gsx18 securing medical cannabis industry … · medical cannabis, cannabis-infused products,...

Securing the Medical Cannabis IndustryFrom Seed to Sale Tim Sutton CPP, CHPA

T.P. Sutton LLC

Tim Sutton, CPP, CHPADirector of Security

Greenhouse Group LLC Compass Ventures Inc. Maryland Compassionate Care & Wellness LLCGrassroots Cannabis LLCHerbology LLC

WHAT DO WE DO?Manage 8 dispensaries and one cultivation center in IL.Manage a cultivation center, processing center and dispensary in Maryland.Manage a cultivation center, processing center and 4 dispensaries in Pennsylvania.

06

WIDESPREADThirty-seven states and the District of Columbia have enacted laws legalizing marijuana in some form or another.

Alaska allows adults 21 and over to transport, buy or possess up to an ounce of marijuana and six plants. Oregon approved a similar measure allowing adults to possess up to an ounce in public and 8 ounces in their homes.Colorado and Washington passed similar measures legalizing marijuana for recreational use in 2012. Under the marijuana legalization law that took effect February 26, 2015, District of Columbia residents over the age of 21 are allowed to possess up to two ounces of marijuana on their person, as well as use and grow marijuana in their private residence.

CASH BUSINESSBanks struggle to do business with the cannabis industry as cannabis is illegal by Federal Law

Illinois CULTIVATION CENTERS1)Suitability of the Proposed Facility:

A) Measure 1: The applicant demonstrates that the proposed facility is suitable for effective and safe cultivation of medical cannabis, sufficient in size, power allocation, air exchange and air flow, interior layout, lighting, and sufficient both in the interior and exterior to handle

the bulk agricultural production of medical cannabis, cannabis-infused products, product handling, storage,trimming, packaging, loading and shipping. The loading/unloading of medical cannabis in the transport motor vehicle for shipping shall be in an enclosed, secure area out of public sight.

Illinois CULTIVATION CENTERS1)Suitability of the Proposed Facility:

B) Measure 2: The applicant demonstrates the ability to continue to meet qualifying patient demand by expanding the cultivation facility in a quick and efficient manner with minimal impact on the environment and the surrounding community.

C) Measure 3: The applicant provides an employee handbook that will provide employees with a working guide to the understanding of the day-to-day administration of personnel policies and practices.

IllinoisCULTIVATION CENTERS2)Proposed Staffing Plan and Knowledge of

Illinois Law and Rules Relating to Medical Cannabis

A) Measure 1: The applicant fully describes a staffing plan that will provide and ensure adequate staffing and experience for all accessible business hours, safe production, sanitation, adequate security and theft prevention; and

B) Measure 2: The applicant provides an Operations andManagement Practices Plan that demonstrates compliance with this Part and the Act.

IllinoisCULTIVATION CENTERS

3) Security Plan:

A) Measure 1: The applicant's security plan demonstrates its ability to prevent the theft or diversion of medical cannabis and how the plan will assist with ISP, Department, and local law enforcement. Specifically, it shall evidence compliance with all items in Sections 1000.440, 1000.445 and 1000.450.

B) Measure 2: The applicant demonstrates that its plan for record keeping, tracking and monitoring inventory, quality control and security and other policies and procedures will discourage unlawful activity. It also describes the applicant's plan to coordinate with and dispose of unused or surplus medical cannabis through ISP and the Department.


3) Security Plan:

C) Measure 3: The applicant's security plan shall describe the enclosed, locked facility that will be used to secure or store medical cannabis, its security measures, including when the location is closed for business, and the steps taken to ensure that medical cannabis is not visible to the public.

D) Measure 4: The applicant describes its transportation plan regarding procedures for safely and securely delivering medical cannabis to registered dispensaries.


Should the applicant be awarded a permit, the information and plan that an applicant provided in its application becomes a mandatory condition of the permit. If a permittee fails to comply with standard and special conditions of the permit, the Department may assess a penalty or seek suspension or revocation of the permit pursuant to Section 1000.700.


In the event that two or more qualified applicants for a cultivation center permit receive the same total score, the Department shall select the applicant that received the highest score in the cultivation plan category. In the event that the same two applicants received the same score in the cultivation plan category, the Department shall select the applicant that received the highest score in the security plan category.

IllinoisDISPENSARIES

2) Security and Recordkeeping

A) The security plan will demonstrate the capability for the prevention of the theft or diversion of medical cannabis. The security plan will demonstrate safety procedures for dispensary employees, patients and caregivers, and safe delivery and storage of cannabis and currency. It will evidence compliance with all security requirements in this Part.


2) Security and Recordkeeping

B) A plan for recordkeeping, tracking and monitoring inventory, quality control and other policies and procedures that will promote standard recordkeeping and discourage unlawful activity. This plan will include the applicant's strategy to communicate with the Division and ISP on the destruction and disposal of cannabis.


Should the applicant be awarded an authorization, the information and plans provided in the application become a condition of the authorization. Dispensing organizations have a duty to disclose any material changes to the application. Failure to comply with the conditions or requirements in the application may subject the dispensing organization to discipline, up to and including suspension or revocation of its authorization by the Division. Revocation of an authorization shall serve as a final administrative decision by the Division.


In the event that two or more applicants receive the same total high score, the Division will select the applicant that received the highest score in the security and recordkeeping categories. In the event that the applicants received the same score in the security and recordkeeping categories, the tied applicants will be interviewed by a panel of three Department employees selected by the Director. The panel will interview the applicants based on the information gathered during the application process. The panel will make a written recommendation to the Director, and the Director will review the recommendation and make a final written determination.

Each State’s Application isDIFFERENTMost of the requirements are not based upon established industry standards and guidelines, but rather based upon the fear and uncertainty of the perceived risks and challenges and lack of actual knowledge about security and modern technology.

...facility shall angle cameras so as to allow for the capture of clear and certain identification of any person entering or exiting the facility...cameras shall be appropriate for normal lighting conditions of the area under surveillance...

...security system shall include a duress alarm, panic alarm, and hold up alarm....

a printer capable of printing still images at 1900dpi…

a printer capable of printing still images at 9600dpi...

Each State’s Application isDIFFERENTaccess to cannabis will be limited and controlled...

…maintain all recorded video for a four year period….

cameras must be at least 600 lines per inch (analog) or D1 (IP) and a minimum light factor requirement of 0.7 lux…

Unobstructed video surveillance of outside areas, the storefront and the parking lot, that shall be appropriate for the normal lighting conditions of the area under surveillance. Cameras shall be angled so as to allow for the capture of facial recognition, clear and certain identification of any person entering or exiting the dispensary, the immediate surrounding area and license plates of vehicles in the parking lot…

IllinoisCULTIVATION CENTERSSection 1000.445 Electronic Security System

1)Visually records and monitors all building entrances and exits, all parking lot areas, and rear alley areas immediately adjacent to the building, and covers the entire inside of the facility, including all limited access areas and all areas where cannabis is produced, stored, shipped or destroyed, but does not include restrooms nor the executive office. Fixed cameras shall be installed to provide a consistent recorded image of these areas. The cultivation center shall instruct the company or individuals installing the surveillance cameras to maximize the quality of facial and body images and to avoid backlighting and physical obstructions.


2) Cameras installed outdoors and in low-light interior areas shall be day/night cameras with a minimum resolution of 600 lines per inch (analog) or D1 (IP) and a minimum light factor of 0.7 LUX.

The installation of additional lighting may be required to increase picture clarity and brightness. Cameras shall be calibrated and focused to maximize the quality of the recorded image.


3) The recording device shall be a digital video recorder (DVR) that meets the following minimum standards:

A) Displays a date and time stamp on all recorded video.B) Can produce a video disc (CD/DVD) directly from the DVR unit using an installed media

recording drive. The video on the disc shall be viewable on any Windows PC, and shall include any required player software on the disc.

C) The ability to remain operational during a power outage.


3) The recording device shall be a digital video recorder (DVR) that meets the following minimum standards:

D) Allow for the exporting of still images in an industry standard image format, including .jpg, .bmp and .gif. Exported video shall have the ability to be archived in a proprietary format that ensures authentication of the video and guarantees that no alteration of the recorded image has taken place. Exported video shall also have the ability to be saved in an industry standard file format that can be played on a standard computer operating system. All recordings shall be erased or destroyed prior to disposal.

4) A display monitor with a minimum screen size of 12 inches shall be connected to the electronic recording security system at all times.


5) Electronic recording security systems are required to be maintained in good working order at all times. The owner of a cultivation center shall instruct each manager, employee or agent overseeing the functioning of the video recording security system to immediately report to the agent-in charge any malfunctioning or technical problems with the system.


6) Security recordings shall meet the following minimum requirements:

A) The recorded image resolution shall be at least D1; andB) The recorded image frame rate shall be at least three frames per second during

alarm or motion based recording.


7) Security recordings shall be retained by the cultivation center for a minimum of 90 days at the permitted premises and an additional 90 days off site (i.e., cloud storage). The recording system for the security cameras must be located in a locked, tamper-proof compartment. A cultivation center shall be prohibited from taping over existing security video from the last 60 days.


8) Have available a video printer capable of immediately producing a clear still photo from any video camera image.

9) Upon request, the recording or any photo shall be turned over to ISP or the Department.


b) Access to surveillance areas shall be limited to persons who are essential to surveillance operations, law enforcement agencies, security system service personnel, the Department, and others when approved by the Department. A current list of authorized employees and service personnel that have access to the surveillance room must be available to the Department upon request. Surveillance rooms shall remain locked.


c) The electronic security system shall be available 24 hours per day, 7 days per week, to the Department and law enforcement agencies via a secure web-based portal.

IllinoisCULTIVATION CENTERSSection 1000.450 Alarm System

a) A cultivation center shall install, maintain and use a professionally monitored robbery and burglary alarm system meets the following requirements:

1) At a minimum, the system shall provide coverage of all facility entrances and exits, rooms with exterior windows, rooms with exterior walls, roof hatches, skylights and storage rooms that contain safes.

2) Duress alarm, which means a silent security alarm system signal generated by the entry of a designated code into an arming station in order to signal that the alarm user is being forced to turn off the system.


3) Panic alarm, which means an audible security alarm system signal generated by the manual activation of a device intended to signal a life threatening or emergency situation requiring law enforcement response.

4) Holdup alarm, which means a silent alarm signal generated by the manual activation of a device intended to signal a robbery in progress.


5) Automatic voice dialer, which means any electrical, electronic, mechanical or other device capable of being programmed to send a prerecorded voice message requesting dispatch, when activated, over a telephone line, radio or other communication system to a law enforcement, public safety or emergency services agency.

6) A failure notification system that provides an audible, text or visual notification of any failure in the surveillance system. The failure notification system shall provide an alert to the cultivation center, within five minutes after the failure, by telephone, email or text message.


7) The ability to remain operational during a power outage and ensure all access doors are not solely controlled by an electronic access panel to ensure that locks are not released during power outage.

b) The system shall be inspected and all devices tested annually by a qualified alarm vendor.

Delavan, Illinois

386 page SECURITY PLAN for an Illinois cultivation center application.

A chain link fence will be erected along the perimeter of the property. The fence will meet the specifications developed by the U.S. Department of Defense for effectiveness. Where the ground is sandy or subject to erosion, the bottom should be installed a couple of inches below ground. To protect against washouts or channeling under the fence, culverts or troughs will be provided at natural drainage points. If any of these drainage points are larger than 96 square inches, they, too, will be provided with physical barriers that will protect the perimeter without, however, impeding the drainage. Any access points/gates installed in the fencing will be secured with a heavy duty approved padlock and will be monitored 24/7 by CCTV, alarm detection devices or security guards.

PERIMETER SECURITY

The standard chain-link fence used as a perimeter barrier around the facility cannot alone be considered a serious deterrent to a determined adversary but at the least establishes a visible legal boundary of the property and can hold signs advising outsiders of trespassing violations.

PERIMETER SECURITY

The actual video surveillance system specifics will be attached to this security plan. All cameras that are capturing people entering and exiting doors to the facility or areas where marijuana is present will provide a minimum pixel density of 5 px/cm at a distance from the portal of 5 feet in all directions to maximize the expectation of identification. Cameras capturing vehicles entering/exiting the property will provide a pixel density providing images where the height of the letters and numbers on license plates are represented by 15 pixels to ensure legibility. The written security management plan will contain policy and procedure for usage and accessibility of the system.

VIDEO SURVEILANCE SYSTEM

VIDEO SURVEILANCE SYSTEM

SECURITY COMMAND CENTER

MarylandCULTIVATION CENTERS10.62.10.xx

.04 Security of Premises. A licensed premises shall be constructed to prevent unauthorized entry.

.05 Security Lighting. A. Lighting fixtures of the licensed grower shall be designed and installed to ensure proper surveillance. B. This regulation does not apply to lighting in areas of the premises used to cultivate medical cannabis.

MarylandCULTIVATION CENTERS10.62.10.06.06 Security Alarm Systems.

A. A licensee shall maintain a security alarm system that covers all perimeter entry points and portals at all premises.

B. A security system shall be: (1) Continuously monitored; (2) Capable of detecting smoke and fire; and (3) Capable of detecting power loss.

C. A security alarm system shall include panic alarm devices mounted at convenient, readily-accessible locations throughout the licensed premises.

MarylandCULTIVATION CENTERS10.62.10.06

D. A second, independent security alarm system shall be used to protect: (1) A location where records are stored on-site; (2) A location where records are stored off-site; and (3) A cabinet or room that holds medical cannabis.

E. A security alarm system shall remain operational until a licensed premises no longer has any medical cannabis, seeds, or cuttings on the premises.

F. A security alarm system shall be equipped with auxiliary power sufficient to maintain operation for at least 48 hours.

MarylandCULTIVATION CENTERS10.62.10.07 .07 Video Surveillance Requirements.

A. A licensee shall maintain a motion-activated video surveillance recording system at all premises that: (1) Records all activity in images of high quality and high resolution capable of clearly revealing facial detail; (2) Operates 24-hours a day, 365 days a year without interruption; and (3) Provides a date and time stamp for every recorded frame.

B. A licensee shall post appropriate notices advising visitors of the video surveillance.


C. A surveillance camera shall be located and operated to capture each exit from the premises.

D. A surveillance camera shall capture activity at each entrance to an area where medical cannabis is grown, tested, cured, manufactured, processed or stored.

E. A recording of all images captured by each surveillance camera shall be kept: (1) At the licensed premises; and (2) At an off-site location.


F. The storage of all recordings of security video surveillance shall be: (1) Access-limited; (2) Secured by a security alarm system that is independent of the main premises security alarm system; (3) In a format that can be easily accessed for investigational purposes; and (4) Retained for a minimum of 30 calendar days.

G. Any recording of security video surveillance shall be made available to the Commission or law enforcement agency for just cause as requested.

MarylandCULTIVATION CENTERS10.62.10.08 .08 Visitor to a Non-Public Area of the Premises.

A. When a visitor is admitted to a non-public area of the premises of a licensee, a registered grower agent shall: (1) Log the visitor in and out; (2) Retain with the log a photocopy of the visitor’s government-issued identification; (3) Continuously visually supervise the visitor while on the premises; and (4) Ensure that the visitor does not touch any plant or medical cannabis.

B. The licensee shall maintain a log of all visitors to non-public areas for 2 years.

PennsylvaniaGROWER/PROCESSORCENTERS§ 1151.25. Visitor access to grower/processor facilities.(a) A grower/processor facility may not be open to the general public. A grower/processor shall

require vendors, contractors and other individuals requiring access to the facility for purposes regarding the growing, processing or testing of medical marijuana to sign a visitor log and wear a visitor identification badge that is visible to others at all times while on the site and in the facility.

(b) A grower/processor shall require visitors to present government-issued identification that contains a photo to gain access to the site and facility.

(c) No one under 18 years of age is permitted to enter a grower/processor site and facility.(d) A grower/processor shall post a sign in a conspicuous location at each entrance of the site and

facility that states:THESE PREMISES ARE UNDER CONSTANT VIDEO SURVEILLANCE. NO ONE UNDER THE AGE OF 18 IS PERMITTED TO ENTER.

PennsylvaniaGROWER/PROCESSORCENTERS(e) A grower/processor shall do the following when admitting a visitor to its site and facility:

(1) Require the visitor to sign a visitor log upon entering and leaving the facility.

(2) Check the visitor's government-issued identification to verify that the name on the identification provided matches the name in the visitor log. A photocopy of the identification must be retained with the log.

(3) Issue a visitor identification badge with the visitor's name and company, if applicable, and a badge number.

(4) Escort the visitor while the visitor remains in the facility or on the site.

(5) Ensure that the visitor does not touch any medical marijuana plant or medical marijuana located in a limited access area.

PennsylvaniaGROWER/PROCESSORCENTERS(f) The following apply to the visitor log:

(1) The grower/processor shall maintain the log required under subsection (e) for 4 years and make the log available to the Department, State or local law enforcement, and other State or local government officials upon request if necessary to perform the government officials' functions and duties.

(2) The log must include the full name of each visitor, the visitor identification badge number, the time of arrival, the time of departure and the purpose of the visit, including the areas of the site and the facility visited and the name of each employee visited.

PennsylvaniaGROWER/PROCESSORCENTERS(g) This section does not limit the right of the Department or its authorized agents, or other Federal,

State or local government officials, from entering any area of a grower/processor site and facility if necessary to perform the governmental officials' functions and duties.

(h) A principal, financial backer, operator or an employee of a grower/processor may not receive any type of consideration or compensation for allowing a visitor to enter a limited access area.

PennsylvaniaGROWER/PROCESSORCENTERS§ 1151.26. Security and surveillance.

(a) A facility must have security and surveillance systems, utilizing commercial-grade equipment, to prevent unauthorized entry and to prevent and detect diversion, theft or loss of medical marijuana. The security and surveillance systems must include:

(1) A professionally-monitored security alarm system that includes the following:

(i) Coverage of all facility entrances and exits; rooms with exterior windows, exterior walls, roof hatches or skylights; storage rooms, including those that contain safes; and the perimeter of the facility.

(ii) A silent security alarm system signal, known as a duress alarm, generated by the entry of a designated code into an arming station to signal that the alarm user is being forced to turn off the system.

(iii) An audible security alarm system signal, known as a panic alarm, generated by the manual activation of a device intended to signal a life threatening or emergency situation requiring law enforcement response.

PennsylvaniaGROWER/PROCESSORCENTERS

(iv) A silent alarm signal, known as a holdup alarm, generated by the manual activation of a device intended to signal a robbery in progress.

(v) An electrical, electronic, mechanical or other device capable of being programmed to send a prerecorded voice message requesting dispatch, when activated, over a telephone line, radio or other communication system to a law enforcement, public safety or emergency services agency.

(vi) A failure notification system that provides an audible, text or visual notification of any failure in the systems. The failure notification system must provide by telephone, e-mail or text message an alert to a designated security person within the facility within 5 minutes after the failure.


(vii) A smoke and fire alarm.

(viii) Auxiliary power sufficient to maintain operation of specified growing and processing areas identified in the grower/processor's plan of operation for at least 48 hours following a power outage.

(ix) The ability to ensure all access doors are not solely controlled by an electronic access panel to prevent locks from becoming released during a power outage.

(x) Motion detectors.


(2) A professionally-monitored security and surveillance system that records all activity in images capable of clearly revealing facial detail. The security and surveillance system must include the following:

(i) Fixed camera placement that allows for a clear image of all individuals and activities in and around the following:

(A) A limited access area of the facility.(B) A room or area containing a security and surveillance system storage device or equipment.(C) Entrances and exits to the facility. Entrances and exits must be recorded from indoor and

outdoor vantage points.(D) Rooms with exterior windows, exterior walls, roof hatches, or skylights and storage rooms,

including those that may contain safes.


(E) Twenty feet from the exterior of the perimeter of the facility.

(ii) Auxiliary power sufficient to maintain operation for at least 48 hours following a power outage.(iii) The ability to operate under the normal lighting conditions of each area under surveillance.(iv) The ability to immediately produce a clear, color, still photograph in a digital format that meets the

requirements of this subsection.

(3) The ability to clearly and accurately display the date and time. The date and time must be synchronized and set correctly and may not significantly obscure the picture.

PennsylvaniaGROWER/PROCESSORCENTERS(4) The ability to record all images captured by each surveillance camera for a minimum of 4 years in a

format that may be easily accessed for investigative purposes. The recordings must be kept:

(i) At the facility:(A) In a locked cabinet, closet or other secure place to protect it from tampering or theft.(B) In a room to which access is limited to authorized individuals and secured by a security alarm system

separate from the site's primary security system.

(ii) At a location other than the location of the facility if approved by the Department.

PennsylvaniaGROWER/PROCESSORCENTERS(5) The following apply regarding the inspection, servicing or alteration of, and the upgrade to, the site’s

security and surveillance systems:(i) The systems shall be inspected and all devices tested once every year by a qualified alarm system

vendor and a qualified surveillance system vendor, as approved by the Department.(ii) The grower/processor shall conduct maintenance inspections once every month and ensure that all

necessary repairs, alterations and upgrades are made for the proper operation of the systems.(iii) The grower/processor shall retain at the facility, for at least 4 years, records of all inspections,

servicing, alterations and upgrades performed on the systems. The following apply:(A) The records shall be made available to the Department and its authorized agents within 2 business

days following a request.(B) Failure to provide the records under clause (A) subjects the grower/processor to the sanctions and

penalties under § 1141.47 (relating to general penalties and sanctions).

PennsylvaniaGROWER/PROCESSORCENTERS(6) In the event of a mechanical malfunction of the security or surveillance system that exceeds an 8-hour

period, the grower/processor shall notify the Department immediately and, with Department approval, provide alternative security measures that may include closure of the facility.

(7) The grower/processor shall designate an employee to continuously monitor the security system and surveillance system at the facility.

PennsylvaniaGROWER/PROCESSORCENTERS(8) The following apply regarding records retention:

(i) Within 2 business days following a request, a grower/processor shall provide up to four screen captures of an unaltered copy of a video surveillance recording to the Department or its authorized agents, law enforcement or other Federal, State or local government officials if necessary to perform the governmental officials' functions and duties.

(ii) If a grower/processor has been notified in writing by the Department or its authorized agents, law enforcement or other Federal, State or local government officials of a pending criminal or administrative investigation for which a recording may contain relevant information, the grower/processor shall retain an unaltered copy of the recording until the investigation or proceeding is closed or the entity conducting the investigation or proceeding notifies the grower/processor that it is not necessary to retain the recording.

PennsylvaniaGROWER/PROCESSORCENTERS(b) The grower/processor shall install commercial-grade, nonresidential doors and door locks on each

external door of the facility. Keys or key codes for all doors shall remain in the possession of designated authorized individuals.

(c) During nonworking hours, entrances to and exits from the site and facility shall be securely locked.

(d) The grower/processor shall have an electronic back-up system for all electronic records.

(e) The grower/processor shall install appropriate lighting to ensure proper surveillance inside and outside of the facility.


f) A grower/processor shall limit access to a room containing security and surveillance monitoring equipment under this section to persons who are essential to maintaining security and surveillance operations, Federal, State and local law enforcement, security and surveillance system service employees, the Department or its authorized agents, and other persons with the prior written approval of the Department. The following apply:

(1) A grower/processor shall make available to the Department or the Department's authorized agents, upon request, a current list of authorized employees and service employees or contractors who have access to any security and surveillance areas.

(2) A grower/processor shall keep security and surveillance rooms locked at all times and may not use these rooms for any other purpose or function.

126 M3006-V visitor hall

Camera ID Description Installation Height Resolution Focal Length Sensor Size

126 M3006-V visitor hall 9 2048x1536 1.6 1/3.6 " 5:9

5 P3384-V dock

Camera ID Description Installation Height Resolution Focal Length Sensor Size

5 P3384-V dock 7 1280x960 3 1/3 " 16:9

www.jvsg.com 3

1

Camera ID Model Installation Height Resolution Focal Length Sensor Size Pixels On Target

1 Avigilon 1.0-H3M-D1 9 1280x720 3 1/4 " 4:3 53x40 px/ft

QUESTIONS, COMMENTS or COMPLAINTS?

Tim Sutton CPP, CHPAOwner and PrincipalTP Sutton Security ConsultingSpringfield, IL217-836-1581www.linkedin.com/in/timothysuttonwwwtpsutton.com

https://www.linkedin.com/in/timothysutton%22%20/o%20%22my%20LinkedIn%20Profile

https://www.linkedin.com/in/timothysutton%22%20/o%20%22my%20LinkedIn%20Profile

gsx18 securing medical cannabis industry … · medical cannabis, cannabis-infused products,...

Documents