How to Meet California’s 2026 Cannabis Security Compliance Requirements

Note: This post was updated in March 2026 with new information on California cannabis security laws.

Cannabis use, both medical and recreational, is legal in California. In fact, CA was the first state in the U.S. to allow medicinal cannabis use after the Compassionate Use Act was passed by voters in 1996. This law provided for people to possess and use cannabis without legal consequences if they had a medical condition that required the use of marijuana for treatment.

This event set a precedent for future cannabis laws and on November 8, 2016, voters passed, Proposition 64 of the Adult Use of Marijuana Act with 57% of approval, which legalized the use, sale, and cultivation of recreational cannabis in California for adults 21 and over.

Unique Challenges for Cannabis Businesses in California

Although its use is permitted, the cannabis industry is strictly regulated by the Department of Cannabis Control (DCC) to ensure operations are safe and products contaminant-free. These rules range from track and trace protocols to video surveillance guidelines and include provisions that support the safeguarding of logistics, operations, procedures, and physical security.

For instance, as per the official DCC regulations, record retention should be supervised. Section §5037 asks cannabis licensees to keep and maintain security records related to commercial cannabis activity for at least seven years, except for surveillance recordings required pursuant to Section §5044.

Other directives to observe in order to get and maintain a cannabis operating license to do business in the golden poppy state are:

1. Access Control
   

   Section §5042 stipulates that only employees and other authorized individuals, including vendors and contractors, can access limited-access areas of the licensed premises. All points of entry and exit, and entrances to all limited-access areas, should have a solid door and be securely locked with a commercial-grade, nonresidential lock mechanism.

   If an individual enters a sensitive area and is not an employee, then they should be escorted by a worker at all times.

   A record of all authorized individuals that had access to limited-access areas should be maintained and made available to the Bureau immediately upon request.

2. Video Surveillance

   Video surveillance rules are provided in Section §5044. First and foremost, licensed premises must have a digital video surveillance system, with a resolution of at least 1280 x 720 pixels, able to record unceasingly, 24/7/365, with a minimum of 15 frames per second (FPS), and with the right time and date display.

   Cameras should be permanently mounted and installed in a fixed location that allows the device to clearly record activity occurring within 20 feet of all points of entry and exit.

   Entrances and exits to the licensed premises must be recorded from both indoor and outdoor vantage points.

   It is essential that the security camera system allows for the clear and accurate identification of any person in all areas required to be filmed, including where cannabis goods are weighed, packed, stored, loaded, unloaded, prepared, or moved within the premises.

   Secure storage of surveillance images is vital; they should be duly protected from tampering and theft and maintained for no less than 90 days.

3. Alarm System

   Section §5047 discusses the need to maintain an alarm system in a cannabis facility. The system’s data related to monitoring and alarm activity must be made available to the Bureau upon request.

   Moreover, the installation, maintenance, monitoring, and response to the alarm system must be conducted by a fully licensed security integrator.

4. Track and Trace

   A track-and-trace system is a required regulatory tool that tracks cannabis inventory, transfers, and sales in real time to ensure transparency and compliance. If a licensee is unable to solve a compliance notification within three business days, the Bureau must be notified immediately.

   The track-and-trace system must record the name and type of cannabis goods, amount, total wholesale costs, date and time of transportation, and license number, among other information, including:

   • Transportation type
   • Receipt
   • Return
   • Destruction and disposal
   • Laboratory testing
   • Laboratory results

   RFID technology can support tagging mature plants, bundles, and products to ensure a precise accounting across your entire cannabis operations. By implementing advanced RFID solutions, managers and auditors can prevent the diversion, theft, and counterfeiting of products. This technology can optimize labor-intensive protocols and support compliance with the DCC.
   
   

Best practices for implementing physical security measures

Implementing these security measures requires careful planning and adherence to best practices:

• Compliance: It is key to ensure that all security systems and procedures are fully compliant with California’s cannabis laws and industry standards. This includes implementing robust measures to protect sensitive data, securing physical premises, and establishing strong access control mechanisms.
• Regular audits: A proactive approach to identifying and addressing potential security gaps. These audits should encompass comprehensive assessments of all security-related aspects, including, but not limited to, surveillance and alarm systems, and personnel training.
• Training: Providing thorough staff training is paramount in maintaining a secure environment. This includes educating employees on security protocols, emphasizing adherence to established procedures, and promoting a culture of vigilance and awareness.

By focusing on these best practices, cannabis businesses can establish a robust security framework that safeguards against potential threats and ensures a secure operating environment in the cannabis industry.

Personnel Security Training and Responsibilities for California Cannabis Businesses

Employees working in California’s evolving cannabis industry establishments should be well-versed in security protocols and procedures. Responsible personnel must oversee the implementation of security measures, ensuring that doors are locked, surveillance systems are operational, and access controls are enforced. These steps will protect a business’s assets, customers, and uphold compliance.

Through robust security protocols, access controls, and state-of-the-art security systems, your cannabis business in California can thrive while fostering a secure environment for all stakeholders.