935 Mass. Reg. 500.110

Current through Register 1520, April 26, 2024

Section 500.110 - Security Requirements for Marijuana Establishments

(1)General Requirements. A Marijuana Establishment shall implement sufficient security measures to deter theft of Marijuana and Marijuana Products, prevent unauthorized entrance into areas containing Marijuana and Marijuana Products and ensure the safety of Marijuana Establishment employees, Consumers and the general public. Security measures taken by the Licensee to protect the Premises, employees, Marijuana Establishment Agents, Consumers and general public shall include, but not be limited to, the following:

(a) Positively identifying individuals seeking access to the Premises of the Marijuana Establishment or to whom or Marijuana Products are being transported pursuant to 935 CMR 500.105(13) or delivered pursuant to 935 CMR 500.145 to limit access solely to individuals 21 years of age or older;

(b) Adopting procedures to prevent loitering and ensure that only individuals engaging in activity expressly or by necessary implication permitted by 935 CMR 500.000 and its enabling statute are allowed to remain on the Premises;

(c) Disposing of Marijuana in accordance with 935 CMR 500.105(12) in excess of the quantity required for normal, efficient operation as established within 935 CMR 500.105;

(d) Securing all entrances to the Marijuana Establishment to prevent unauthorized access;

(e) Establishing Limited Access Areas pursuant to 935 CMR 500.110(4), which, after receipt of a final License, shall be accessible only to specifically authorized personnel, limited to include only the minimum number of employees essential for efficient operation;

(f) Storing all Finished Marijuana Products in a secure, locked safe or vault in such a manner as to prevent diversion, theft and loss;

(g) Keeping all safes, vaults, and any other equipment or areas used for the production, cultivation, harvesting, Processing or storage, including prior to disposal, of Marijuana or Marijuana Products securely locked and protected from entry, except for the actual time required to remove or replace Marijuana;

(h) Keeping all locks and security equipment in good working order;

(i) Prohibiting keys, if any, from being left in the locks or stored or placed in a location accessible to persons other than specifically authorized personnel;

(j) Prohibiting accessibility of security measures, such as combination numbers, passwords or electronic or biometric security systems, to persons other than specifically authorized personnel;

(k) Ensuring that the outside perimeter of the Marijuana Establishment is sufficiently lit to facilitate surveillance, where applicable;

(l) Ensuring that all Marijuana Products are kept out of plain sight and are not visible from a public place, outside of the Marijuana Establishment, without the use of binoculars, optical aids or aircraft;

(m) Developing emergency policies and procedures for securing all product following any instance of diversion, theft or loss of Marijuana, and conduct an assessment to determine whether additional safeguards are necessary;

(n) Developing sufficient additional safeguards as required by the Commission for Marijuana Establishments that present special security concerns;

(o) At Marijuana Establishments where transactions are conducted in cash, establishing procedures for safe cash handling and cash transportation to financial institutions to prevent theft, loss and associated risks to the safety of employees, customers and the general public;

(p) Sharing the Marijuana Establishment's floor plan or layout of the facility with Law Enforcement Authorities, and in a manner and scope as required by the municipality and identifying when the use of flammable or combustible solvents, chemicals or other materials are in use at the Marijuana Establishment; and

(q) Sharing the Marijuana Establishment's security plan and procedures with Law Enforcement Authorities, police and fire departments, if the plans or procedures are modified in a material way, including the addition of plans to deliver directly to Consumers in the case of a Marijuana Retailer or Marijuana Establishment with a Delivery Endorsement.

(2)Alternative Security Provisions.

(a) Notwithstanding the requirements specified in 935 CMR 500.110(1), (5) through (7), if a Marijuana Establishment has provided other, specific safeguards that may be regarded as an adequate substitute for those requirements, such measures may be taken into account by the Commission in evaluating the overall required security measures. For purposes of cash handling and cash transportation, only alternative safeguards that comply with the requirements of 935 CMR 500.110(7)(b) shall be considered to be adequate substitutes.

(b) The applicant or Licensee shall submit a request for an alternative security provision to the Commission on a form as determined and made available by the Commission. On receipt of the form, the Commission shall submit the request to the chief law enforcement officer in the municipality where the Marijuana Establishment is located or will be located. The Commission shall request that the chief law enforcement officer review the request and alternative security provision requested and, within 30 days;

1. certify the sufficiency of the requested alternate security provision; or

2. provide the Commission with a statement of reasons why the alternative security provision is not sufficient in the opinion of the chief law enforcement officer.

(c) The Commission shall take the chief law enforcement officer's opinion under consideration in determining whether to grant the alternative security provision, provided that it shall not be determinative. If no response is received from the chief law enforcement officer or a delegee within 30 days of submitting the request to the chief law enforcement officer, the Commission shall proceed with a determination.

(3)Buffer Zone. A Marijuana Establishment Entrance may not be closer than 500 feet from the nearest School Entrance, unless a city or town adopts an ordinance or bylaw that reduces the distance requirement.

(a) The buffer zone distance of 500 feet shall be measured in a straight line from the geometric center of the Marijuana Establishment Entrance to the geometric center of the nearest School Entrance, unless there is an Impassable Barrier within those 500 feet; in these cases, the buffer zone distance shall be measured along the center of the shortest publicly-accessible pedestrian travel path from the geometric center of the Marijuana Establishment Entrance to the geometric center of the nearest School Entrance.

(b) The buffer zone distance of 500 feet may be reduced if a city or town adopts an ordinance or bylaw that reduces the distance requirement.

(4)Limited Access Areas.

(a) All Limited Access Areas shall be identified by the posting of a sign that shall be a minimum of 12" x 12" and which states: "Do Not Enter - Limited Access Area - Access Limited to Authorized Personnel Only" in lettering no smaller than one inch in height.

(b) All Limited Access Areas shall be clearly described by the filing of a diagram of the licensed Premises, in the form and manner determined by the Commission, reflecting entrances and exits, including loading areas, walls, partitions, counters, Propagation, Vegetation, Flowering, Processing, production, storage, disposal and retail sales areas.

(c) At all times following receipt of a final License, access to Limited Access Areas shall be restricted to employees, agents, or volunteers specifically permitted by the Marijuana Establishment, agents of the Commission, Commission Delegees, and state and local Law Enforcement Authorities acting within their lawful jurisdictions, police and fire departments, and emergency medical services acting in the course of their official capacity.

(d) Employees of the Marijuana Establishment shall visibly display an employee identification badge issued by the Marijuana Establishment at all times while at the Marijuana Establishment or transporting Marijuana.

(e) Following receipt of a final License, all outside vendors, contractors, and Visitors shall obtain a Visitor Identification Badge prior to entering a Limited Access Area and shall be escorted at all times by a Marijuana Establishment Agent authorized to enter the Limited Access Area. The Visitor Identification Badge shall be visibly displayed at all times while the Visitor is in any Limited Access Area. All Visitors shall be logged in and out and that log shall be available for inspection by the Commission at all times. All Visitor Identification Badges shall be returned to the Marijuana Establishment on exit.

(f) A Marijuana Establishment conducting operations under multiple license types on a single Premise may establish Limited Access Areas for each licensed activity that overlap in shared hallways and access points, provided that operations under each license type are segregated and a Marijuana Establishment Agent has access only to the areas where activities are conducted pursuant to the license under which the Marijuana Establishment Agent is registered.

(5)Security and Alarm Requirements for Marijuana Establishments Operating Enclosed Areas .

(a) A Marijuana Establishment located, in whole or in part, in a building, Greenhouse, Warehouse, or other Enclosed Area shall have an adequate security system to prevent and detect diversion, theft or loss of Marijuana or unauthorized intrusion, utilizing commercial grade equipment which shall, at a minimum, include:

1. A perimeter alarm on all building entry and exit points and perimeter windows, if any;

2. A failure notification system that provides an audible, text or visual notification of any failure in the security system. The failure notification system shall provide an alert to designated employees of the Marijuana Establishment within five minutes after the failure, either by telephone, email or text message;

3. A Duress Alarm, Panic Alarm or Holdup Alarm connected to local public safety or Law Enforcement Authorities;

4. Video cameras in all areas that may contain Marijuana or vaults or safes for the purpose of securing cash, at all points of entry and exit and in any parking lot which shall be appropriate for the normal lighting conditions of the area under surveillance. The cameras shall be directed at all safes, vaults, sales areas and areas where Marijuana is cultivated, harvested, Processed, prepared, stored, handled or dispensed, or where cash is kept and processed. Cameras shall be angled so as to allow for the capture of clear and certain identification of any Person entering or exiting the Marijuana Establishment or area;

5. Recordings from all video cameras which shall be enabled to record 24 hours each day and be available for immediate viewing by the Commission on request for at least the preceding 90 calendar days or the duration of a request to preserve the recordings for a specified period of time made by the Commission, whichever is longer. Video cameras may use motion detection sensors to begin recording, so long as the motion detection sensor system provides an alert to designated employees of the Marijuana Establishment in a manner established in the Marijuana Establishment's written security procedures and approved by the Commission or a Commission Delegee. If a Marijuana Establishment receives notice that the motion detection sensor is not working correctly, it shall take prompt action to make corrections and document those actions. Recordings may not be destroyed or altered, and shall be retained as long as necessary if the Marijuana Establishment is aware of a pending criminal, civil or administrative investigation or legal proceeding for which the recording may contain relevant information;

6. The ability to immediately produce a clear, color still image whether live or recorded;

7. A date and time stamp embedded in all recordings, which shall be synchronized and set correctly at all times and may not significantly obscure the picture;

8. The ability to remain operational during a power outage for a minimum of four hours and, if it appears likely that the outage will last for more than four hours, the Marijuana Establishment takes sufficient steps to ensure security on the Premises in consultation with the Commission; and

9. A video recording that allows for the exporting of still images in an industry standard image format, including.jpg,.bmp and.gif. Exported video shall have the ability to be archived in a proprietary format that ensures authentication of the video and guarantees that no alteration of the recorded image has taken place. Exported video shall also have the ability to be saved in an industry standard file format that may be played on a standard computer operating system. All recordings shall be erased or destroyed prior to disposal.

(b) All security system equipment and recordings shall be maintained in a secure location so as to prevent theft, loss, destruction and alterations.

(c) In addition to the requirements listed in 935 CMR 500.110(5)(a) and (b), the Marijuana Establishment shall have a back-up alarm system, with all the capabilities of the primary system, provided by a company supplying commercial grade equipment, which may not be the same company supplying the primary security system, or shall demonstrate to the Commission's satisfaction alternate safeguards to ensure continuous operation of a security system.

(e) A current list of authorized employees and service personnel that have access to the surveillance room shall be available to the Commission on request. If the surveillance room is on-site of the Marijuana Establishment, it shall remain locked and may not be used for any other function.

(f) All security equipment shall be in good working order and shall be inspected and tested at regular intervals, not to exceed 30 calendar days from the previous inspection and test.

(g) Trees, bushes and other foliage outside of the Marijuana Establishment shall be maintained so as to prevent a Person or Persons from concealing themselves from sight.

(6)Security and Alarm Requirements for Marijuana Establishments Operating Outdoors.

(a) A Marijuana Establishment that is outdoors shall implement adequate security measures to ensure that outdoor areas are not readily accessible to unauthorized individuals and to prevent and detect diversion, theft or loss of Marijuana which shall, at a minimum, include:

1. A perimeter security fence designed to prevent unauthorized entry to the cultivation facility with signs notifying observers that it is a Limited Access Area;

2. Commercial-grade, nonresidential locks;

3. A security alarm system that shall:

a. be continuously monitored, whether electronically, by a monitoring company or other means determined to be adequate by the Commission; and

b. provide an alert to designated employees of the Marijuana Establishment within five minutes after a notification of an alarm or a system failure, either by telephone, email or text message.

4. Video cameras at all points of entry and exit and in any parking lot which shall be appropriate for the normal lighting conditions of the area under surveillance. The cameras shall be directed at all safes, vaults, sales areas, and areas where Marijuana is cultivated, harvested, Processed, prepared, stored, handled, Transferred or dispensed and for the purpose of securing cash. Cameras shall be angled so as to allow for the capture of clear and certain identification of any Person entering or exiting the Marijuana Establishment or area;

5. 24-hour recordings from all video cameras that are available immediate viewing by the Commission on request and that are retained for at least 90 calendar days. Recordings may not be destroyed or altered, and shall be retained as long as necessary if the Marijuana Establishment is aware of a pending criminal, civil or administrative investigation or legal proceeding for which the recording may contain relevant information;

6. The ability to immediately produce a clear, color still image whether live or recorded;

7. A date and time stamp embedded in all recordings, which shall be synchronized and set correctly at all times and may not significantly obscure the picture;

8. The ability to remain operational during a power outage; and

(b) All security system equipment and recordings shall be maintained in a secure location so as to prevent theft, loss, destruction and alterations.

(c) In addition to the requirements listed in 935 CMR 500.110(6)(a) and (b), the Marijuana Establishment shall have a back-up alarm system, with all capabilities of the primary system, provided by a company supplying commercial grade equipment, which may not be the same company supplying the primary security system, or shall demonstrate to the Commission's satisfaction alternate safeguards to ensure continuous operation of a security system.

(d) Access to surveillance areas shall be limited to Persons that are essential to surveillance operations, Law Enforcement Authorities acting within their lawful jurisdiction, police and fire departments, security system service personnel and the Commission. A current list of authorized employees and service personnel that have access to the surveillance room shall be available to the Commission on request. If the surveillance room is on-site of the Marijuana Establishment, it shall remain locked and may not be used for any other function.

(e) All security equipment shall be in good working order and shall be inspected and tested at regular intervals, not to exceed 30 calendar days from the previous inspection and test.

(f) Security plans and procedures shared with Law Enforcement Authorities pursuant to 935 CMR 500.110(1)(o) shall include:

1. A description of the location and operation of the security system, including the location of the central control on the Premises;

2. A schematic of security zones;

3. the name of the security alarm company and monitoring company, if any;

4. A floor plan or layout of the facility in a manner and scope as required by the municipality; and

5. A safety plan for the Manufacture and production of Marijuana Products as required pursuant to 935 CMR 500.101(3)(c)3.

(7)Cash Handling and Transportation Requirements.

(a) A Marijuana Establishment with a contract to deposit funds with a financial institution that conducts any transaction in cash shall establish and implement adequate security measures and procedures for safe cash handling and cash transportation to financial institutions or DOR facilities to prevent theft and loss, and to mitigate associated risks to the safety of employees, customers and the general public. Adequate security measures shall include:

1. An on-site secure locked safe or vault maintained in an area separate from retail sales areas used exclusively for the purpose of securing cash;

2. Video cameras directed to provide images of areas where cash is kept, handled and packaged for transport to financial institutions or DOR facilities, provided that the cameras may be motion-sensor activated cameras and provided, further, that all cameras be able to produce a clear, still image whether live or recorded;

3. A written process for securing cash and ensuring transfers of deposits to the Marijuana Establishment's financial institutions and DOR facilities on an incremental basis consistent with the requirements for deposit by the financial institution or DOR facilities; and

4. Use of an armored transport provider that is licensed pursuant to M.G.L. c. 147, § 25 (watch, guard or patrol agency) and has been approved by the financial institution or DOR facility.

(b) Notwithstanding the requirement of 935 CMR 500.110(7)(a)4., a Marijuana Establishment may request an alternative security provision under 935 CMR 500.110(2) for purposes of cash transportation to financial institutions and DOR facilities. Any approved alternative security provision shall be included in the security plan shared with law enforcement in the municipality in which the Marijuana Establishment is licensed and periodically updated as required under 935 CMR 500.110(1)(q). To be determined to provide a sufficient alternative, any such alternative safeguard shall include, but may not be limited to:

1. Requiring the use of a locked bag for the transportation of cash from a Marijuana Establishment to a financial institution or DOR facility;

2. Requiring any transportation of cash be conducted in an unmarked vehicle;

3. Requiring two registered Marijuana Establishment Agents employed by the Licensee to be present in the vehicle at all times during transportation of deposits;

4. Requiring real-time GPS tracking of the vehicle at all times when transporting cash;

5. Requiring access to two-way communications between the transportation vehicle and the Marijuana Establishment;

6. Prohibiting the transportation of Marijuana or Marijuana Products at the same time that cash is being transported for deposit to a financial institution or DOR facility; and

7. Approval of the alternative safeguard by the financial institution or DOR facility.

(c) All written safety and security measures developed under 935 CMR 500.110(7) shall be treated as security planning documents, the public disclosure of which would jeopardize public safety.

(8)Security Requirements for Delivery Licensee or a Marijuana Establishment with Delivery Endorsement Operations.

(a) A Marijuana Establishment licensed as a Delivery Licensee or a Marijuana Establishment with a Delivery Endorsement shall implement adequate security measures to ensure that each vehicle used for transportation of Marijuana and Marijuana Products is not readily accessible to unauthorized individuals and to prevent and detect diversion, theft or loss of Marijuana. Security measures shall, at a minimum, include for each operational delivery vehicle:

1. A vehicle security system that includes an exterior alarm;

2. A secure, locked storage compartment in each vehicle and not easily removable for the purpose of transporting the Marijuana or Marijuana Products;

3. A secure, locked storage compartment in each vehicle that is not easily removable for the purpose of transporting and securing cash used as payment for deliveries of Marijuana or Marijuana Products;

4. A means of secure communication between each vehicle and the Marijuana Establishment's dispatching location which shall be capable of being monitored at all times that a vehicle is performing a delivery route. Means of communication shall include:

a. Two-way digital or analog radio (UHF or VHF);

b. Cellular phone; or

c. Satellite phone.

5. A global positioning system (GPS) monitoring device that is:

a. Not a mobile device and that is attached to the vehicle at all times that the vehicle contains Marijuana or Marijuana Products; and

b. Monitored by the Delivery Licensee or a Marijuana Establishment with a Delivery Endorsement at a fixed location during the transportation of Marijuana or Marijuana Products for the purpose of home delivery with location checks occurring at least every 30 minutes. The Delivery Licensee or a Marijuana Establishment with a Delivery Endorsement may delegate monitoring of the GPS to the Third-party Technology Platform Provider with which the Delivery Licensee or a Marijuana Establishment with a Delivery Endorsement has a contract, provided that the Delivery Licensee or a Marijuana Establishment with a Delivery Endorsement shall be responsible for ensuring that monitoring occurs as required under 935 CMR 500.110(8).

6. A video system that includes one or more video cameras in the storage area of the vehicle and one or more video cameras in the driver area of the vehicle and which shall remain operational at all times during the entire transportation process and which shall have:

a. The ability to produce a clear color still photo whether live or recorded; and

b. A date and time stamp embedded in all recordings which shall be synchronized and set correctly at all times and may not significantly obscure the picture.

7. All security equipment in each vehicle shall be in good working order and shall be inspected and tested at regular intervals, not to exceed 30 calendar days from the previous inspection and test.

(b) A Delivery Licensee or a Marijuana Establishment with a Delivery Endorsement Agents engaged in the delivery of Marijuana or Marijuana Products to a Consumer shall have on their person an operational body camera during all times that the Marijuana Establishment Agent is outside of the delivery vehicle for the purpose of transacting a delivery

1. The body camera shall record all deliveries.

2. Consumers shall be notified of the use of body cameras to record delivery transactions at the time of order, on the proof of order and by the Marijuana Establishment agent on arrival at the Residence.

3. In addition to providing notice, body cameras shall be displayed conspicuously on the Marijuana Establishment Agent's person.

4. A Delivery Licensee or a Marijuana Establishment with a Delivery Endorsement shall maintain video from body cameras confidentially and protected from disclosure to the full extent allowed by law. The Licensee shall implement data security, records retention, and record destruction policies for body camera video in compliance with applicable federal and state privacy laws including, but not limited to, the Driver Privacy Protection Act, 18 USC § 2721, the Massachusetts Identify Theft Act, M.G.L. c. 93H, 201 CMR 17.00: Standards for the Protection of Personal Information of Residents of the Commonwealth, and the Fair Information Practices Act, M.G.L. c. 66A.

5. Video of deliveries shall be retained for a minimum of 30 days, or, with notice to the Delivery Licensee or Marijuana Establishment with a Delivery Endorsement, for the duration of an investigation by the Commission or by law enforcement, whichever is longer. To obtain video from a Licensee as part of an investigation, Commission staff shall consult with the Executive Director and to the extent possible, view the video at the place of storage.

6. A Delivery Licensee or a Marijuana Establishment with a Delivery Endorsement may not share or disclose any portion of the information or video footage collected as the result of the use of a body camera pursuant to 935 CMR 500.110(8)(b) to any third-party not explicitly authorized by 935 CMR 500.000 to have access to that video footage, subject to the exceptions in 935 CMR 500.110(8)(b)6.a. and b.

a. A Licensee or Marijuana Establishment shall make video footage available to law enforcement officers acting in his or her official capacity pursuant to a validly issued court order or search warrant demonstrating probable cause.

b. Nothing in 935 CMR 500.110(8)6. shall prohibit law enforcement from performing a constitutionally valid search or seizure including, but not limited to, circumstances that present an imminent danger to safety, and other exceptional or emergency circumstances where time or opportunity to apply for a warrant is lacking.

7. Unless retained for investigative purposes, the Licensee shall erase or otherwise destroy videos after the 30-day retention period.

(c) Delivery Licensee or a Marijuana Establishment with a Delivery Endorsements transporting Marijuana and Marijuana Products for home delivery shall ensure that all vehicles used for deliveries are staffed with a minimum of two Marijuana Establishment Agents. At least one Marijuana Establishment Agent shall remain with the vehicle at all times that the vehicle contains Marijuana or Marijuana Products.

(d) All Marijuana Establishment Agents acting as delivery employees of a Delivery Licensee or a Marijuana Establishment with a Delivery Endorsement must have attended and successfully completed Responsible Vendor Training Basic Core Curriculum and Delivery Core Curriculum courses in accordance with 935 CMR 500.105(2)(b) prior to making a delivery.

(e) A Marijuana Establishment Agent shall document and report any unusual discrepancy in inventory to the Commission and the local Law Enforcement Authorities in which the establishment is licensed within 24 hours of the discovery of such a discrepancy.

(f) A Delivery Licensee or a Marijuana Establishment with a Delivery Endorsement shall report to the Commission and local law enforcement any vehicle accidents, diversions, losses, or other reportable incidents that occur during transport immediately and, under no circumstances, more than 24 hours of becoming aware of any accidents, diversions, losses, or other reportable incidents and shall otherwise comply with the incident reporting requirements set forth under 935 CMR 500.110(9).

(g) The following individuals shall have access to Delivery Licensee or a Marijuana Establishment with a Delivery Endorsement operations and vehicles, including video recordings:

1. Representatives of the Commission in the course of responsibilities authorized by M.G.L. c. 94G or 935 CMR 500.000;

2. Representatives of other state agencies acting within their jurisdiction; and

3. Law Enforcement Authorities and emergency medical services in the course of responding to an emergency.

(h)935 CMR 500.000 shall not be construed to prohibit access to authorized state or local Law Enforcement Authorities or public health, inspectional services, or other permit-granting agents acting within their lawful jurisdiction.

(i) All vehicles used by the Delivery Licensee or a Marijuana Establishment with a Delivery Endorsement for home delivery are subject to inspection and approval by the Commission prior being put into use. It shall be the Delivery Licensee or a Marijuana Establishment with a Delivery Endorsements responsibility to make the Commission aware of its intent to introduce a new vehicle into operation and ensure an inspection of the vehicle prior to commencing operation.

(j) Firearms are strictly prohibited from Delivery Licensee or a Marijuana Establishment with a Delivery Endorsement vehicles and from Marijuana Establishment Agents performing home deliveries.

(9)Incident Reporting.

(a) A Marijuana Establishment shall notify appropriate Law Enforcement Authorities and the Commission of any breach of security or other reportable incident defined in 935 CMR 500.110(9) immediately and, in no instance, more than 24 hours following discovery of the breach or incident. Notification shall occur, but not be limited to, during the following occasions:

1. Discovery of inventory discrepancies;

2. Diversion, theft or loss of any Marijuana Product;

3. Any criminal action involving or occurring on or in the Marijuana Establishment Premises or Licensee or agent;

4. Any suspicious act involving the sale, cultivation, distribution, Processing or production of Marijuana by any Person;

5. Unauthorized destruction of Marijuana;

6. Any loss or unauthorized alteration of records related to Marijuana;

7. An alarm activation or other event that requires response by public safety personnel, including but not limited to local law enforcement, police and fire departments, public works or municipal sanitation departments, and municipal inspectional services departments, or security personnel privately engaged by the Marijuana Establishment;

8. The failure of any security alarm system due to a loss of electrical power or mechanical malfunction that is expected to last more than eight hours;

9. A significant motor vehicle crash that occurs while transporting or delivering Marijuana or Marijuana Products and would require the filing of a Motor Vehicle Crash Operator Report pursuant to M.G.L. c. 90 § 26; provided however that a motor vehicle crash that renders the Licensee's vehicle inoperable shall be reported immediately to state and local law enforcement so that Marijuana or Marijuana Products may be adequately secured; or

10. Any other breach of security.

(b) A Marijuana Establishment shall, within ten calendar days, provide notice to the Commission of any incident described in 935 CMR 500.110(9)(a) by submitting an incident report in the form and manner determined by the Commission which details the circumstances of the event, any corrective action taken, and confirmation that the appropriate Law Enforcement Authorities were notified.

(c) All documentation related to an incident that is reportable pursuant to 935 CMR 500.110(9)(a) shall be maintained by a Marijuana Establishment for not less than one year or the duration of an open investigation, whichever is longer, and made available to the Commission and Law Enforcement Authorities within their lawful jurisdiction on request.

(10)Security Audits. A Marijuana Establishment shall, on an annual basis, obtain at its own expense, a security system audit by a vendor approved by the Commission. A report of such audit shall be submitted, in a form and manner determined by the Commission, no later than 30 calendar days after the audit is conducted. If the audit identifies concerns related to the establishment's security system, the Marijuana Establishment shall also submit a plan to mitigate those concerns within ten business days of submitting the audit