Summary

In this article we talk about:

📷 Video Surveillance 

🚷 Intrusion Detection

Whole books and reddit threads cover this topic. There is virtually no end to the intrusion detection solutions on the market. They range from cheap and ubiquitous IR motion detectors to military grade long range radar systems. 

To quote Health Canada:

There is no one size fits all and the project will dictate the intrusion detection solutions. Balance the need for adequate coverage without overwhelming the Head of Security with nuisance alarms. (Refer to our upcoming article on alarm management and record keeping)

Designing a system that can differentiate between attempted unauthorized access and other benign activities is key. Even “smart” systems can struggle with this, especially in unpredictable outdoor environments. More expensive solutions are not always more effective but effective solutions tend to be more expensive. Saving money on the front end usually means carrying a long term operating cost for dealing with false alarms and other issues. 

Intrusion detection manufacturers often provide specifications, software or free design support.

🔐 Access Control - Restricted Access

There are two main ways to do this. Good old lock and key or electric locks paired with card readers. This applies for fence gates, exterior doors and interior doors. Rollup doors and sliding gates can be secured with an interlocked motorized opener combined with a locking mechanism.   

For smaller sites with few staff and few doors, lock and key is usually enough. Deadbolts with an integrated standalone keypad or card reader can be a good solution to simplify key management. 

When keys are required we recommend a solution like the Abloy Protec2.  These keys can not be copied and are designed to allow for key management across multiple doors and users.

For larger sites with lots of staff the use of digital access control (scannable credential plus a PIN code) becomes practical. Credentials and PINs can be managed remotely from a centralized portal. Access authorizations can be segmented according to roles and responsibility.  

📋 Record Retention

Record retention is one of the most critical aspects of maintaining and demonstrating compliance, despite being often overlooked during the design phase. Failure to comply with Health Canada’s record retention requirements is one of the most common physical security deficiencies. 

The onus is on the LP to show compliance. Those without a clear audit trail risk non-compliance and the loss of their ability to sell product.

Check out Table 2 on page 20 of the Physical Security Measures Guide for Cannabis.

Retaining records is only the start. The Head of Security needs to respond to every event and document what corrective measures she took. There are a variety of simple solutions on the market that can be integrated into a compliant platform. Proactive event management is critical and must be performed continuously. Good luck trying to figure it out once the Health Canada inspector is in your office. 

The regulations allow for record storage digitally on premise, in the cloud or on paper. If records are stored in the cloud or another offsite backup then the Head of Security must still be able to access everything from site. 

The same goes for video footage aka Visual Recordings. “Only” one year of footage is required and (believe it or not) Health Canada will insist that you not store your video footage on paper. 

Depending on the number of cameras and the speed of your internet connection either cloud or on premise storage can be practical. Selecting the right cameras and optimizing bandwidth usage will help reduce the total archive size and in turn reduce costs. 

An offsite backup is recommended regardless of which primary storage method you use. Ensure that procedures are designed to ensure that malice or user error doesn’t result in lost or tampered records.  

📊 Monitoring and Response

There is no doubt that when Health Canada says intrusion detection systems must be monitored “at all times” they mean “365 days a year, 7 days a week and 24 hours a day”. This gets repeated a lot, lest one assume it is just a suggestion. 

Most sites will use a combination of third party monitoring and on premise personnel to meet this requirement. A good option is push notifications to the Head of Security’s mobile phone augmented with third party monitoring during off hours. 

For very large sites it may be practical to have full time personnel who attend to the intrusion detection system at all times. Regardless, it is still a good practice to have a backup to ensure continuous coverage.

No matter what the size of the site, every detected occurrence (i.e alarm) must be documented and an “appropriate measure” taken. This is where the Standard Operating Procedures (SOPs) come in. Appropriate measures can include recording, notification, investigation, escalation or corrective/preventive actions. 

If Health Canada finds a large number of false alarms (or conversely a suspicious lack of events) they will check that the Head of Security is following proper protocols and the security system is functional. Too many false alarms often lead to “alarm fatigue” meaning no one takes them seriously anymore. That is, until an inspector comes and writes an observation. 

Also known as the Perimeter or sometimes the secure perimeter. This one is subject to some interpretation.

Top priority, the site must be designed in a manner that prevents unauthorized access. This means the perimeter should be a solid barrier that can’t be easily climbed or breached.   Health Canada references the rings of protection concept (aka Concentric Circles of Protection). 

For an outdoor cultivation site the perimeter will generally be the fence line. 

For an indoor facility, the perimeter is usually either the building envelope or an exterior fence. In some cases a combination of fence and walls will be used. For units that share walls with neighbours, interior walls can be part of the perimeter. 

No matter what, the perimeter needs to be designed so that it can be monitored by video surveillance and intrusion detection. Planning ahead and defining the perimeter with this in mind can simplify the site security system and reduce costs.

This is where the regulations become tautological.

Is cannabis being stored if I step out of the room and leave it unattended? What if I leave it overnight? What if I put a cannabis product in the fridge and spin around three times with my eyes closed? 

Okay, deep breath. We consider an area to be “storage” when cannabis is present and typically unattended. Everywhere else that cannabis is present is “operations”. If you’re growing weed in there, it's a grow area.

Physical security requirements for both operations and storage areas are almost identical. The distinctions become relevant in the following situations:

• Storage Areas require access logs while operations areas do not. This might impact what kind of access control you install.
• Grow areas only require video surveillance at the entry and exit points, not inside the grow area. 
• Grow area intrusion detection systems are not required to detect unauthorized movement.   
• Requirements for adding areas to licences vary depending on the area’s classification. Some changes require prior approval from Health Canada. 

Physical Barriers

This one is mostly common sense but check out pages 13-14 of the Guide.

Additional security measures may be required to satisfy your personal risk tolerance or your insurance company. 

Notice that barriers are to delay intrusion. No mention here of heavy barricades, bollards, moats, electric fences or vaults.

A standard operating procedure (SOP) is a documented procedure that instructs employees on how to do or complete a specific task. 

 
Make sure that SOPs are written so that they can be used and understood by the humans using them. SOPs are meant as living documents so if they don’t work, change them. We’ll have an upcoming article on the art and science of drafting SOPs coming soon. 

There are 5 physical security “themes”, previously known as SOP Priority Areas, that must be addressed by your SOPs. How you do this will depend on your facility and the type of security system installed. No matter what, creating an audit trail to show compliance is critical.

These five physical security elements map to the four areas as shown in the table. Record Retention shows up twice because it applies to both Areas and Physical Security.