N.Y. Comp. Codes R. & Regs. tit. 9 § 125.3

Current through Register Vol. 46, No. 36, September 4, 2024

Section 125.3 - Security and Storage of Cannabis

(a) General Requirements. A licensee shall implement sufficient security measures to deter diversion, theft, or loss of cannabis and cannabis products, theft, or loss of cash, prevent unauthorized entrance into areas containing cannabis or cannabis products, and to ensure the safety of the licensee's employees and the general public. Unless otherwise approved by the Office, such security measures taken by the licensee shall include, but not be limited to, the following:

(1) positively identifying individuals who are not employees of the facility and are seeking access to the premises to limit access solely to individuals twenty-one (21) years of age or older;

(2) implementing and maintaining a security plan which may be included within the licensee's operating plan and shall include a description of the security measures to:

(i) prevent unauthorized access to the licensed premises by unauthorized persons and protect the physical safety of employees;

(ii) deter theft or loss of cannabis and cannabis products;

(iii) prevent loitering and ensure that only individuals engaging in activity expressly or by necessary implication permitted by the Cannabis Law and this Title are allowed to remain on the premises of the licensee;

(iv) lock all perimeter doors and windows; and

(v) provide for safe cash storage and handling, and transportation of cash to financial institutions; and

(3) securing all entrances to the licensed facility to prevent unauthorized access;

(4) ensuring that both the inside, and the outside perimeter of the licensed facility are sufficiently illuminated to facilitate surveillance;

(5) maintaining trees, bushes, and other foliage outside of the licensed premises so as to prevent a person from concealing themselves from sight; and

(6) any other requirements provided in this section, and as determined by the Office.

(b) Storage. Cannabis and cannabis products shall be stored in a secure, locked safe, vault, or other approved equipment or location within the licensed premises to prevent diversion, theft or loss, and in such a manner, as to protect against physical, chemical and microbial contamination, and deterioration of the cannabis and cannabis products as follows:

(1) all safes, vaults or any other approved equipment or areas used for the cultivation, processing, and/or storage of cannabis or cannabis products shall be securely locked and protected from entry, except for the actual time required to remove or replace cannabis and cannabis products;

(2) keys shall not be left in the locks or stored or placed in a location accessible to individuals who are not authorized to access cannabis or cannabis products;

(3) security measures, such as combination numbers, passwords or biometric security systems, shall not be accessible to individuals other than those specifically authorized to access cannabis or cannabis products;

(4) a separate secure area shall be designated for temporary storage of any cannabis or cannabis product that requires disposal;

(5) cannabis and cannabis products within storage areas shall be kept out of plain sight and not visible from a public place outside of the licensed premises without the use of binoculars, optical aids, or aircraft; and

(6) access to cannabis and cannabis product storage areas and areas within the licensed facility where security equipment and recordings are stored shall be restricted to:

(i) authorized licensee personnel;

(ii) employees of the Office or its authorized representatives;

(iii) emergency personnel responding to an emergency; and

(iv) other individuals authorized by the licensee for the sole purpose of maintaining the operations of the facility.

(c) Security System. All facilities operated by a licensee where cannabis or cannabis products are stored or handled shall have a security system to prevent and detect diversion, theft or loss utilizing commercial grade equipment, which shall, at a minimum, include:

(1) a perimeter alarm that communicates with an internal designee and a third-party commercial central monitoring station when intrusion is detected;

(2) video camera surveillance in all areas, except in areas where cannabis consumers are consuming cannabis, that may contain cannabis or cannabis products, all surveillance areas or rooms and at all points of entry and exit, and in any parking lot, which shall be appropriate for the normal lighting conditions of the area under surveillance. Video camera surveillance shall meet the following additional requirements:

(i) video cameras shall be directed at all safes, vaults, sales areas, and any other areas where cannabis and cannabis product, as applicable, is cultivated, harvested, processed, prepared, stored, handled, transferred, or sold and for the purpose of securing cash;

(ii) video cameras shall be positioned at entry and exit points, and at each point-of-sale area, to allow for the capture of clear and certain identification of any person entering or exiting the facility or at the point-of-sale;

(iii) video cameras shall have the ability to immediately produce a clear color still photo from any camera image (live or recorded);

(iv) video recordings shall allow for the exporting of still images in an industry standard image format (including .jpeg, .bmp, and .gif). Exported video shall have the ability to be archived in a proprietary format that ensures authentication of the video and guarantees that no alteration of the recorded image has taken place. Exported video shall also have the ability to be saved in an industry standard file format that can be played on a standard computer operating system;

(v) video cameras shall include a date and time stamp embedded on all recordings. The date and time shall be synchronized and set correctly, measured in accordance with the United States National Institute Standards and Technology standards and shall not significantly obscure the picture;

(vi) video cameras shall produce continuous recordings during hours of operation and at any time that cannabis or cannabis product is handled, and motion activated recordings at all other times, from all video cameras, which the licensee shall make available via remote access or login credentials for immediate viewing by the Office or the Office's authorized representative upon request. All recordings shall be retained for at least 60 days;

(vii) licensees shall make an unaltered copy of video camera recording(s) to the Office upon request;

(viii) if a licensee is aware of a pending criminal, civil or administrative investigation or legal proceeding for which a recording may contain relevant information, the licensee shall retain an unaltered copy of the recording until the investigation or proceeding is closed or the entity conducting the investigation or proceeding notifies the licensee that it is not necessary to retain the recording, but in no event for less than 60 days; and

(ix) the physical media or storage device on which surveillance recordings are stored shall be secured in a manner to protect the recording from tampering or theft; and

(3) a failure notification system that provides an audible, text, or visual notification of any failure in the security system. The failure notification system shall provide an alert to the licensee's designated representative(s) within five (5) minutes of the failure, either by telephone, email, or text message;

(4) the ability for the security alarms and video surveillance system to remain operational during a power outage for a minimum of eight (8) hours;

(5) limiting access to any surveillance areas and keeping all on-site surveillance rooms locked. A licensee shall make available to the Office or the Office's authorized representative, upon request, a current list of authorized employees who have access to any surveillance room;

(6) keeping all locks, storage and security equipment in full operating order and shall test and inspect such equipment at regular intervals, not to exceed 30 calendar days from the previous inspection and test. Records of security tests shall be maintained for five (5) years and made available to the Office upon request; and

(7) outdoor areas designated for cannabis cultivation shall implement the video surveillance requirements as set forth in this Part, which shall be operating for no less than the three-week period preceding a harvest, as well as at all times while drying, curing, storing or disposing of cannabis. To ensure that outdoor areas are not readily accessible to unauthorized individuals and to prevent and detect diversion, theft or loss of cannabis, cultivation security measures shall, based on tier of the outdoor cultivator, include the following:

(i) a perimeter security fence or perimeter breach detection device, unless otherwise approved by the Office, designed to prevent unauthorized entry with signs notifying observers that it is a Limited Access Area; fencing shall:

(a) be constructed of metal or another similarly secure material;

(b) measure at least eight (8) feet from the ground to the top;

(c) have support posts that are securely anchored; and

(d) meet the requirements of the relevant municipal code provisions; and

(ii) use commercial-grade, nonresidential locks;

(iii) motion activated floodlights, which may face away from the canopy, or other technology, such as motion activated night vision cameras, which provide sufficient visibility in darkness; and

(iv) controlled point of access.

(8) The Office shall determine the appropriate security measures for outdoor nursery areas and based on cultivator tier size, for outdoor canopy areas in the period preceding a harvest and for drying, storage, and disposal areas at all times.

(d) Employee and Visitor Identification. Employees, visitors, and other persons at licensed premises, including persons engaged in the transportation of cannabis or cannabis products, shall be required to provide identification to the Office, or other authorized enforcement official upon request.

(1) All licensees and employees on the licensed premises shall be required to hold and properly display an identification badge, issued by the licensee, at all times, while on the licensed premises or when engaged in the transportation of cannabis or cannabis products. The identification badge shall include, at a minimum, the following information:

(i) employee's first and last name;

(ii) employee's photograph;

(iii) licensee's legal name; and

(iv) licensee's license number as issued by the Office;

(2) Non-employee visitors to the licensed premises, other than cannabis consumers, shall be required to hold and properly display an identification badge issued by the licensee at all times while on the licensed premises.

(3) The licensee shall maintain a visitor log of all persons, other than employees, cannabis consumers visiting a retail dispensary, permitted cannabis laboratories or laboratory sampling firms, emergency personnel responding to an emergency, or any other persons as determined by the Office, that shall be maintained on the licensed premises for a period of five (5) years and be made readily available to the Office upon request. The log shall include the following information:

(i) the full name of each visitor, as well as the company the individual works for entering the licensed premises;

(ii) the time of arrival;

(iii) time of departure; and

(iv) purpose of the visit.

(e) Incident Reporting. A licensee shall notify the Office in a manner prescribed by the Office, of any breach of security or other incident set forth in this section immediately and, in no instance, more than twenty-four (24) hours following discovery of the security breach or incident.

(1) Notification to the Office shall be provided for the following incidents:

(i) discovery of inventory discrepancies;

(ii) diversion, theft, or loss of any cannabis or cannabis product;

(iii) any criminal action involving or occurring on or in the licensed premises;

(iv) any suspicious act involving the cultivation, processing, distribution, or sale of cannabis or cannabis products by any person;

(v) unauthorized destruction of cannabis or cannabis products;

(vi) any loss or unauthorized alteration of records related to cannabis or cannabis products;

(vii) an alarm activation or other event that requires response by public safety personnel, including, but not limited to: local law enforcement, police and fire departments, public works or municipal sanitation departments, and municipal inspectional services departments, or security personnel privately engaged by the licensee;

(viii) the failure of any security alarm system, or video surveillance, due to a loss of electrical power or mechanical malfunction that is expected to last more than eight (8) hours;

(ix) a significant motor vehicle crash that occurs while transporting or delivering cannabis products and would require the filing of an accident report with the New York State Department of Motor Vehicles;

(x) any other breach of security; and

(xi) any other event that may compromise public health and/or safety including the health and safety of the workforce at the licensed premises;

(2) The licensee shall, within ten (10) calendar days of any incident in paragraph (1) of this subdivision, submit an incident report in a form and manner determined by the Office which details the circumstances of the incident, any corrective action taken, and confirmation that the appropriate law enforcement authorities were notified.

(3) All documentation related to an incident shall be maintained by a licensee for not less than five (5) years or the duration of an open investigation, whichever is longer, and made available to the Office and law enforcement authorities within their lawful jurisdiction upon request.

N.Y. Comp. Codes R. & Regs. Tit. 9 § 125.3

Adopted New York State Register September 27, 2023/Volume XLV, Issue 39, eff. 9/27/2023