The Complete Guide to Protect Your Cannabis Shop

Operating a cannabis dispensary comes with potential threats and inherent security risks.

One obvious threat associated with operating a marijuana business comes from the cannabis industry’s reliance on cash, leading to break-ins and robberies across the country.

But dispensary owners can’t focus exclusively on physical store security, there are also dangers related to cybersecurity that must be accounted for.

Recently, the government-run Ontario Cannabis Store (OCS) was impacted by a major data breach affecting 1,200-plus regulated dispensaries in cannabis. Data leaks like this are a cause for concern and can lead to further cybersecurity breaches.

From break-ins to phishing scams, your shop may be a target for criminal activity. The good news is there are preventative steps you can take to minimize risk and maximize dispensary security.

In this guide, you'll learn how to make sure your dispensary is secure.

Find out where most dispensaries are at risk, then take action with best practices for both physical security and cybersecurity.

Read on for the full guide, or click the links on the left to jump to a section.

The two sides of dispensary security

Every retail shop faces risks to security, but cannabis dispensaries are at much higher risk due to the volume of cash and data that they have available.

Below are some of the highest-risk areas of a cannabis business.

• Internal theft

• Cybersecurity

• Break-ins

• Robbery

• Delivery

• Shoplifting

The approach you take for each risk will vary depending on your situation, location, staff, workflows, and dispensary size.

In order to properly create a security strategy, your plan should consist of two core areas: physical security and cybersecurity.

Creating a physical security plan for your dispensary

There are a variety of tools, processes, and partnerships you must implement to create an effective physical security strategy.

Identify weak points in your store’s security

If you have ever been robbed or experienced theft before, you might recognize what went wrong in the past. But there are likely unidentified areas where you may be at additional risk.

Ask yourself these questions for a quick audit of your physical security:

• Do I have a reliable alarm system?

• Is the interior and exterior of my dispensary well lit?

• Are my cannabis products displayed in safe, secure locations?

• Do I have sufficient security staff?

• Do I have a comprehensive surveillance system?

• Are my delivery vehicles armored and secure?

• Am I operating my dispensary according to my state’s regulations for cannabis security?

If you answered "no" to any of these questions, that's an indication of a weak area to focus on strengthening security.

Create a perimeter around your dispensary

To best protect your dispensary, you need to introduce a secure perimeter. The size and scope of this perimeter will vary depending on your store’s needs and potential risks.

To create your perimeter, consider these three key features: surveillance, fencing, and lighting.

📹 Video surveillance systems

You’ll use these camera systems to help establish the perimeter around your store. You should also surveil the inside of your shop to keep track of any internal theft and deter shoplifters.

The best cannabis surveillance systems should be able to:

• Provide high resolution – The higher the resolution, the better your chance of identifying a threat. 4K resolution is the highest. You may be able to get by with a 1080p Full HD camera, but there is a risk that the camera won’t pick up some small details (license plates, faces, etc.) from a distance

• Function well, day or night – Make sure that your security cameras feature long-range infrared night vision. This will ensure that your cameras can pick up images in low or no light.

• Weatherproof and vandal resistant – Installing security cameras in your dispensary with IP66 or IP67 weatherproof rating and vandal-proof housing is a must to make sure nothing interrupts your surveillance.

• Integrate with your cannabis POS system – We recommend Solink which is a cloud-based video security and loss prevention system. It syncs video surveillance footage with Flowhub POS data, allowing you to gain complete visibility into your dispensary.

💡 Lighting

Keeping the outside of your dispensary well-lit will deter criminals.

These lighting options are best-suited for dispensary security:

• High-Intensity Discharge (HID) – These are one of your brightest options for outdoor lighting. HID lights light up a large area of space at a time. This makes them an ideal choice for commercial structures like parking lots, garages, and warehouses.

• Motion-activated – Motion-activated lights essentially act as a form of alarm system, but without the loud sirens. If an intruder enters your vicinity, the lights will illuminate.

• Parking lot lights – Parking lot lights are mounted on a pole and used to light up a wide area for parking lots and large parking structures.

• Wall pack lights – Wall packs are mounted on the walls of your building and used to provide lighting to entrances, exits, garages, and other important exterior details.

⛓️ Fencing

A key physical aspect of your shop’s perimeter will be the fence you surround yourself with.

Here are the most popular fences for retailers:

• Aluminum fences – These are strong, durable, easy to maintain, and reasonably priced. Aluminum fences are hard to climb because of the vertical bars and the metal’s strength keeps them in place for years when built correctly.

• Chain link – These fences are popular for businesses looking for maximum protection and durability without sacrificing seclusion. Chain link fences last a long time and can withstand extreme weather conditions. However, these are also easier to climb than aluminum fences.

• Wood – Wood fences provide both security and privacy. They are also a cost-effective choice for wind protection, outside noise reduction, and physical security. Wood fences typically require more maintenance than other fence materials, but with proper care they can last for many years.

When installing fencing, use these tips:

• Lock down all external mechanical and electrical devices.

• Fence special areas such as utility locations and parking lots.

• Secure any gates with heavy-duty padlocks.

Secure the inside of your building

Once your perimeter is set, you can strategically protect the inside of your dispensary.

To keep your interior safe, first understand how customers and employees are going to move through your dispensary layout. Then think about how you’re going to deter or catch criminals in the event of a break-in, robbery, or shoplifting.

Use the following tools and strategies to protect the inside of your dispensary.

💪 Reinforced glass

Your windows are high-risk points in your store’s physical security. Burglars can easily smash through most glass (including tempered glass) so you need to think carefully about this security step.

Try these options instead of typical glass:

• Safety and security window film – This type of film is composed of a pliable polyester mylar coating. It’s applied directly to the inside surfaces of your existing glass. The film is capable of holding your glass together in the event of high impact. This will delay burglary and smash-and-grab attempts.

• Laminated safety glass – This type of glass consists of an extremely robust thermoplastic interlayer between two glass layers. This makes the glass up to 100 times stiffer and five times stronger than traditional safety glass.

• Polycarbonate panels – These panels are made up of acrylics, polycarbonates, and other plastics. It looks and feels like glass, but is actually much more secure. This option is by far the most secure and can be made to be virtually unbreakable. Of course, this means they are also the most expensive option.

⚠️ Alarm systems

There are a few types of alarm systems, such as:

• Glass break detectors – You can either use an acoustic or shock detector. Acoustic detectors sense the high frequency of breaking glass and can be mounted anywhere within about 20 feet of glass windows or doors. Shock detectors sense the vibration of breaking glass and must be attached to the glass they are monitoring.

• Motion detectors – These alarms monitor the heat or energy released when an individual moves within the device’s range, therefore notifying you of unauthorized movement within your dispensary.

• Panic buttons – A panic button is a great addition to your security system as it signals an incident in progress to law enforcement. The button can be either remote or hard-wired in your shop.

🔐 Locks and secure storage

Depending on your dispensary’s layout, you will likely have a room where you store cannabis products. You may also display products throughout your store.

These products will help you secure those areas so no one but those with a key or code can access them:

• Safes – For smaller dispensaries, a safe is an option to keep product and cash secure. But make sure you’re choosing TL-rated safes, which are held to some of the highest security standards in the industry and are far superior to standard gun safes.

• Vaults – While vaults aren’t as affordable as a safe, they’re necessary for larger cannabis businesses and can securely store large quantities of cannabis and cash. A best practice for building cannabis vaults is lining the walls and ceiling with maximum-security mesh. This method is used to secure government, commercial, and retail buildings. Be sure to check with your state’s regulations on vault construction as some markets require specific materials for vault construction.

• High-security doors – Secure doors must be durable, code-compliant, and resistant to forced entry. They should also be easy to install, automatically locking, and customizable for your unique needs and specifications.

• High-security locks – Many states require various locking systems in place at dispensaries. Here are some of the most common security lock requirements:

  • Commercial-grade, nonresidential door locks that are installed on all points of entry and exit.

  • Cannabis-infused products that need to be refrigerated must be locked in a refrigerated unit incorporated into the building structure.

  • Limited-access areas must have a commercial door and non-residential lock and shall remain closed when not in use.

  • For delivery of cannabis, products must be locked in a box, container or cage secured inside the vehicle. A delivery employee cannot leave unless the vehicle is locked and the alarm system is active.

  • Security locks may be installed into a cannabis facility’s kiosks or fixtures like hinged cabinet doors, drawers, display cases, sliding cabinet doors, and two-way drawers.

👮 Hire a security officer

An armed guard won’t just stop criminals in the act, they’ll help deter crime. Security guards reduce internal theft by serving as visual reminders to staff that they are being actively monitored.

Security personnel should be:

• Firm, but still polite.

• Able to refer customers to the right employee when asked for help.

• Trained and certified.

• Able to work as a team with the retail store which means in certain scenarios this guard must know when to take charge of a situation.

Armed security may feel offputting to customers, but it often has the reverse effect. Security officers make cannabis customers feel safer, especially if they’re properly trained.

Hire, train, and retain secure staff

Outside of security hardware (and guards), your daily dispensary staff plays an important role in the safety of your store. Employee theft is also one of the biggest loss factors for cannabis dispensaries. There are four key solutions to making your staff as secure as possible:

Run background checks

• Successful hiring practices start at the HR level, make sure you put someone in charge who is meticulous and is able to vet every new hire diligently.

• Use a secure background check software like Checkr to vet every potential new hire.

Follow best practices for employee accountability

• Implement standard operating procedures (SOPs) for all employees that specifically outline workflows such as cash handling, drawer closing, and inventory management.

• Try to always have two employees working at the same time, preferably with the supervision of a manager.

• Provide comprehensive security training in regard to accountability, safety, and operational security.

Create a culture of respect and trust

• Pay your staff a fair wage, allow them to collect tips (if legal in your market), and offer employee discounts to create a more loyal workforce.

• Avoid being too restrictive of your staff. Harassment and accusations are not going to reduce internal theft in the long run. This will only upset your employees.

• Pay attention to the culture of your company. If employees are unhappy, listen to them and resolve the issue.

Creating a dispensary cybersecurity strategy

Dispensary owners often overlook cybersecurity, but it's just as important as physical security. Most companies have unprotected data and poor cybersecurity practices in place, making them vulnerable to cyber attacks which have been on the rise since the pandemic.

Cannabis companies are at higher risk of cyber attacks for a few reasons:

• Cannabis is a new industry – In this budding industry, there isn’t as much information available on online security best practices.

• Dispensaries are often small businesses – Smaller companies will likely not be able to afford to have an IT member on staff and are therefore less likely to prioritize cybersecurity.

• Cannabis customers value privacy – Because cannabis is often used as a medicine, the data surrounding patient identity should be considered as important as a hospital’s.

Therefore, cannabis business owners have to take careful security measures to protect their data, website, employees, and customers. It's never been more important to embed cybersecurity awareness and training into your cannabis business culture.

Below are the most important dispensary cybersecurity best practices:

Implement and utilize Multi-Factor Authentication (MFA)

The main benefits of MFA are:

• Limit the impact of a password breach

• Reducing vulnerability to phishing attacks

• Help maintain compliance with regulations

• Demonstrate to employees and customers that your business takes information security seriously

Here’s how you can utilize MFA at your cannabis dispensary:

• Ensure that anywhere you’re entering a password (either personal or for your cannabis business), you’re also activating Multi-Factor Authentication.

• Use an authenticator app like Google Authenticator. Google Authenticator generates 2-Step Verification codes directly on your phone. Using 2-Step Verification provides stronger security for your dispensary’s Google Account because it requires a second step of verification when you sign in.

• Enable Multi-Factor Authentication (or use partners that emphasize this capability) for any online ecommerce options your dispensary offers.

Secure your website

Here are ways to increase website security and give your customers more peace of mind:

• Use a Web Application Firewall (WAF), which is a firewall that monitors, filters, and blocks data packets as they travel to and from your website or web application. Examples of WAFs are Wordfence or Sucuri if your website is hosted on WordPress. Otherwise, AWS WAF, Azure WAF, and Cloudflare are strongly recommended.

• Scan your site for malicious codes regularly.

• Back up your website regularly. Creating a proper backup is a relatively simple and very important endeavor. It’s just a matter of deciding how you’re going to do it, and how often.

• Install a Secure Socket Layer certificate (SSL) – This is a digital certificate that authenticates a website's identity and enables an encrypted connection

Secure your business network

Follow these steps to ensure comprehensive security for your network:

1. Perform a network audit

• Use an audit to determine things like your network’s vulnerabilities, unused applications, open ports, and determine the overall strengths of your firewall.

• If you’re not working with an IT professional, you can use a network audit software to facilitate the process.

2. Update your antivirus software

• This step is often overlooked because many computers already have this software installed.

• Perform regular updates and document the step of updating your antivirus software in any applicable SOPs.

3. Protect your Wi-Fi networks

• Ensure that your Wi-Fi network is secured, encrypted, and hidden.

• To hide your network:

  • Connect your computer to the router's Wi-Fi network.

  • Open your Internet browser.

  • Choose Advanced > Wi-Fi > Wi-Fi Security Settings.

  • Click next to the SSID.

  • Check the Hide Wi-Fi

  • Click save

• Make sure to use a strong Wi-Fi password.

• Subnet guest Wi-Fi from your main network.

Protect your customer and company data

Some cannabis technology companies can put your data at risk, as seen in this 2020 POS data leak. Choose partners with proven track records of data protection. Outside of vetting your technology partners, protect your data by:

• Utilizing Data Loss Prevention (DLP) tools. These will make sure that data is not misused, leaked, or accessed by unauthorized parties.

• You can also take further steps to secure your email communications since these are not typically encrypted by default. See how to encrypt your emails in Google here.

Train and manage employees for dispensary cybersecurity

Social engineering attacks occur through human interaction, often over the phone, through email, or even in person.

• Make sure your staff are trained to recognize and alert your team to any suspicious activity or threats such as phishing, social engineering, and other types of cyber attacks.

• Implement fire drills or rehearsals to simulate fake cyber scams on employees to test their knowledge and provide real-world examples.

• Implement "Least Privilege". This is a security concept where users are given the minimum levels of access or permissions needed to perform their job. Limit employee permissions in your cannabis point-of-sale software and throughout any other software your business uses.

• Create an employee offboarding policy. When your employees leave the company, make sure you have SOPs in place to off-board them. This includes deleting email and POS software accounts, changing social media passwords, and ensuring there are no accessible platforms for that employee after they’ve left.

Don't wait to secure your dispensary

While security is an added cost to your dispensary's bottom line, it's usually a requirement in legal cannabis markets. Plus, the ability to keep your building, products, cash, and employees safe should be a top priority for every business owner.

Whether you're planning to open a cannabis business, currently designing your store, or have been operating for years, take a critical look at what you can do to make sure you're prepared in the event of a disaster.