OHIO CANNABIS BUSINESS SECURITY
KNOWLEDGE CENTER

Created to provide helpful information about the Ohio cannabis industry

OHIO CANNABIS LICENSE INFO

Please note; while we aim to keep these pages fully up to date with the latest information, cannabis laws are always changing. We encourage you to verify these rules and regulations in the official legal text, which we’ve linked throughout the page for your convenience.

For compliance requirements related to cannabis seed to sale tracking and reporting for growers, manufacturers, and dispensaries in Ohio, click here!

Click here for program webpage

Ohio Cannabis Business Security Requirements

*Please note that this section encompasses only the compliance requirements relevant to business security. Many parts of the rules and regulation shave been removed to focus exclusively on the security compliance aspects. To view the full set of rules and regulations for Ohio, click here!

Ohio Business Security Requirements for Cannabis Licensees

You can view the program webpage here.

A Full List Of Rules & Regulations

Cultivators:

3796:2-2-05 Cultivator security.

  • (A) The department shall determine the appropriate storage and security requirements for all cultivator facilities and may require additional safeguards to ensure the security of medical marijuana. A cultivator shall comply with the security plan submitted as part of its cultivator provisional license application. At a minimum, the cultivator shall do the following:
    • (1) Install an adequate security alarm system around the perimeter of the facility to prevent and detect diversion, theft, or loss of medical marijuana utilizing commercial grade equipment;
    • (2) Maintain or construct fencing to prevent unauthorized entry or access to waste disposal containers, disposal areas or compost areas located outside the facility;
    • (3) Utilize a video surveillance recording system installed by a vendor that is approved by the department and meets the standards required by the department to prevent and detect diversion, theft or loss of medical marijuana;
    • (4) Maintain all security system equipment and video surveillance systems in a secure location so as to prevent theft, loss, destruction or alterations;
      • (a) A cultivator shall limit access to surveillance areas to type 1 key employee that are essential to surveillance operations, law enforcement agencies, security system service employees, the department, and others when approved by the department.
      • (b) A cultivator shall make available to the department, upon request, a current list of type 1 key employees and contractors who have access to the surveillance rooms. A cultivator shall keep all on-site surveillance rooms locked and shall not use such rooms for any other functions.
    • (5) Keep all approved safes, approved vaults, or any other approved equipment or areas used for cultivating, harvesting, or storing of medical marijuana, securely locked and protected from unauthorized access to medical marijuana;
    • (6) Ensure the outside perimeter of the cultivator is well-lit and in accordance with the cultivator’s plan in its license application;
    • (7) Restrict access to any area within a cultivator containing medical marijuana except registered employees and agents or an individual permitted to access the facility under the supervision of a registered employee or agent in accordance with the visitor authorization procedures set forth in this chapter;
    • (8) Limit the use of combination numbers, passwords, or electronic or biometric security systems to registered, authorized employees and prevent the sharing of any employee-specific access credentials; and
    • (9) Not allow keys to be left in the locks and not store or place keys or badges in a location accessible to persons other than registered, authorized employees.
  • (B) The cultivator shall install a security alarm system and a video surveillance recording system under paragraph (A) of this rule. A security alarm system and video surveillance recording system shall, at a minimum, contain the following:
    • (1) A system designed to detect motion and identify unauthorized access to the facility;
    • (2) Video cameras that capture the entire facility, including direct placement near the entrances, exits, and parking areas to capture a clear and certain identification of any person entering or exiting the facility, which shall be appropriate for the normal lighting conditions of the area under surveillance;
    • (3) Video cameras shall be directed at all approved safes, approved vaults, and any other area where medical marijuana is being cultivated, harvested, stored, or handled;
    • (4) The video surveillance recording system shall comply with the following minimum capabilities:
      • (a) Provide a direct feed and login capabilities to the department to allow for real-time access and monitoring of the facility via the live video surveillance recording system;
      • (b) A display monitor with a minimum screen size of twelve inches shall be connected to the electronic recording security system at all times;
      • (c) Installed in a manner that will prevent cameras from being readily obstructed, tampered with, or disabled;
      • (d) The ability to immediately produce a clear color still photo that is a minimum of 9600 dpi from any camera image (live or recorded);
      • (e) A date and time stamp embedded on all recordings. The date and time shall be synchronized and set correctly and shall not significantly obscure the picture;
      • (f) Cameras installed outdoors and in low-light interior areas shall be day/night cameras with a minimum resolution of 600 lines per inch (analog) or D1 (IP) and a minimum light factor requirement of 0.7 LUX. The installation of additional lighting may be required to increase picture clarity and brightness. Cameras shall be calibrated and focused to maximize the quality of the recorded image;
      • (g) Allow for the exporting of still images in an industry standard image format, including .jpg, .bmp and .gif. Exported video shall have the ability to be archived in a proprietary format that ensures authentication of the video and guarantees that no alteration of the recorded image has taken place. Exported video shall also have the ability to be saved in an industry standard file format that can be played on a standard computer operating system. All recordings shall be erased or destroyed prior to disposal;
      • (h) Security recordings shall provide an image resolution of at least D1, and the image frame rate shall be at least thirty frames per second during alarm or motion based recording; and
      • (i) Repair or replace any failed component of the video surveillance recording system within twenty-four hours, unless notice is provided to the department and an extension is approved.
    • (5) Twenty-four hour live feed with motion-activated recording capabilities from all video cameras, which the cultivation facility shall make available for immediate viewing by the department upon request and shall retain the recordings for at least forty-five days. If a cultivator is aware of a pending criminal, civil or administrative investigation or legal proceeding for which a recording may contain relevant information, the cultivator shall retain an unaltered copy of the recording until the investigation or proceeding is closed or the entity conducting the investigation or proceeding notifies the cultivator that it is not necessary to retain the recording;
    • (6) Silent alarm, which can be utilized in the event of a holdup or other instances of duress, which notifies law enforcement;
    • (7) Panic alarm, which means an audible security alarm system signal generated by the manual activation of a device intended to signal a life-threatening or emergency situation requiring a law enforcement response;
    • (8) Automatic voice dialer, which means any electrical, electronic, mechanical, or other devices capable of being programmed to send a prerecorded voice message, when activated, over a telephone line, radio, or other communication systems, to law enforcement, public safety, or emergency services agency requesting dispatch;
    • (9) The failure notification system that provides an audible, text, or visual notification of any failure in the surveillance system. The failure notification system shall provide an alert to the cultivation facility within five minutes of the failure, either by telephone, email, or text message; and
    • (10) The ability to comply with the security requirements of this rule for a period of at least forty-eight hours during a power outage.
  • (C) In addition to the requirements listed in paragraph (B) of this rule, each cultivator shall have a back-up alarm system approved by the department that shall detect unauthorized entry during times when no employees are present at the facility and that shall be provided by a company supplying commercial grade equipment, which shall not be the same company supplying the primary security system.
  • (D) A cultivator shall keep all security equipment in good working order and the systems shall be inspected and all devices tested on an annual basis by a third party.

Processors

3796:3-2-05 Processor security.

  • (A) The department shall determine the appropriate storage and security requirements for all processor facilities and may require additional safeguards to ensure the security of medical marijuana. A processor shall comply with the security plan submitted as part of its processor provisional license application. At a minimum, the processor shall:
    • (1) Install an adequate security alarm system around the perimeter of the facility to prevent and detect diversion, theft, or loss of medical marijuana, utilizing commercial grade equipment;
    • (2) Maintain or construct fencing and gates that surround the facility to prevent unauthorized entry to the facility or unauthorized access to waste disposal containers located outside the facility;
    • (3) Utilize a video surveillance recording system installed by a vendor that is approved by the department and that meets the standards required by the department to prevent and detect diversion, theft, or loss of medical marijuana;
    • (4) Maintain all security system equipment and video surveillance systems in a secure location so as to prevent theft, loss, destruction, or alterations:
      • (a) A processor shall limit access to surveillance areas to type 1 key employees that are essential to surveillance operations, law enforcement agencies, security system service employees, the department, and others when approved by the department; and
      • (b) A processor shall make available to the department, upon request, a current list of type 1 key employees and contractors who have access to the surveillance room. A processor shall keep all on-site surveillance rooms locked and shall not use such rooms for any other functions.
    • (5) Keep all approved safes, vaults, or any other approved equipment or areas used for processing or storing of plant material, medical marijuana extract, and medical marijuana products securely locked and protected from unauthorized access;
    • (6) Ensure the outside perimeter of the facility is well-lit and in accordance with the processor’s plan in its license application;
    • (7) Restrict access to any area within the facility containing plant material, medical marijuana extract, or medical marijuana products to all persons except licensed employees and agents or an individual permitted to access the facility under the supervision of a licensed employee or agent in accordance with the visitor authorization procedures set forth in rule 3796:5-2-01 of the Administrative Code;
    • (8) Limit the use of combination numbers, passwords, or electronic or biometric security systems to licensed, authorized employees, and prevent the sharing of any employee-specific access credentials; and
    • (9) Not allow keys to be left in the locks and not store or place keys or badges in a location accessible to persons other than licensed, authorized employees.
  • (B) The processor shall install a security alarm system and a video surveillance recording system under paragraph (A) of this rule. A security alarm system and video surveillance recording system shall, at a minimum, contain the following:
    • (1) A system designed to detect motion and identify unauthorized access to the facility;
    • (2) Video cameras that capture the entire facility, including direct placement near the entrances, exits, and parking areas to capture a clear and certain identification of any person entering or exiting the facility, which shall be appropriate for the normal lighting conditions of the area under surveillance;
    • (3) Video cameras shall be directed at all approved safes, approved vaults, marijuana sales areas, and any other area where plant material, medical marijuana extract, or medical marijuana products are being processed, stored, or handled;
    • (4) The video surveillance recording system shall comply with the following minimum capabilities:
      • (a) Provide a direct feed and login capabilities to the department to allow for real-time access and monitoring of the facility via the live video surveillance recording system.
      • (b) A display monitor with a minimum screen size of twelve inches shall be connected to the electronic recording security system at all times.
      • (c) Installed in a manner that will prevent cameras from being readily obstructed, tampered with, or disabled.
      • (d) The ability to immediately produce a clear color still photo that is a minimum of ninety-six hundred dpi from any camera image, live or recorded.
      • (e) A date and time stamp embedded on all recordings. The date and time shall be synchronized and set correctly and shall not significantly obscure the picture.
      • (f) Cameras installed outdoors and in low-light interior areas shall be day/night cameras with a minimum resolution of six hundred lines per inch (analog) or D1 (IP) and a minimum light factor requirement of 0.7 LUX. The installation of additional lighting may be required to increase picture clarity and brightness. Cameras shall be calibrated and focused to maximize the quality of the recorded image.
      • (g) Allow for the exporting of still images in an industry standard image format, including .jpg, .bmp and .gif. Exported video shall have the ability to be archived in a proprietary format that ensures authentication of the video and guarantees that no alteration of the recorded image has taken place. Exported video shall also have the ability to be saved in an industry standard file format that can be played on a standard computer operating system. All recordings shall be erased or destroyed prior to disposal.
      • (h) Security recordings shall provide an image resolution of at least D1, and the image frame rate shall be at least three frames per second during alarm or motion based recording.
      • (i) Repair or replace any failed component of the video surveillance recording system within twenty-four hours, unless notice is provided to the department and an extension is approved.
    • (5) Twenty-four hour live feed with motion-activated recording capabilities from all video cameras, which the processor facility shall make available for immediate viewing by the department upon request and shall retain the recordings for at least forty-five days. If a processor is aware of a pending criminal, civil or administrative investigation or legal proceeding for which a recording may contain relevant information, the processor shall retain an unaltered copy of the recording until the investigation or proceeding is closed or the entity conducting the investigation or proceeding notifies the processor that it is not necessary to retain the recording;
    • (6) Silent alarm, which can be utilized in the event of a holdup or other instances of duress, which notifies law enforcement;
    • (7) Panic alarm, which for purposes of this subsection means an audible security alarm system signal generated by the manual activation of a device intended to signal a life-threatening or emergency situation requiring a law enforcement response;
    • (8) Automatic voice dialer, which for purposes of this subsection means any electrical, electronic, mechanical, or other devices capable of being programmed to send a prerecorded voice message, when activated, over a telephone line, radio or other communication systems, to law enforcement, public safety or emergency services agency requesting dispatch;
    • (9) A failure notification system that provides an audible, text or visual notification of any failure in the surveillance system. The failure notification system shall provide an alert to the processor facility within five minutes of the failure, either by telephone, email, or text message; and
    • (10) The ability to comply with the security requirements of this rule for a period of at least forty-eight hours during a power outage.
  • (C) In addition to the requirements listed in paragraph (B) of this rule, each processor shall have a back-up alarm system approved by the department that shall detect unauthorized entry during times when no employees are present at the facility and that shall be provided by a company supplying commercial grade equipment, which shall not be the same company supplying the primary security system.
  • (D) A processor shall keep all security equipment in good working order and the systems shall be inspected and all devices tested on an annual basis.

Labs

3796:4-2-07 Testing laboratory security.

  • (A) The department shall determine the appropriate security requirements for all testing laboratory facilities and may require additional safeguards to ensure the security of medical marijuana. A testing laboratory shall comply with the security plan submitted as part of its testing laboratory provisional license application. At a minimum, the testing laboratory shall:
    • (1) Install an adequate security alarm system around the perimeter, utilizing commercial grade equipment, to prevent and detect diversion, theft, or loss of medical marijuana;
    • (2) Utilize a video surveillance recording system installed by a vendor that is approved by the department and that meets the standards required by the department to prevent and detect diversion, theft, or loss of medical marijuana;
    • (3) Maintain all security system equipment and video surveillance systems in a secure location so as to prevent theft, loss, destruction, or alteration;
      • (a) A testing laboratory shall limit access to surveillance areas to type 1 key employees that are essential to surveillance operations, law enforcement agencies, security system service employees, the department, and others when approved by the department; and
      • (b) A testing laboratory shall make available to the department, upon request, a current list of type 1 employees and contractors who have access to the surveillance room. A testing laboratory shall keep all on-site surveillance rooms locked and shall not use such rooms for any other functions.
    • (4) Keep all approved safes, approved vaults, or any other approved equipment or areas used for storing medical marijuana samples securely locked and protected from unauthorized access;
    • (5) Ensure the outside perimeter of the facility is well-lit and in accordance with the testing laboratory’s plan in its license application;
    • (6) Restrict access to any area within the facility containing medical marijuana samples to all persons except licensed employees and agents or an individual permitted to access the facility under the supervision of a licensed employee or agent in accordance with the visitor authorization procedures set forth in rule 3796:5-2-01 of the Administrative Code.
    • (7) Limit the use of combination numbers, passwords, or electronic or biometric security systems to licensed, authorized employees, and prevent the sharing of any employee-specific access credentials; and
    • (8) Not allow keys to be left in the locks and not store or place keys or badges in a location accessible to persons other than licensed, authorized employees.
  • (B) The testing laboratory shall install a security alarm system and a video surveillance recording system under paragraph (A) of this rule. A security alarm system and video surveillance recording system shall, at a minimum, contain the following:
    • (1) A system designed to detect motion and identify unauthorized access to the facility;
    • (2) Video cameras in all areas that may contain medical marijuana samples, and at all points of entry and exit to capture a clear and certain identification of any person entering or exiting the facility, which shall be appropriate for the normal lighting conditions of the area under surveillance;
    • (3) Video cameras shall be directed at all approved safes, approved vaults, any other area where medical marijuana samples are being stored or handled;
    • (4) The security alarm system and video surveillance recording system shall comply with the following minimum capabilities:
      • (a) Provide a direct feed and login capabilities to the department to allow for real-time access and monitoring of the facility via the live video surveillance recording system.
      • (b) A display monitor with a minimum screen size of twelve inches shall be connected to the electronic recording security system at all times.
      • (c) Installed in a manner that will prevent cameras from being readily obstructed, tampered with, or disabled.
      • (d) The ability to immediately produce a clear color still photo that is a minimum of 9600 dpi from any camera image (live or recorded).
      • (e) A date and time stamp embedded on all recordings. The date and time shall be synchronized and set correctly and shall not significantly obscure the picture.
      • (f) Cameras installed outdoors and in low-light interior areas shall be day/night cameras with a minimum resolution of six hundred lines per inch (analog) or D1 (IP) and a minimum light factor requirement of 0.7 LUX. The installation of additional lighting may be required to increase picture clarity and brightness. Cameras shall be calibrated and focused to maximize the quality of the recorded image.
      • (g) Allow for the exporting of still images in an industry standard image format, including .jpg, .bmp and .gif. Exported video shall have the ability to be archived in a proprietary format that ensures authentication of the video and guarantees that no alteration of the recorded image has taken place. Exported video shall also have the ability to be saved in an industry standard file format that can be played on a standard computer operating system. All recordings shall be erased or destroyed prior to disposal.
      • (h) Security recordings shall provide an image resolution of at least D1, and the image frame rate shall be at least three frames per second during alarm or motion based recording.
      • (i) Repair and/or replace any failed component of the video surveillance recording system within twenty-four hours, unless notice is provided to the department and an extension is approved.
    • (5) Twenty-four hour live feed with motion-activated recording capabilities from all video cameras, which the testing laboratory shall make available for immediate viewing by the department upon request and shall retain for at least forty-five days. If a testing laboratory is aware of a pending criminal, civil or administrative investigation, or legal proceeding for which a recording may contain relevant information, the testing laboratory shall retain an unaltered copy of the recording until the investigation or proceeding is closed or the entity conducting the investigation or proceeding notifies the testing laboratory manager that it is not necessary to retain the recording;
    • (6) A silent alarm, which can be utilized in the event of a holdup or other instances of duress, which notifies law enforcement;
    • (7) Panic alarm, which for purposes of this subsection means an audible security alarm system signal generated by the manual activation of a device intended to signal a life-threatening or emergency situation requiring a law enforcement response;
    • (8) Automatic voice dialer, which for purposes of this paragraph means any electrical, electronic, mechanical, or other device capable of being programmed to send a prerecorded voice message, when activated, over a telephone line, radio or other communication system, to a law enforcement, public safety, or emergency services agency requesting dispatch;
    • (9) A failure notification system that provides an audible, text, or visual notification of any failure in the surveillance system. The failure notification system shall provide an alert to the testing laboratory within five minutes of the failure, either by telephone, email, or text message; and
    • (10) The ability to comply with the security requirements of this rule for a period of at least forty-eight hours during a power outage.
  • (C) In addition to the requirements listed in paragraph (B) of this rule, each testing laboratory shall have a back-up alarm system approved by the department that shall detect unauthorized entry during times when no employees are present at the facility and that shall be provided by a company supplying commercial grade equipment, which shall not be the same company supplying the primary security system.
  • (D) A testing laboratory shall keep all security equipment in good working order and the systems shall be inspected and all devices tested on an annual basis.

Dispensaries

3796:6-3-07 Security, control, and storage of medical marijuana at a dispensary.

  • (A) Pursuant rule 3796:6-3-05 of the Administrative Code, a designated representative shall provide supervision and control of medical marijuana and medical marijuana products and adequate safeguards to ensure that such items are dispensed in accordance with Chapter 3796. of the Revised Code and this division, by the following procedures:
    • (1) A licensed dispensary key employee shall provide personal supervision of the medical marijuana and medical marijuana products, order forms, all records relating to the dispensing of medical marijuana and medical marijuana products unless the state board of pharmacy has issued written approval to a dispensary allowing for the storage of records off-site.
    • (2) Whenever personal supervision of medical marijuana and medical marijuana products is not provided by a licensed dispensary key employee, physical or electronic security of such items must be provided according to the following requirements:
      • (a) The dispensary department, restricted access areas and stock of medical marijuana must each be secured by a physical barrier with suitable locks and an electronic barrier to detect entry at a time when licensed dispensary employees are not present. The physical barrier shall be constructed from floor to ceiling to separate the public entry area from the dispensary department. Such a barrier, before being put into use, must be approved by the state board of pharmacy.
      • (b) A restricted access area within the dispensary department must contain all medical marijuana, and if maintained on the licensed premises, all records relating to the dispensing of medical marijuana, and any other items required to be under the personal supervision of a licensed dispensary employee.
      • (c) A dispensary maintaining records at a location other than the premises licensed by the state board of pharmacy or via a computerized recordkeeping system shall maintain an executed agreement with the company possessing or storing the records authorizing an agent of the state board of pharmacy access to the records maintained in accordance with this rule within three business days, excluding weekends and holidays. The dispensary is obligated to ensure the board receives the records in the timeframe specified in this rule.
      • (d) No item, product, record, or equipment that must be accessible to anyone other than a licensed dispensary employee may be stored in restricted access areas.
      • (e) No medical marijuana may be sold or otherwise dispensed at any time the dispensary department is closed.
    • (3) Areas designated for the dispensing and storage of medical marijuana shall meet the security requirements in rule 3796:6-3-16 of the Administrative Code. No person may be within the physical confines of the area designated for dispensing or storage of medical marijuana unless under the personal supervision of a licensed dispensary employee.
  • (B) A dispensary shall store inventory on the licensed premises. All inventory stored on the licensed premises must be secured in restricted access areas and tracked in the inventory tracking system.
  • (C) A dispensary shall maintain adequate lighting, ventilation, temperature, humidity control, and equipment. Required equipment includes, but is not limited to, adequate personal protective equipment for employees.
  • (D) Containers storing expired, damaged, deteriorated, misbranded, adulterated or opened medical marijuana shall be separated from other medical marijuana until they are destroyed in accordance with the dispensary destruction policy. Expired, damaged, deteriorated, misbranded, or adulterated medical marijuana shall not be stored at the licensed dispensary for more than one week.
  • (E) The dispensary shall be maintained in a clean and orderly condition. It shall be free from infestation by insects, rodents, birds, or pests.
  • (F) Medical marijuana shall be stored at appropriate temperatures and under appropriate conditions to help ensure that its identity, strength, quality, and purity are not adversely affected.

Ohio is still in the process of finalizing all rules and regulations pertaining to medical marijuana. If you have any questions pertaining to the application process for Ohio or security requirements feel free to reach out to us by clicking here.

 

Why Choose Helix Cannabis Security?

Focused on Safety, Security, and Compliance

 

Our top priority is making sure your staff, your business, and your investment, are safe and secure. We provide cost-effective solutions to satisfy every    compliance requirement in your state as well as end-to-end expert security consultation, and of course, development and implementation of services.

Helix Dispensary Security Services

Compliance

Maintain full compliance with your state and local cannabis business security requirements through Helix’s full-service security firm. Our team of cannabis security experts have implemented compliance-centric security frameworks in dozens of legal cannabis markets for grow warehouses, manufacturing facilities, laboratories and dispensaries.

digital-security

360 Security Systems

From cameras and remote monitoring services to alarm systems and rapid response, Helix Digital Security Systems can address all of your security needs and beyond. Cover every square inch of your facility with comprehensive security camera systems, ensuring 24/7 visibility, DVR capabilities, and more.

physical-security

Security Training

Your staff isn’t expected to stop criminals in action, but ensuring your staff is trained on security best practices can provide essential steps in de-escalation, situational control, and threat identification to allow team members to resolve a situation before it arises.

Want to learn more about Helix Security’s comprehensive services and expertise?

Remote, Eyes-On Monitoring

monitoring

The most-cost effective approach to 24/7 active monitoring of your legal cannabis business.

Remote monitoring provides live, eyes-on guards monitoring your business security camera systems 24 hours a day, 7 days a week. Our guards will activate timely response times and ensure your business is secure, especially when you can’t be there.

At Helix Cannabis Security, we consider it a cannabis security best practice to have guards on-site at your facility at all times that people are present. If people are not present on the premise, there’s no need to risk the safety of a security guard. Remote monitoring provides the same, high-level attention and security, without risking a guards life, or incurring unnecessary costs.

Click to learn more.

Receive Our Pricing Guide