols, structured check-in and check-out processes for each room and shift change, as well as supplying employees with company-issued work attire that is worn during work hours and stored on-site.
Non-compliance
States have enacted particular Green Rush regulations for the approval of cannabis business operations. This means that failure to comply with those rules can result in the loss of your license and even the closure of your marijuana establishment. Most of states require exhaustive security plans for each of these processes:
- Inventory tracking of all marijuana and marijuana products on the premises.
- Employee qualification and training.
- Waste disposal.
- Transportation and delivery of marijuana and marijuana products.
Likewise, cannabis operators must perform regular audits to detect and address any security gaps. It is also important to work with an experienced security integrator familiar with the Green Rush in your location, as regulations and requirements vary by state.
The cannabis environment is unlike any other security environment. Video directives might include seed-to-sale visibility, cameras pointing to any place marijuana may grow or travel, specific number and placement of cameras, quality of video footage, the length of time recorded footage is stored for, and 24/7 monitoring of video feed.
If your security partner is uneducated about these guidelines, they may fail to follow the requirements exactly and lead you to poor compliance and expensive fines.
Although some states have strict regulations, others can be general on certain key points, like the quality of camera images or the specific video storage requirements. That’s why doing the bare minimum is often not enough. Instead, we suggest that you create a security environment thinking of your profitability, safety, and protection first, rather than solely focusing on compliance.
Cybersecurity concerns
Cannabis organizations have been affected by cyberattacks and data breaches on several occasions. Since this sector is experiencing an accelerated expansion, it has become a recurrent target of cybercriminals who attempt to:
- Get the business customers’ and employees’ personally identifiable information, including medical diagnoses, credit card data, banking details, and other sensitive documents.
- Sabotage operations and deliveries to marijuana shops and customers.
- Affect in a negative way the marijuana supply chain, including smaller operators and patients.
Through credit card theft, misuse of personally identifiable information, ransomware, and industrial espionage on trade secrets of cannabis businesses, cybercriminals are evolving and becoming more sophisticated every day.
There are several reasons why the Green Rush is now being attacked. Firstly, the cannabis industry is new, which comes with unawareness, misinformation, and confusion. Owners and operators are still in the process of identifying major security threats, implementing effective solutions to eliminate them, foreseeing an unpredictable future, and partnering with the right security integrator.
All of these factors are seductive opportunities for cybercriminals, who see cannabis businesses as novices, compared to more mature sectors, such as healthcare or banking.
While the profitability of your business is at risk with cyberattacks, we should also consider the danger they pose to patients if their data is stolen.
To protect your marijuana organization against a cyber attack:
- Build an effective defense from the beginning by conducting a thorough risk assessment
- Create an incident response and remediation plan to handle attacks, from early detection to recovery.
- Offer your employees comprehensive security training so they can recognize their responsibility in preventing a cyber attack by practicing good cyber hygiene and identifying online scams, phishing attacks, and social engineering tactics.
Moreover, physical security is fundamental to minimizing cyber risks. By limiting access to spaces where data is stored and elevating the monitoring capabilities of your site, you can reduce the exposure of sensitive company data to cyber thieves.
The idea of legalizing marijuana is gradually becoming widely accepted by state legislators and consumers. This "green rush” has prompted a multibillion-dollar business that is continuously increasing. Choosing the right security system in California, Oregon, Oklahoma, Montana, Colorado, Alaska, Arizona, Florida, Maine, and Massachusetts, is fundamental to keeping marijuana businesses open and effectively functioning.