Security Systems: Vaults, Access, Video, Cash Handling

Executive Summary (TL;DR)

• Treat cannabis security systems as an integrated, code-aligned program—vault design, role-based access control, 24/7 video with compliant retention, and auditable cash handling—rather than a checklist.
• Tie security milestones to leases, LOIs, and closings (permit approvals, power turn-on, commissioning) to protect DSCR and avoid stranded TI.
• Siting and zoning shape your design: verify LUCS (Land Use Compatibility Statement), EFU (Exclusive Farm Use) allowances, CUP (Conditional Use Permit) conditions, lighting limits, and parking flows before you spec cameras or vaults.
• Greenhouse and light-industrial footprints demand environment-ready hardware and SOPs; C1D1 (Class I, Division 1) areas require rated components and restricted access.
• When you’re ready to act, shortlist assets such as cannabis businesses for sale, cannabis properties for sale or pre-screen leaseable properties that already disclose power, vault-ready rooms, and surveillance infrastructure.

Table of Contents

• Market context and investor/operator intent
• Core requirements and design principles
• Vaults: construction, placement, auditability
• Access control: zones, roles, logs
• Video surveillance: coverage, performance, retention
• Cash handling: SOPs, transport, reconciliation
• Land use, zoning, and AHJ touchpoints (LUCS, EFU, CUP)
• Greenhouse and industrial nuances (C1D1, environment, stormwater)
• Financing and TI: lease vs. purchase, DSCR impacts
• Due-diligence checklists and decision matrices
• FAQs
• Call to Action

Why security systems drive outcomes for cannabis deals

In cannabis, security systems determine more than compliance—they materially affect rent commencements, punch-list timing, and valuation. Where jurisdictions require defined surveillance coverage, retention, and secure storage, the difference between “pass first inspection” and “re-work” can be months of carrying cost. Investors and operators should underwrite security against:

• Zoning and siting: LUCS, EFU, Goal 3 (Agriculture) protections, CUP conditions.
• Facility type: retail storefront, non-storefront delivery, greenhouse/indoor cultivation, extraction with C1D1 spaces.
• Utilities and resilience: power capacity and backup; stormwater and riparian setbacks that can limit fence lines and camera poles.
• Documentation: premises map, SOPs, event logs, and evidence export workflows for regulators and buyers.

Next step: Start with a pipeline of properties that already fit your risk model—shortlist from for sale listings and compare lease ready shells where landlords will fund base-building TI.

Core security design principles (fast reference)

Objectives: deter, detect, delay, document, and demonstrate compliance. Align each feature to one of those verbs.

• Deter: perimeter lighting/visibility, fencing, bollards, signage at limited-access doors.
• Detect: analytics-ready cameras, door contacts, glass-break, motion, duress buttons.
• Delay: vault assemblies, UL-rated safes, interlocked vestibules, secure cages.
• Document: 24/7 recording, time-sync, retention, chain-of-custody logs, cash logs.
• Demonstrate: premises map, SOPs, maintenance logs, video export repeatability.

Semantically related terms woven throughout: zoning, LUCS, EFU, Goal 3, CUP, C1D1, TI, DSCR, OWRD, OLCC, ODA, wetlands delineation, riparian setbacks, stormwater.

Vaults: construction, placement, auditability

Purpose. Vaults and safes protect currency, product, and high-value SKUs while enabling clean audit trails.

Specifications (typical best practice):

• Structure: reinforced walls and door assemblies; anchor safes to slab with manufacturer-specified hardware; verify slab thickness and PSI.
• Location: avoid exterior walls and windows; maintain camera lines of sight to all entry points and handling surfaces.
• Access: dual custody for opening/closing; independent alarm zone; separate keypad credentials from general access.
• Environmental: temperature/humidity ranges suited for product stability; fire-resistive construction where required by local code or insurer.
• Auditability: camera coverage of vault ingress/egress and cash/product count tables; serialized tamper-evident bags; time-stamped reconciliation logs.

Deal tip (operators/investors). In LOIs and PSAs, state the vault spec as a condition to rent commencement or closing, with a punch-list and test protocol (door time-delay, alarm verification, camera angles, and evidence-export test). This aligns TI with valuation and DSCR covenants.

Access control: zones, roles, logs

Zones. Segment the facility into risk-based zones: public, sales, limited access, inventory, vault, server/NVR, shipping/receiving, and any C1D1-rated rooms.

Hardware & policy.

• Readers & controllers: use offline fail-secure at perimeter doors; online for interior high-risk zones; maintain uninterrupted power via UPS.
• Roles and permissions: least privilege; time-bounded visitor badges; dual custody for vault and cash office.
• Logs: retain door events for the same or longer than video retention; reconcile anomalies (e.g., “door forced open”) daily.
• Change control: treat adds/moves/changes like IT—ticketing, approvals, documented testing.

Myth vs. Fact

• Myth: “A single keypad is fine for small shops.”
• Fact: Role-based access with unique credentials and logs is essential—shared codes obliterate accountability and undermine compliance narratives during diligence.

Video surveillance: coverage, performance, retention

Coverage (typical requirements across jurisdictions): all ingress/egress points; sales counters and display cases; product storage, vault, and inventory rooms; processing/extraction areas; loading bays; and any exterior approach where product or cash may move. Maintain clear views of hands at POS and count tables.

Performance. Many rulesets specify minimum resolution (e.g., 1280×720), frame rate (e.g., 10 fps), continuous 24/7 recording, nighttime capture, and time-sync. Build with headroom (storage, bitrate) so retention isn’t jeopardized by peak motion.

Retention varies by state. Examples to illustrate the range:

• Oregon (OLCC): continuous coverage with 90-day retention and minimum performance specs.
• California (DCC): 90-day minimum retention for surveillance recordings.
• Colorado (MED): rulesets have historically required 40-day minimum retention; check current text and local requirements before procurement.

Commissioning checklist (use in leases/LOIs):

• Camera FOVs verified and documented against the premises map.
• Low-light tests at exterior approaches and cash office.
• Export test: produce authenticated clips with embedded time/date; document chain of custody.
• Storage math proof: bitrate × camera count × retention days ≥ NVR capacity with margin.
• Alerts for camera/NVR failure and time-sync drift.

Cash handling: SOPs, transport, reconciliation

Objective. Convert a high-risk process into a repeatable, surveilled workflow.

• Smart safes & drops: deposit to validated devices; limit drawer maximums; log each transfer.
• Dual custody: two employees present for counts, vault access, and bag sealing.
• Sealed transit: tamper-evident bags; scheduled armored pickup or secure transport per policy; avoid ad hoc runs.
• Video & access linkage: synchronize count room cameras with POS exception reports; reconcile variances to door events.
• Incident response: duress buttons, silent alarms, and post-incident evidence kits (exported clips, bag serials, door logs).

Land use, zoning, and AHJ touchpoints (LUCS, EFU, CUP)

Security doesn’t exist in a vacuum; it must reflect zoning and local conditions.

• LUCS: obtain a Land Use Compatibility Statement confirming your cannabis use is permitted at the site.
• EFU & Goal 3: on Exclusive Farm Use land (Goal 3 – Agriculture), production may be allowed, but time, place, and manner limits (lighting, odor, traffic, hours) impact camera siting and exterior illumination.
• CUP: Conditional Use Permits often set conditions on lighting levels, parking, and hours. Your surveillance plan and access schedules must reflect these.
• Police liaison: some jurisdictions review premises maps and security plans; engage early to avoid re-work.
• Stormwater & environmental: wetlands delineation, riparian setbacks, and stormwater management can constrain fence lines and pole locations—fold these into the site plan to keep cameras compliant and serviceable.

Greenhouse & industrial nuances (C1D1, environment, stormwater)

Greenhouses and light-industrial sites add environment-driven constraints to security systems:

• C1D1 rooms (extraction/solvent storage): use equipment suitable for hazardous locations; restrict access to trained staff; maintain camera views that do not compromise classified‐area compliance.
• Humidity & temperature: select sealed, corrosion-resistant camera housings; plan for lens heaters/clear domes to avoid condensation.
• Light management: IR behavior and blackout curtains can create glare; test after dusk.
• Perimeter: long spans and rural siting demand layered detection (fence vibration, analytics, lighting) without violating CUP glare restrictions.
• Stormwater: route cabling and footings to avoid swales and detention features; protect low-voltage infrastructure from flood paths.

Financing & TI: lease vs. purchase, DSCR impacts

Security design is a capital plan.

DSCR lens. Missed inspections and re-work depress coverage. Use event-based triggers (permit sign-offs, power PTO, security commissioning) in LOIs and leases. Build 10–15% contingency into the TI budget for added cameras, photometric adjustments, and storage headroom.

Due-diligence checklists and decision matrices

Seller prep (before listing):

• Premises map with limited-access areas and camera IDs.
• Retention proof: random 90-day clip export (or jurisdictional minimum) with time stamps.
• Vault spec sheets, safe anchor details, alarm certificates.
• Access control roles/permissions export and 90-day door logs.
• Cash SOPs, variance reports, and armored-car contracts (if applicable).
• LUCS/CUP and any environmental constraints (wetlands, riparian setbacks).

Buyer diligence (during LOI/PSA):

• Live demo: retrieve and export footage at each critical area; verify frame rate and low-light performance.
• Access review: least-privilege roles, visitor policy, revocation path; audit log retention.
• Alarm and duress: test signals; review false-alarm rate.
• Environmental overlays: do CUP lighting limits conflict with surveillance needs? Any stormwater features blocking pole/fence lines?
• Water and ag context (when applicable): OWRD documentation for legal water; secure and monitor wells/meters.

Decision matrix (simplified)

FAQs

1) How long must we keep surveillance video?
Requirements vary by jurisdiction. Many require 24/7 recording with defined minimum retention (commonly 40–90+ days). Confirm the rule text for your location before procuring storage.

2) Can we use motion-based recording to save storage?
Where continuous recording is required, motion-only is non-compliant. Use continuous recording with analytics for alerting, and size storage appropriately.

3) What’s the minimum camera spec?
Rules commonly specify minimum resolution and frame rates (e.g., 1280×720 at 10 fps). Build headroom to sustain retention at those settings.

4) Where should the NVR/server live?
Place in a limited-access, climate-controlled room with UPS and secure racks. Log all access events and back up configurations.

5) Do C1D1 rooms need special cameras?
Yes. Classified areas require appropriately rated components and installation practices. Coordinate early with the AHJ and your engineer of record.

Call to Action

Ready to pair vaults, access control, video, and cash SOPs with a property that can pass inspection the first time?

Disclaimer

This article is for educational purposes only and does not constitute legal, engineering, financial, or tax advice. Always consult qualified professionals and your local Authority Having Jurisdiction before making decisions.

Please visit:

Our Sponsor