The words access control rarely appear in cannabis licensing regulations, and if they do, the requirements typically do not demand more than a lock and key. 

Illinois is one of the few U.S. states mandating access control for licensed cannabis operations. The state requires an electronic access control system that uses a credential such as a key fob, access card, or biometric to control access to cannabis businesses.

Other states do not mention access control at all. California’s Code of Regulations, for example, mentions surveillance cameras, burglar alarms, and security guards, but says little about access control systems. Instead, California requires walls separating limited access areas from common or exterior areas, commercial-grade locking doors, and access control policies.

Experts advise companies to invest in access control anyway, even when regulations overlook the technology. Access control systems play a critical role in cannabis security. The technology manages access to sensitive areas and protects the safety and compliance of cannabis products, intellectual property, confidential business information, and business assets. The systems keep intruders out and maintain an audit trail of all comings and goings.

“As a consultant, I always recommend an access control system because it provides so much control over your cannabis operation,” says Charlena Berry, a principal consultant for Cannabis Business Growth. “However, access control is expensive and can be a barrier to operations that are not well funded.” 

Investing in expensive technology when it is not required can be a hard sell. So before you invest, carefully weigh the benefits and considerations of access control technology.

Access Control Improves Physical Security

Selling, growing, or manufacturing cannabis is a high-stakes, high-profit, cash-only game that makes these businesses targets for crime. Thieves target cannabis businesses for their valuable products (marijuana significantly increases in value when diverted to areas where it is still illegal) and for the piles of cash on site.

Headlines across the United States show that thieves regularly hit cannabis businesses. In Concord, California, alone, police report marijuana delivery robberies occur up to four times a month. Safety is also an issue. In November 2020, a suspect shot a bystander and injured two police officers during a robbery at an Oakland, California, marijuana business.

Access control systems protect cannabis businesses against inventory and profit losses and keep employees and customers safe. An access control system only allows authorized people to enter by using a key fob, card, or biometric. The system also maintains a complete record of every time a person enters and leaves. 

Access Control Aids Regulatory Compliance

While state regulations may overlook access control, many states require logs of all entries and exits to the facility and secure areas. They also mandate that companies make these records available to law enforcement upon request. While pen and paper might work, access control provides an easier way to track this data. 

Colorado, for example, asks for commercial-grade nonresidential locks at entrances and exits. Colorado also directs licensees to maintain a current list of authorized personnel with access to the surveillance system and a log listing all individuals who enter limited access areas.

Access control systems help businesses meet standards like those in Colorado.

An access control system helps to keep the wrong people out, let the right people in, and keep a log of all entries and exits. Every employee receives a key fob or badge to enter the building and secure areas. Every time a user presents his or her credentials to a card reader, the access control system logs the event. 

Types of Access Control

There are three types of access control systems available: Role-based access control, discretionary access control, and mandatory access control. Understanding how each type functions helps cannabis businesses select the right system for their operation. 

Role-based access control designates access based on predefined employee roles. Security managers set levels of access according to specific job titles. For instance, shift leads might receive access to all areas, while technicians only receive access to the dispensary. A role-based system eliminates the need to assign specific access to an individual. 

Discretionary access control systems allow authorized employees to grant unique access allowances to each employee. The security manager sets access for individual employees, making it easy to eliminate access when an employee leaves or is fired. 

Mandatory access control is more commonly used in government offices and military institutions. With these systems, owners do not control who has access to specific areas; instead, a central authority controls access. 

Choosing which access control system to use, requires companies to consider their budget and the time they want to spend on access control. 

Choose Your Credential

The credential an access control system uses to validate identity also warrants consideration. Cannabis operators can choose between code-punch systems, key fobs, cards, and biometrics; each with its own set of disadvantages and benefits.

Code-punch locks assign each user a unique user code. They provide strong security and smooth functionality while eliminating the issue of keys being stolen or misplaced. However, these systems are prone to code sharing, dead batteries, and wearing of numerical keypads that hint at the characters of frequently used codes.

Cards and key fobs incorporate software that allows certain cards or fobs to access specific areas during specified hours. The credentials provide a heightened level of access control and a strong audit trail. But like keys, people can easily lose, steal, or misappropriate key fobs.

Biometric access control costs more than other options, but because they use fingerprint or retina scans to give access, these systems help eliminate physical credential accounting and reduce the potential for loss, theft, or misappropriation of physical access credentials.

Integrate Access Control with VMS

Another consideration when adding access control is whether to integrate it with video management software (VMS). For an integration to succeed, the access control system needs an open architecture that interfaces with VMS.

Integrating access control into VMS allows centralized management of the facility’s security operations and improves situational awareness. Should an unauthorized access incident occur, authorized personnel can match video footage to the access record for additional information or evidence.

U.S. state laws may not always require access control systems, but consultants recommend them for a reason. The improvement in physical security keeps employees and customers safe and protects businesses against the loss of products and profits. 

According to Tim Sutton, a security consultant and cannabis practice leader at Guidepost Solutions, “You do not need to control every door electronically, but make your entrances, exits, and restricted areas electronic. Doing so lets you control who goes in and out and provides an audit trail for an investigation.”

 

Patrick Chown is the owner and president of security system integrator, Safe and Sound Security, and the president of Seed to Sale Security, a national brand serving the cannabis industry. Safe and Sound Security offers security system installation, cannabis security plans, and cannabis security consulting to cannabis companies.