Physical Cannabis Security Measures for Cannabis In Canada
If you're just starting on the journey of starting a cannabis business, then physical security needs to be near the top of your priority list.
Section four of Health Canada's cannabis regulations set out strict rules on cannabis security. You must follow these regulations at all times to be able to comply with your license. This is to make sure that license holders safeguard their product and keep it safe from divergence.
There's a lot of info to digest on this topic, and it can be challenging to make sense of it, so we've compiled this guide for you to take you through all the cannabis security measures you'll need to put in place.
Security Requirements by License Category
The physical security measures set out by Health Canada can be broken down into two categories. These categories are based on the type of license that you hold.
The first category covers standard cultivation and processing licenses and sales for medical purposes with possession. The second category is broader and covers micro cultivation, micro processing, analytical testing, research and development, and sales for medical purposes without possession.
The categories vary in terms of what is required and the cost of implementation, so it's something to consider before you apply for your license.
Standard Cultivation and Processing Licenses
The physical security measures covered by this first category are stringent and likely to come at a significant cost to you.
The best way to get this process done as quickly as possible is to conduct an initial security audit followed by a more detailed security report. This report will be able to detail what security devices you have and their effectiveness and locations.
The report will cover the four areas set out in Health Canada's physical security guide. These areas are site design, perimeter, operations and storage areas, and retention.
Let's take a closer look at these now.
Site Design
Your business site must be designed and equipped to keep unauthorized personnel out of the site.
The site is defined as all the areas encompassed by the perimeter (which we'll look at next). The size and shape of the proposed perimeter is entirely at the discretion of the license holder.
It's advised that you design your site based on the 'rings of protection' principle. This essentially means that you should plan your site in such a way that several layers of protection protect your main product.
In theory, once somebody has breached the first ring of protection, you will be notified and can stop them before they reach further rings.
Perimeter
Your perimeter is entirely up to you, but you must clearly mark it on your design plans.
Whatever perimeter you choose, it must be visually monitored at all times using recording devices that can detect any attempt to gain access to the site. The visual recording devices you use must work at all times and must monitor the entire perimeter. You must also keep your perimeter clear of any objects that can obstruct the view.
As well as recording devices, you'll need an intrusion detection system. These systems must be fully operational and monitored at all times. You can use a third party to monitor your system or have an in-house department for it. It just needs to be monitored round the clock.
Operations and Storage Areas
The location of your storage area is paramount, and there are things you need to do to meet the requirements of the regulations.
You must restrict access to your storage area to only people who need to be there to do their job. You can implement this with swipe cards, key codes, or specially cut keys given only to certain people.
You must keep a detailed record of everyone who has access to these areas. You can do this by maintaining access logs of keypads and swipe card readers or by holding a physical log on who has a key and who's been in and out of the area.
Every operation and storage area will need to be equipped with adequate physical barriers. You'll need strong walls, locked doors and windows, and fences. You'll also need to make sure there are no vent openings.
Like the security measures you need to take at the perimeter, you also need intrusion detection systems and visual monitoring devices in your storage and operations areas. The only exception to this is your grow area, where you do not need an intrusion system.
Retention
You must keep hold of your security records for specified periods. You must keep recordings from visual devices for at least a year after the recording was made. And you must keep security reports and their contents for two years.
If you decide to get a security report, experts will assess these four areas. At Growth West, we have specially trained cannabis security experts who can carry out this report.
Other Licenses
When it comes to other forms of licenses, the regulations are less stringent and therefore less expensive.
Let's take a look at the cannabis security measures you'll need to put in place if you hold the licenses covered by this second category.
Micro-Cultivation, Micro-Processing, and Nursery Licenses
The security measures for this type of license are similar to the requirements for the licenses covered by category one.
You must ensure that your site is designed to prevent unauthorized access and have a clearly defined perimeter. You'll also need to ensure that your site is protected by a continuous physical barrier such as a fence or wall.
Restricted access needs to be in place for storage and operations areas. Again, You must restrict access to these areas solely to individuals who need to be there for duties.
Analytical Testing
If you hold a license for analytical testing, you need to ensure that you have a physical barrier protecting your storage areas. You'll also need to adhere to the previously mentioned rules of restricted access.
Research
If you hold a license for research purposes, the only mandatory security measures are physical barriers and restricted access to storage areas.
While you don't have to comply with all the other regulations for other license types, it's worth looking at investing in some extra security if you're worried about it.
Sale for Medical Purposes (Without Possession)
If you have a license to sell cannabis for medical purposes (without possession), then there are no physical cannabis security measures to comply with.
You will, however, have to adhere to the rules around the retention of security information and data.
Standard Operating Procedures
Licensees of either category will need to produce a detailed organizational security plan. The plan must follow the template provided in Health Canada's license application guide.
You'll need to provide detailed descriptions of the roles and responsibilities of the Health Canada designated managers and executives. You'll also need to produce detailed descriptions of any security-related standard operating procedures (SOPs) that employees can follow in each priority and risk area.
Health Canada defines an SOP as a "documented procedure that instructs employees on how to do or complete a specific task." The description of your SOPs must "capture the risk mitigation measures that are in place to prevent, identify, and respond to potential incidents that could result in the diversion of cannabis to or from the illicit market."
The Five Themes
Copies of your full SOPs are not required when you submit your license application, but they need to include enough detail to show that you can comply with Health Canada's requirements of how SOPs should work.
Health Canada has identified five themes that your SOPs should cover. Let's take a closer look at these themes.
Theme 1: Employee Information
Your description must describe how SOPs will address information that could compromise an employee's security clearance. You'll also need to address information on non-security cleared employees that can comprise the security of the whole organization.
Theme 2: Security Measures - People and Cannabis Movement
You should describe how your SOPs will address the movement of both cannabis and people in your operations.
For people, you must address:
- Entry to the site perimeter
- Security breaches to the site perimeter
- Access to operation and storage areas
- Security breaches to operation and storage areas
For cannabis, you need to address:
- Safekeeping of cannabis when being transported or shipped
- Validating the legality of cannabis entering the site
- Unauthorized movement of cannabis
- Detecting loss or theft
- Destruction of cannabis
This theme does not apply to people who hold sale for medical purposes (without possession) licenses.
Theme 3: Security Awareness and Training
The descriptions of your SOPs in this area must include security training, site orientation training, how security issues are reported, and how investigations are managed.
You'll need to address both initial and ongoing security training for employees, as well as security briefings for site visitors.
Theme 4: Storage of Information
Your SOPs must address your contingency plans if your record-keeping system goes down.
You'll also need to cover any possible protection of client information and the storage and retrieval of any video monitoring footage.
Theme 5: Information and Operations Management
Lastly, the description of your SOPs should include details on how you manage your information.
This includes any cyber security measures, IT disaster recovery, and business continuity.
Writing Your SOPs
Writing your SOPs can be a time-consuming and confusing task. We at Growth West can handle this aspect for you.
We can write both abbreviated and detailed SOPs with their work instructions for use in the facility. We can also prepare these for inspection from Health Canada. Our subject expert Mr. Bob Weir has completed many security projects in the cannabis industry for both public and private companies.
We can also supply attestations that are required to be made from your head of security and assistant head of security with regards to themes four and five.
Get on Top of Your Cannabis Security Today
The Canadian government's cannabis security regulations are complex and varied. It can be stressful for you to have to wade through the legal paperwork on your own.
At Growth West, we can help you wade through these legal requirements in a way that saves time, effort, and money. Contact us today to see how we can help you.