Article headlines proclaim California’s legalization of marijuana has led to the demise of the “Wild West” of weed. In many ways, this is true; dealing in cannabis was once a crime, but it’s now a legitimate and lucrative business and viable career option complete with benefits.
But there is a dark side to this booming business; a brand-new Wild West if you will. Though proponents of legalization argued the black market would dry up as legitimate cannabis businesses opened their doors, this has not been the case in California.
Trinity County’s undersheriff Christopher Compton reported in “Ending Weed Prohibition Hasn’t Stopped Drug Crimes,” in the Jan/Feb 2019 issue of The Atlantic, “We haven’t seen a drop in crime, whatsoever. In fact, we’ve seen a pretty steady increase.” His counterpart in Mendocino, Matthew Kendall, agreed, telling The Atlantic, “We’re seeing more robberies and more gun crime.”
Matt Carroll, owner of Carroll Security Consulting, reports these comments are not surprising; criminals are attracted to the cash and crops of these legitimate businesses.
He explains, “You’re dealing with a product that was born and raised in a black market, and these crime networks are very established. While cannabis is legal in California, and sells for approximately $1,500 a pound, if you take that same pound to a state where it’s illegal, it’s just tripled in value.”
A decade ago, criminals grew their own crops in remote areas and harvested them once a year, according to Carroll. Today, he says, they target legitimate cannabis businesses to rob them of their products and profits. “It’s far less labor intensive,” he says.
Carroll leverages decades of private security and public law enforcement experience to help emerging cannabis businesses and local governments develop successful and cost-effective cannabis security programs.
In this role, he advocates for aggressive security standards for licensed cannabis operators but reports the regulatory waters for securing these businesses are murky at best.
Competing regulations at the state and local levels, he says, make it difficult for cannabis businesses to know exactly what they need to do to keep their crops and cash safe from those intent on stealing them.
He issues a word of caution to those catapulting into the cannabis business: “Take your time. Don’t rush into anything. Get the lay of the land and see what the processes are for the local municipality you hope to start up in.
Then spend the money to secure your business properly. You’re going to spend the money one way or another. It’s just a question of whether you’re going to spend it on proactive security measures or react after crimes occur.”
The Rules of California Cannabis Security
To capitalize on the opportunities cannabis presents, investors must learn to navigate the Golden State’s complex rules and regulations about growing, distributing and selling cannabis.
The first thing to understand, reports Carroll, is there are three governing bodies for cannabis at the state level, and each has its own area of purview.
- The California Department of Food and Agriculture (CDFA),
- The California Department of Public Health (CDPH), and
- The Bureau of Cannabis Control (BCC).
The CDFA oversees cultivators. This organization does not require cultivators to submit a security plan to obtain a state license.
Meanwhile, the CDPH’s Manufactured Cannabis Safety Branch has established security requirements for cannabis manufacturers. These requirements are outlined in the California Code of Regulations, starting with §40200 Security (page 44).
This organization requires cannabis manufacturers to comply with local ordinances as well as state law. “So, in addition to these state regulatory requirements, they must be aware of and abide by any applicable requirements established by their local jurisdiction,” reports a CDPH spokesperson.
The CDPH regulations require cannabis manufacturers to develop and implement a written security plan addressing, at minimum:
- Preventing access by unauthorized persons.
- Protecting physical safety of employees.
- Preventing against theft or loss of cannabis products.
- Securing electronic records to prevent unauthorized access and backing up electronic records to ensure integrity of information is maintained.
- Also, cannabis manufacturers must install and operate a video surveillance system on their premises to record areas in which cannabis or cannabis products are stored, prepared or moved and at the facility’s entrances and exits.
“Failure to maintain required security equipment/processes could result in a corrective action, notice of violation, and/or an enforcement action on the business,” reports the CDPH spokesperson.
The BCC is the lead agency in regulating commercial cannabis licenses for medical and adult-use cannabis in California. This organization is responsible for licensing retailers, distributors, testing labs, micro-businesses and temporary cannabis events.
Like the CDPH, the BCC details some security elements in its regulations. For instance, when applying for a license, applicants must provide a complete and detailed diagram of the proposed premises, showing all boundaries, dimensions, entrances and exits, interior partitions, walls, rooms, windows and doorways.
Applicants are also required to include a brief statement or description of the principal activity to be conducted on-site. This diagram also must show where security cameras will be located.
California Cannabis Security Compliance For Micro Businesses
One area of confusion Carroll has seen is when an entity applies for a micro-business license through the BCC, which allows them to engage in three or more licensed activities under one roof.
“You could have a cultivation operation, a manufacturing operation and a distribution operation operating under one roof,” he says. “These folks fall under BCC regulation, but they have to comply with all sets of rules (with other regulatory bodies) because they’re engaging in cultivating, manufacturing and distribution.”
He says these entities get far down the rabbit hole then find out that while their security plan might meet BCC requirements for distribution it does not meet CDPH regulations for manufacturing. “Each license has to be, in essence, treated like a standalone business separate from the others,” he says.
The other issue is though the state regulatory agencies have set a basic framework for security, it’s very limited. “The approach has been to barge in, establish a limited framework for security, then allow local jurisdictions to choose to create further regulation if they chose to,” he says. “What is required of commercial operations, as a result, can vary tremendously on the security side depending on the city or county they are choosing to start their business in.”
When one considers the variety of security regulations surrounding just the use of surveillance cameras, it’s easy to see how complicated things can be.
A state regulatory body might require 1-megapixel cameras while local regulations set the bar at 80 megapixels. Though the state requires less, businesses are required to meet local regulations too.
What to Include in Your Cannabis Security SOP
Applying for a license, whether cultivating, manufacturing or distributing, requires operators to have a security SOP (standard operating procedure). But this document isn’t just important for getting a license, it’s also essential for protecting a cannabis operators’ assets.
As illustrated above, cannabis companies deal with tons of cash and a valuable product, making them ripe targets for crime. Along with a viable business opportunity comes huge potential for diversion, theft, loss and other illegal activity.
When businesses apply for a license, they will be asked about how they will build out their facility to keep employees, products and the community safe. The following areas should be considered in every security SOP:
- The types of alarms, access control, surveillance cameras, lighting and perimeter security
- Record-keeping security processes
- Security personnel or armed guards
- Ingress and egress security
- Employee background screening processes and employee identification
- Limited access areas
When it comes to technology, there are four primary elements to a viable security program for cannabis businesses: Cameras, Access Control, Burglar Alarms, and Structured Cabling. Each is critically important and will be covered in an upcoming blog.
California Law for Video Surveillance of Cannabis Operations
In the past, cannabis sales were not necessarily associated with rule following. But today, with the legalization of marijuana, there are strict rules for cannabis operations, all of which must be followed to comply with State of California laws and local municipality regulations.
Here is a brief summary of the rules pertaining to video surveillance of cannabis operations in California.
The State of California requires video surveillance in the following areas of a cannabis operation:
- Wherever cannabis goods are weighed, packed, stored, loaded and unloaded for transportation
- prepared or moved within the premises
- limited-access areas
- security rooms
- areas storing a surveillance-system storage device with at least one camera recording the access points to the secured surveillance recording area
- entrances and exits to the premises, which shall be recorded from both indoor and outdoor vantage points.
The state also requires retailers to record point-of-sale areas and areas where cannabis goods are displayed for sale. With these systems, cameras must be able to clearly record the facial features of any person purchasing or selling cannabis goods, or any person in the retail area, to help authorities determine identity.
In addition:
- Cameras on the premises must have a minimum camera resolution of 1280 x 720 pixels.
- The surveillance-system storage device or the cameras themselves shall be transmission control protocol (TCP) capable to make them accessible via the Internet.
- The video surveillance system must always effectively and clearly record images of the area.
- Each camera must be permanently mounted and in a fixed location.
- Each camera must be placed in a location that allows it to clearly record activity occurring within 20 feet of all points of entry and exit on the licensed premises.
- The cameras also must be capable of clearly and certainly identifying any person and activities in the area being filmed.
- Cameras shall record continuously 24 hours per day and at a minimum of 15 frames per second (FPS).
- The physical media or storage device on which surveillance recordings are stored shall be secured in a manner to protect the recording from tampering are theft.
- Surveillance recordings shall be kept for a minimum of 90 days and stored in a manner that allows regulatory bodies to review them upon request.
- Recorded images shall be time and date stamped.
- The system must be equipped with a failure notification system that notifies the licensee of any interruption or failure of the video surveillance system or storage system.
IP Cameras for Cannabis Security
The law requires cannabis operations to install a robust and comprehensive video surveillance system. This begins with the selection of Internet Protocol (IP) cameras.
But first, what is an IP camera?
The simple definition is an IP camera is small computer that receives control data and sends image data via the Internet. These digital video cameras are commonly used for surveillance.
IP cameras offer higher frame rates than their analog counterparts, work well in areas with a lot of motion and in situations where high detail is needed. They produce sharp images and allow users to focus and zoom in remotely.
Today’s smart IP cameras also leverage advanced video analytics to help operators detect, verify and act on events. Video management software (VMS) for IP cameras can be installed on a camera, on the NVR, or work as a separate software system.
Each version’s analytic capabilities can be used for motion detection, facial recognition and license plate reading, and even people counting and dwell time monitoring.
When selecting an IP camera for cannabis operations, it’s important to select one that meets state requirements. This means the IP camera must offer a minimum camera resolution of 1280 x 1024 pixels. The state also requires they have a minimum of 720p resolution and a minimum of 15 frames per second.
A 1-megapixel camera is all that’s typically required to meet state standards, but Matt Carroll, owner of Carroll Security Consulting, reports it’s not enough.
“The 1-megapixel rating for a camera mounted within 20 feet of the doors means absolutely nothing in terms of video quality,” he explains. “What you need to be more concerned with is pixels per foot at the focus point of the camera.
While the camera may be positioned to view a door somewhere in the viewing frame, chances are it’s viewing a lot of additional things. The viewing angle is much wider, much broader and that 1-megapixel rating is going to be spread across the entire side of the building.”
Some local municipalities require more. Sacramento for example mandates using 2-megapixel cameras. But, if a cannabis operator is interested in having high quality video footage of persons and property entering and leaving a facility, Carroll advocates for 8 megapixels per foot at the point of focus.
“You have got to have enough detail in the imagery to be able to identify a person so you know who they are,” he says. “You need to be able to see their face, clothing, shoes and things like that. Most operators have at least 5-megapixel cameras throughout their facility.”
Tying Your Cannabis Security System Together With A Video Management System (VMS)
VMS enables users to record and view live video from multiple surveillance cameras. It can be either appliance- or Windows-based, depending on the manufacturer, and used with either IP-based or analog cameras with an encoder. Whether appliance or server based, VMS typically operates on a Windows-based platform.
The primary difference between the two is an appliance-based system, even one with software on it, is essentially a system used to record and later review video. Such a system lacks advanced features, and will not integrate with other systems in play, such as an access control system.
A server-based VMS, however, acts as a building block for a total security management solution that includes video, access control, analytics, burglar alarms, communication systems, motion detection, trigger alarms and more.
Plus, if a cannabis operator has multiple sites, with VMS in place he can toggle between multiple locations in one interface. Server-based VMS may seem like overkill until one considers the ability to check license plates, faces as they come and go, and create alerts for certain situations.
VMS also helps cannabis operators meet state requirements, which mandate remote access to surveillance systems used by cannabis operations.
“Server-based VMS is just more purpose built for video,” reports Patrick Chown, president of Safe and Sound Security Inc. “It’s going to be smoother. It’s going to be better for connecting access control with your system. You can manage all parts of your video surveillance system, and all locations, in one place.”
Video Monitoring vs. Security Guards
Today’s smart cameras can make it seem like they are the less expensive option for securing a cannabis operation, but the truth is that while video can be a deterrent and help solve crimes after they occur, a hybrid approach using both video and live monitoring can be far more effective.
“Cameras are great, if you want to pop some popcorn and watch a movie of a crime that already happened, but I’ve yet to see one climb off its mounting pole and intervene in a crime,” Carroll jokes. “On the flip side, cameras that are only live monitored, where someone is watching them, are also a problem. After 20 minutes a human being isn’t really paying attention.”
But installing smart IP cameras with VMS analytics capabilities and including 24/7 live monitoring is the best of both worlds. It speeds up response times and ensures incidences are captured and dealt with.
If budget allows, cannabis operations should consider employing an external monitoring company to keep constant watch over video feeds. These services can quickly respond to incidents in real-time, and dispatch emergency personnel as necessary.
Video Storage for California Cannabis Security
Another consideration pertains to storage. California law requires cannabis dispensaries and cultivators to maintain video footage for at least 90 days, and the storage requirements are enormous.
California mandates cameras be placed in both indoor and outdoor locations and operate continuously; motion detection cameras are not allowed.
Two options exist for video storage: on-premise and in the cloud. To choose between the two, users must consider the resolution their cameras record at and how long they are storing the video.
Hardware storage is often a good option, unless an operator is worried about theft of the hardware itself. If someone steals that server and makes off with it, they take all that footage and data with them.
For this reason, the State of California requires securing the physical media or surveillance video storage device in a way that protects recordings from tampering or theft.
Upon consideration, many cannabis operations don’t opt for cloud storage. The No. 1 reason for this is typically cost.
Most cloud storage options carry a per camera, per month cost that can range from $40 to $60 per camera. If an operation has 200 cameras and is paying $60 per camera per month, that’s $12,000 a month or $144,000 per year.
Over a decade, that adds up to $1.4 million. Clearly, it can be more cost effective to purchase and maintain an on-site storage system.
“Most of our customers are not going to do the cloud. They are not going to spend that much money,” says Chown. “We give them options. We talk about the prices and the storage requirements, and really consider what is best for their application.”
The second reason to opt for an on-premise storage solution is the bandwidth needed to transmit data to the cloud. If a cultivator or dispensary operation exists in an area with an Internet connection capability of transmitting 50 megabits per second, it’s not an issue.
But in most cases, cannabis operators set up shop in remote areas where bandwidth is limited and transmitting video to on-site storage is the only option.
Whenever on-site storage is used, however, California law requires video footage be kept in a secure locked room that is only accessible to authorized personnel.
Taking Plant Height & Infrared Light Into Consideration
Security cameras at cannabis operations must be placed in a way that prevents tampering or obstruction, in other words, high enough off the ground to avoid tampering and in covert areas to avoid detection. But plant height also must factor into decisions about where to place cameras.
Plants might be 4 inches tall when the cameras go in but will grow to 6 feet tall in a couple of months. If their mature height is not considered in design, the plants will eventually block camera views; opening the door for someone to enter the room and steal what they want, and the crime to go undetected.
It’s important to consider how the facility will operate, where the traffic will be, where the plants will be, and the height of those plants at maturity when placing cameras.
Also, should infrared surveillance cameras be used, it’s important to weigh its use against infrared’s impact on the plants themselves. Infrared is outside the range of light visible to the unaided human eye, but it can be seen by plants and may impact how they grow.
Scientists believe too much infrared light, especially in the far-red end of the spectrum, may damage cannabis plants. Heat from infrared may discolor or kill them, as well as cause them to experience early growth spurts that reduce their health or encourage them to flower too soon.
With that in mind it’s best to limit infrared camera use in grow operations, and only employ the minimum number of infrared cameras needed for security purposes.
Specifications may not consider plant height or infrared’s impacts, but knowledgeable integrators should, according to Chown. “Compliant doesn’t mean you’re operating at peak levels,” he says. “If your security partner doesn’t understand how you are running your business, they can get you compliant but that doesn’t mean your system is going to work.”
Next week’s blog will consider access control, while not a requirement for cannabis operations, it’s a very important consideration.
Access Control Systems for California Cannabis Security
California’s Code of Regulations for cannabis operations requires that licensure applications detail how operators plan to secure all access points to the premises.
The regulations mention surveillance cameras, burglar alarms and security guards, but little is noted about access control systems.
In fact, the state simply requires walls separating limited access areas from common/exterior areas, supplemented by commercial-grade locking doors and access patrol policies relating to limited access areas.
“While logging of persons accessing video files is required, the state largely leaves specifics of access control infrastructure and practices to the local authorities to govern,” states Matt Carroll, president of Carroll Security Consulting.
However, even if it’s not required by law, access control is a critical component of a complete cannabis security plan. Without it, cannabis operators leave their operations vulnerable to crime and diversion of their products.
Implementing an access control system limits access to the cannabis operation by managing who can access sensitive areas.
Access control protects the safety and security compliance of the cannabis product, intellectual property and confidential business information, and business assets from bad employees.
Access control keeps intruders out but also maintains an audit trail should the system be breached.
Employee Access
Two points—one high tech and the other low tech—must be addressed in every access control plan, reports Carroll, who states the greatest threats are typically internal, coming from the employees themselves.
For this reason, every solid access plan begins with one that considers employee access. Installing access technology supplements this effort.
The state requires that only stakeholders undergo a background check. But for optimal security, all employees require a background check to ensure they are not career criminals with a record for violent crimes and theft. “You cannot scrutinize employees enough,” Carroll stresses.
Facility design considerations comes next. “Design the premises in a thoughtful manner that keeps workers in various job descriptions confined to areas of the premises consistent with those duties, and only those duties, is where you start,” advises Carroll.
For example, within a processing facility, a secure screening area where privilege to access the facility, and to what extent, is verified and accommodated is the first room employees should enter.
Here, employees must show credentials that demonstrate they are authorized to access the area. The next room in the processing facility, should be a break/room restroom area, followed by the processing room itself.
Cultivation operations, meanwhile, present a new set of problems. The trimmers in these operations are often part-time, on-call and seasonal employees.
Often, cultivators fail to conduct adequate pre-employment screening of these employees, even though they “handle copious amounts of ready-for-consumption products,” states Carroll, who adds, “The potential for diversion and crimes accomplished through insider intelligence is high within this work group.”
These facilities must be designed in a way that prevents employees from gaining direct knowledge about anything else beyond the room in which they work.
They should not know where cultivation, storage, drying, security, loading, vault or other areas are; or how these areas are enforced and monitored.
“Limiting this intelligence promotes target hardening and lessens the ability of this work group to misappropriate intelligence toward burglaries, robberies or other crime,” he says.
Employers also should segregate employees by work group, giving each group separate breakroom and restroom areas. This prevents comingling of employees who work in different aspects of the business.
“When large work groups with distinct access rights are comingling during personal time, the potential for relationships with nefarious intent and conspiracies can easily develop,” he adds.
He also recommends scheduling distinct work groups in a manner that reduces or eliminates the potential for workers in these groups to meet. Strict policies, for example, prohibiting excessively early arrivals and lingering on the premises after hours should be enforced.
Finally, cannabis operations should develop whistleblower protections. Studies on internal theft demonstrate an “immense, and even paralyzing, stress that good employees suffer when put in the position of whistleblowing,” states Carroll.
“An anonymous reporting system with assurances toward confidentiality are critical. And by keeping work groups distinct, the personal bonds that keep internal crimes concealed are diminished. Employees are more likely to report concerns when they are not closely aligned with the suspected worker, and where protective policies encourage whistleblowing.”
4 Access Control Technologies to Choose From
Savvy cannabis operators also understand that a thoughtful access control strategy might begin with premises design and effective and enforced employee policies, but it also requires a state-of-the-art, auditable, electronic access control system.
It’s important to hope for the best while planning for the worst. Here, a variety of access control measures can be implemented to ensure reliable and comprehensive access control.
There are four primary methods of securing a facility, each having its own benefits and disadvantages.
Hard Keys
The traditional metal key and tumbler is one route you can take, but you get what you pay for. This may be the cheapest route, but hard keys are easily lost, stolen, misappropriated and duplicated.
Some companies place a do-not-duplicate stamp on each key, but Carroll refers to this as a “feeble measure toward preventing duplication. A hard-key system cannot be effectively audited, enforced or relied upon to keep unauthorized persons from restricted areas.”
Code-Punch Locks
Some systems provide unique user codes as a matter of policy. While some allow for direct downloading of user data for auditing purposes, these systems are prone to code sharing, dead batteries, and wearing of numerical keypads that hint at the characters of frequently used codes.
One misappropriation of a code is all it takes to eliminate the accountability these auditing features are intended to prevent, according to Carroll.
Cards and Fobs
These systems bring cannabis operators into the realm of intelligent access control. But they too carry risk.
The typical card/fob-driven access control system will incorporate software that allows certain cards/fobs to access specific areas, and then only during days and hours consistent with the work schedule and duties of the employee to whom they are issued.
This provides a heightened level of access control and offers a strong level of auditing, but these systems still leave the potential for lost, stolen and misappropriated cards and fobs.
Carroll recommends not allowing employees to take their credentials off-campus. Cards and fobs should be stored in a safe that only managers can access. Fobs/cards must be diligently programmed to provide only the degree of access necessary for the employee to whom they are assigned.
Employees should be required to sign for receipt and return of their access card. Daily accounting of cards and fobs should be done by a manager, and policies requiring individual “badging in” at each checkpoint should be mandatory in the employer’s policies (e.g. Employee B should be required to scan their card/fob at a control point even if they are entering that area simultaneously with Employee A), according to Carroll.
Biometric Access Control
This is becoming increasing popular and achievable. Modern access control systems utilize fingerprint and retina scans with a high degree of success.
“These systems eliminate the need for physical credential accounting and the potential for the loss, theft or misappropriation of physical access credentials,” states Carroll. “This is by far the most cost-effective and least cumbersome access control approach, affording fewer opportunities for credential misappropriation and the utmost in employee accountability. Biometric access control makes it pretty hard for an employee to claim their credentials were misappropriated; short of this claim’s accompaniment by missing eyes or fingers.”
Integrate Access Control into Video Management Software (VMS)
Employing a VMS system to manage the surveillance camera system enables users to record and view live video from multiple surveillance cameras.
It can be either appliance- or Windows-based, depending on the manufacturer, and used with either IP-based or analog cameras with an encoder. Whether appliance or server based, VMS typically operates on a Windows-based platform.
A server-based VMS is optimal because it acts as a building block for a total security management solution that includes video, access control, analytics, burglar alarms, communication systems, motion detection, trigger alarms and more. Plus, if a cannabis operator has multiple sites, with VMS in place he can toggle between multiple locations in one interface.
For integration to occur, however, the access control system also needs to have an open architecture that enables it to interface with the VMS.
Integrating the access control system into the VMS enables cannabis operations to access data and link it to different security cameras in the facility.
It allows centralized management of the entire facility’s security operations and improves situational awareness.
Should an unauthorized access occur, authorized personnel will not have to dig through thousands of files and video footage to find this information.
Cannabis Burglar Alarms: Start With An ACO Provider
It’s hard to imagine a warehouse with $1 million worth of Vicodin inside lacking a complete security system. That warehouse would be buttoned up like a fortress with the latest in surveillance cameras, video analytics, access control and intrusion alarms, and just for good measure, a couple security guards standing outside.
A similar warehouse with $1 million of cannabis inside may be noticeably less secure. California law for these operations requires a level of security like that legislated for tobacco or alcohol, though the cannabis product is worth far more, especially on the black market where its value triples once it crosses state lines.
But burglar alarms represent one area of protection where security requirements are improving. The law requires cannabis facilities be secured and protected by intrusion (burglar) alarms at entrances, exits and around the perimeter.
The state also mandates that these systems include door and window contacts in the case of break-ins, glass-break detectors in case of smashed windows, and motion detectors in case an intruder gets inside.
The Bureau of Cannabis Control (BCC) asks cannabis business applicants to provide the name, license number, address, phone number and contact person of the alarm company that will install, maintain and monitor the alarm system.
The BCC also requires applicants to detail how they will ensure the alarm system remains operational and how often the alarm company will perform maintenance checks.
In addition, the applicant must describe the alarm system’s features, including whether it has motion detection sensors inside the premises; and to detail how they will respond to an alarm, and whether law enforcement personnel will be notified.
The key to addressing these concerns is hiring a reputable alarm system provider. The BCC wards against the use of less-reputable alarm system installers, or installing your own alarm system, by mandating that cannabis operations use an (Alarm Company Operator) ACO-licensed installer.
“There are alarm companies out there that people run off their cell phones from their living rooms,” states Matt Carroll, owner of Carroll Security Consulting. The ACO distinction helps cannabis operations find certified operators who have passed a minimum standard for licensure.
California’s Bureau of Security & Investigative Services details that an ACO is a licensed individual(s) that operates a business that sells, installs, monitors, maintains, services or responds to alarm systems or supervises such actions.
For a company to seek licensure as an alarm company operator, the qualified manager must have passed the licensing examination. In addition, each individual applicant, partner or corporate officer must undergo a criminal history background check through the California Department of Justice (DOJ) and Federal Bureau of Investigation (FBI), and have committed no offense or violation of the Alarm Company Act that would be grounds for license suspension or revocation.
ACO’s also must maintain a general liability insurance policy with a minimum general aggregate liability limit of $1 million for initial licensure and must have the required insurance in effect at the time of license renewal and for the continued maintenance of the license.
If the ACO has more than five managing members, the insurance coverage requirement increases by $100,000 for each additional member, up to a maximum required amount of $5 million.
Get a UL-Certified System
The Underwriters Laboratory (UL) is a global safety certification company headquartered in Northbrook, Illinois. This company looks at the safety of everything from children’s toys to the components in a computer system.
It also certifies alarm systems, where its standards are far reaching; down to the wire nuts used to make electrical connections. Here, the materials used must be reliable and protected from corrosion.
UL Standard 681 pertains to intrusion alarms. This standard describes the proper steps for the installation of protective wiring and devices for burglar alarm systems covering premises, stockrooms, closed areas, vaults, night depositories, automated teller machines and other security containers. The standard presents different levels of security for operations that vary from a cannabis business to a residential apartment.
Each local municipality also puts forth requirements for cannabis businesses to follow. The City of Sacramento, for example, requires cannabis operations to install an alarm system with a valid UL certificate in accordance with ANSI/UL Standard 681-2014 (Standard for Installation and Classification of Burglar and Holdup Alarm).
This standard requires contacts on every opening in the facility, glass-break sensors on anything with glass, and motion detection within the facility. It also mandates the alarm system provider to provide back-end technologies that perform communications checks on the system several times a day. The standard also requires cellular backups. In addition, it mandates that installers be UL-licensed installers.
Adhering to these stringent requirements protects cannabis sites from poor intrusion alarm installations. “Without a system like this in place, someone can yank a wire out of the wall, and suddenly that door contact, that alarm system, doesn’t work anymore,” Carroll says.
“People then say, ‘Oh, we’ll fix it.’ But suddenly, it’s two years later, and it still doesn’t work. These things don’t happen with a UL system because the premises must be inspected annually to make sure everything is running the way it is supposed to. And, the backend technologies are constantly monitoring that all components comply.”
And, because the monitoring stations themselves are held to a high standard, they are inspected and tested regularly. “It’s not a local friend’s alarm company doing it, where if he happens to wake up and hear his cell phone go off, he responds,” Carroll says. In contrast, a UL-certified monitoring station keeps close watch and receives an alert immediately when an intrusion occurs.
UL-certified systems also mandate a better response time when alarms do occur. According to Carroll, for many alarm companies, a one-hour response time is considered acceptable. But most UL-certified monitoring companies provide a response service or contract with a response service that responds in less than 20 minutes.
Careful With Cellular Monitoring
Alarm company monitoring systems may include Internet-based monitoring tools. These interactive controls enable the arming and disarming of the system, provide system status and status history, and send alerts.
They allow users to monitor their facility from a mobile device and even to access a video feed coming from the facility. But before cannabis operations agree to this type of interactive control, the State of California Department of Consumer Affairs recommends checking to see whether the alarm company provides firmware, an encrypted network or a strong firewall to prevent hackers from obtaining access to the alarm system. If a site is not secured properly, the system can be hacked.
An intrusion alarm system is a necessity for every cannabis operation. It is the best decision a cannabis business owner can make to prevent theft of its products and profits.
But when installing a burglar alarm system remember that all burglars alarm systems are not created equal and neither are those who install and maintain them. It pays to get professional help and make sure that help comes from an ACO- and UL-certified installer. It’s not only good for business, but it is the law.
