A new Illinois law that legalizes recreational, or adult-use, marijuana is set to go into effect on January 1, 2020 and will make Illinois the 11th state to legalize the sale of recreational marijuana. Eligible individuals have been able to purchase medical marijuana in Illinois since 2014, when then-Gov. Patrick Quinn signed into law the Compassionate Use of Medical Cannabis Pilot Program Act. While the latest legislation is still working through some kinks and controversy, it is set to reshape the landscape of marijuana access across the state. As recreational dispensaries gear up to finalize their applications, security is one of the critical operational topics that applicants will need to be well prepared to address.
Marijuana Dispensaries Have to Manage Elevated Security Risks
Cannabis dispensaries are subject to the same security risks as other retail business, but those risks are significantly higher given the nature of the business, as well as the street value of what is still considered a Schedule I drug by the U.S. federal government.
These security-related risks include:
- Theft and robbery – Since black-market marijuana doesn’t seem to be going away anytime soon, theft and robbery should always be at the forefront of any dispensary’s security plan. Dispensaries face both the risk of passive theft by an employee or customer making off with product while someone’s back is turned or aggressive, smash-and-grab robberies that can involve deadly weapons.
- Cyber attacks – When Canada legalized recreational marijuana in 2018, it focused security regulations primarily around data protection. Some may say that with crime rates that pale in comparison to the U.S., it would make sense for our neighbor to the north to focus on cyber-related security. But, in fact, dispensaries in any part of the world should. As more mature businesses harden their cyber defenses, hackers set their sights on smaller businesses that aren’t as well protected or trained to recognize and preempt an attack. Given the value of dispensaries’ products, they are more vulnerable than many other types of businesses to inventory hacking. Plus, most state regulations require internet-based surveillance and alarm systems: yet more entry points for a would-be hacker.
- Transporting cash or other items – Entire ecosystems have been created to support the security needs of marijuana dispensaries and growers, but none may be so interesting as transportation. Unlike your local grocery store, shipments can’t just arrive on a semi-truck with product images and taglines across the side. Armored trucks similar to what you might see at a bank are often the vehicle of choice to transport goods and funds to and from the dispensary. And much like bank trucks, they’re typically driven by armed guards. Because marijuana is still federally illegal, the cannabis industry doesn’t have access to many modern banking options that other businesses do. It’s an all-cash industry that takes a lot of risks simply making deposits and trying to operate, financially, like the legal business it is.
- Properly – or improperly – trained staff – No matter who the staff is – the budtender working behind the counter or the armed guard monitoring surveillance systems – if they are not properly trained, they can create vulnerabilities that can be hard to counter even with advanced physical and technical security measures in place.
Addressing Dispensary Security Risks Head On
Despite the legality of selling marijuana to the public, officials are certainly aware of the security risks of selling what is still considered an illicit drug on the federal level. This is why dispensaries need to meet a variety of security requirements to remain in compliance with state regulations. These regulations vary by jurisdiction and can address seemingly minute specifications for security equipment. For example, many states have specific requirements for video surveillance, including minimum camera resolution, minimum frames per second for recording, 24/7 usage, and archiving video footage for at least 90 days, if not a year. State regulations also define minimum requirements for access control, alarm systems, storage, transport, armed guards and other security measures.
A bit of good news is that the same security best practices that the Hillard Heintze Security Risk Management experts help clients implement in other industries translate to the cannabis industry. In addition to cannabis-related businesses, we do extensive work with other ‘high-risk’ industries that are also under the scrutiny of state and federal regulators as well as threat actors, such as financial services, oil and gas, healthcare, transportation and government as well as other critical infrastructure sectors.
While every situation is unique, here are just a few critical security elements that should be on the mind of anyone currently involved in the Illinois application process or those starting or investing in cannabis-related businesses.
Security in Design and Development
Whether building a cannabis dispensary business from the ground up or retrofitting it into an existing building, it is important to integrate security at the design stage. Security design is typically the first defense a facility has in preventing or mitigating security risks that can lead to theft, robbery or other unwanted intrusions. Working with architects and engineers, a security contractor should develop a technical design package that makes the best use of the latest approaches to security design. This can include, but is certainly not limited to:
- Environmental design that deters or prevents criminal activity, or CPTED
- Access control and visitor management
- Intrusion detection and duress alarms
- Video surveillance and monitoring
- Security operations center (SOC)
- Security system scalability
- Other physical countermeasures, such as barriers, lighting, and perimeter fencing
Security Master Plan
A security plan is not only important, it’s also a requirement for those submitting applications for cannabis-related business licenses in many states, including Illinois. In fact, the point-based system Illinois is using to award licenses places up to 65 points – the highest number available on the scale – on security and record-keeping. The security plan in the Illinois application must also accompany a contract with a licensed private security contractor.
An expert-built security plan will likely exceed the requirements in state applications because it covers a variety of areas detailing what is required and how the security options will function. All the while ensuring that security operations don’t interfere with the staff’s ability to do their jobs or with the customer experience. The security plan also serves as the foundation for training which is why it’s critical to maintain the highest level of security awareness and response. The security master plans our team develops with cannabis-related businesses cover any and all domains within the business from security program leadership and core operations to physical security measures including cyber security, inventory reporting and transportation security – among many other areas. For a more detailed view of a security master plan download our Cannabis Business Security Checklist.
The Illinois application specifically names training as an area that must be addressed in detail, including training on law and regulations, security operations and the safe consumption of adult-use cannabis. The security training element of the application cannot be taken lightly. Without adequate and ongoing training of dispensary staff, the best-laid security plans can become completely ineffective. Every staff member plays a crucial role in positive security outcomes which means training applies to every level of the organization.
You should also hold third-party vendors to strict requirements with regard to training. Armed security guards are often a necessary part of marijuana dispensary businesses but can also add more risk to any situation. Third-party security services should have well-documented training protocol and a means for you to verify that your guards have undergone all necessary trainings and certifications.
You Don’t Have to Be an Expert – But You Need One
No one goes to sleep and wakes up the next morning a security expert. Our team certainly didn’t and the state regulators reviewing applications don’t expect you to be either. That’s exactly why there’s an emphasis on contracting with a licensed security firm in the Illinois application. While your security program may only be one part of the overall application, it is critically important to both the sustainability and profitability of your cannabis business. Our experts are immediately available to start developing the right plan that gives you the best chance at both application approval and successful security outcomes.