Every licensed cannabis operator has to satisfy a state security plan before inspection — surveillance, limited access, alarms, a vault, and often a guard. Here's what the rules actually say, state by state, and how to hire security that passes.
Quick answer
Nearly every state requires 24/7 video surveillance with a minimum retention period, a monitored alarm, a limited-access layout, secure vault/safe storage, and visitor logs. A physical on-site guard is mandated in fewer states than vendors imply — California is the clearest example: a storefront retailer must have at least one licensed security guard on site during business hours, with footage kept 90 days. (Non-storefront, delivery-only retailers and microbusinesses not doing storefront retail are generally treated differently — the standing-guard rule is tied to premises open to the public.) Armed guards are generally permitted where the officer holds the state's armed license, but that varies — confirm with your state cannabis regulator. The single most-cited inspection failure is CCTV retention and camera coverage, so treat that as job one.
Why cannabis is regulated differently
Ordinary retailers write their own security policy. Cannabis operators inherit theirs from the state. When you apply for a license, most cannabis control agencies require you to submit a security plan as part of the application, and your build-out is inspected against it before you can open. The rationale regulators cite is consistent: cannabis is a valuable, diversion-prone product that — because it can't be banked normally under federal law — often runs on cash, making dispensaries a target for both external robbery and internal theft. So the rules are prescriptive rather than advisory: specific camera frame rates, specific retention windows, specific areas that must be under surveillance, and specific records you must produce on demand.
Why the cash problem exists (and why it drives your whole security plan)
Cannabis is legal in most states but still federally illegal (Schedule I). Because federally chartered banks and card networks risk federal money-laundering exposure, most dispensaries still can't get ordinary banking or reliable card processing. The SAFE Banking Act — the bill meant to give state-legal cannabis businesses normal banking access — has passed the U.S. House multiple times but has not become federal law as of 2026. Until it does, many operators run heavily on cash: large on-site balances, manual armored or in-house deposits, and no fraud-reversal safety net. That single fact is the reason regulators mandate vaults, dual-authorization access, cash-handling cameras, and (in practice) armed transport. Every line item below traces back to it.
Two distinctions matter throughout. First, adult-use vs. medical: a state's medical program and its newer adult-use program can carry different rules (New York and Ohio are examples where retention numbers differed or were unified across programs). Second, retail vs. cultivation: a grow or processing facility has its own camera-coverage and access rules focused on the plant canopy, drying, and product-handling areas rather than a sales floor. Most competing "dispensary security" content is published by camera vendors and rarely cites the statute or separates these cases — which is exactly where operators get tripped up.
The five mandates almost every state shares
Regardless of state, a compliant cannabis security plan is built around five pillars:
- Video surveillance. Continuous, 24/7 recording covering sales floors, entrances and exits, limited-access and storage areas, points of sale, and (for cultivation) grow and processing rooms. States set minimum frame rates, image quality, and — critically — a minimum retention period. See our video surveillance and CCTV guide for how to spec a system.
- Limited-access areas. Product and cash live in restricted zones that only authorized, badged personnel (and escorted visitors) may enter, with the boundaries defined in your plan.
- Intrusion alarm. A monitored alarm covering perimeter doors, windows, and often glass-break and motion sensors, with backup power so it survives an outage.
- Vault or safe storage. Product and cash secured in a vault, safe, or locked cage — frequently required to be locked down at close of business.
- Visitor logs and access records. A record of who entered restricted areas and when, retained for a set period and producible for the regulator.
These five are the backbone. Where states diverge — and where operators most need current, verified information — is on the three questions below.
Do you actually need an on-site security guard?
This is the most over-claimed requirement in the industry. Plenty of vendor marketing implies every dispensary must post a guard; the statutes are more varied. The clearest hard mandate is California: under the Department of Cannabis Control's regulations, a licensed storefront retailer must have at least one licensed security guard on the premises during hours of operation (with additional guards as the retailer's own risk assessment warrants). That is a genuine, citable statutory requirement — but it is tied to storefront retail. Non-storefront (delivery-only) retailers and microbusinesses not engaged in storefront retail sales — whose licensed premises are not open to the public — are not covered by the same standing-guard rule, though they still carry full storage, alarm, surveillance, and transport-security obligations.
Most other states are less explicit. Many require a robust security plan and that security personnel or a designated employee monitor the alarm and camera systems, without prescribing a posted physical guard the way California does. In several states the honest description is "not clearly mandated as a posted guard — confirm with your state cannabis regulator and read your specific license conditions." Local rules add another layer: a city or county can require a guard even where the state doesn't, as a condition of your local permit.
So the honest answer is: California clearly requires an on-site licensed guard for storefront retail; elsewhere, verify against your current state rule and your local jurisdiction before assuming you can operate without one. Even where it's optional, many operators post a guard anyway — for deterrence, for staff safety during cash handling, and because it strengthens the "reasonable security" posture that matters if something goes wrong.
Armed or unarmed? A cannabis-specific decision framework
Where a guard is used, the next question is whether they can be armed. As a general rule across states, an armed guard is permitted only if that officer holds the state's armed-security credential — the same firearm permit or armed registration any armed guard needs, on top of the base guard license. Cannabis regulators generally defer to the state's private-security licensing board on this rather than writing their own firearm rules. Because the armed credential, training hours, and eligibility differ so much by state, defer to the licensing spoke for the mechanics: for California, see California security licensing; for Illinois, see Illinois security licensing. Those pages cover the exact armed permit, training, and minimum age.
The harder question — the one no licensing page answers — is whether armed is the right call for a cannabis operation specifically. Here's the framework buyers actually need:
1. Start with what your insurer requires, not what's allowed
Cannabis general-liability, property, and crime/cash coverage is a thin, specialty market, and the carrier's application is your de facto security spec. Underwriters routinely ask whether guards are armed or unarmed, whether cash transport is armed, your safe/vault rating, your camera retention, and whether you've had prior loss events. Two practical patterns show up repeatedly: (a) some crime/cash policies condition coverage or set sub-limits on armed transport for deposits above a threshold, and (b) an armed guard on the floor can raise your liability premium because it increases the assault/negligent-security exposure the carrier is pricing. In other words, armed coverage can lower your theft risk and raise your liability risk at the same time — and your carrier prices both. Ask your broker, in writing, what each posture does to eligibility and premium before you decide.
2. Weigh the concrete liability scenarios
Armed guards change the failure modes, not just the deterrence. The realistic downside scenarios: a guard discharges a weapon during a robbery and a bystander or employee is injured (negligent-security and vicarious-liability exposure that can dwarf the inventory saved); a firearm is disarmed and used against staff; or the mere visible presence of a firearm escalates what would have been a grab-and-run into a violent confrontation. The upside scenario is narrower but real: deterrence and protection during the highest-risk moment, which is almost always cash in motion — the deposit run, the vault-to-armored-car handoff — not the sales floor at 2 p.m.
3. The split most dispensaries actually land on — with numbers
The common, defensible middle path is unarmed uniformed presence on the floor during business hours plus armed coverage only for cash transport and vault handling. Roughly what that looks like in 2026 dollars:
- Unarmed floor officer (bill rate): $22–$35/hr. On a ~12-hour open-to-close day, that's about $8,000–$12,800 per month for a single continuous post.
- Armed cash-transport / escort (bill rate): $30–$48/hr, used in short blocks (a few deposit runs a week) rather than a full-time post. Some operators use licensed armed security; others hire off-duty police at roughly $40–$100+/hr for the uniform-and-authority deterrence.
Our guide to armed vs. unarmed security guards walks the general trade-off; the cannabis-specific answer is driven by your cash volume, your deposit frequency, your locality's rules, and — first — what your carrier will underwrite.
CCTV and retention: the concrete specs, in one place
The most common way a cannabis security plan fails inspection isn't a missing guard — it's camera coverage gaps or footage that isn't retained for the required number of days. Retention windows and technical minimums differ by state and program, and they get amended, so treat every published number as a floor and build in margin. A compliant cannabis video system generally needs to:
- record 24/7 at the state's minimum frame rate (motion-only recording is generally not acceptable for required-coverage areas);
- cover every required area (entrances/exits, sales floor, points of sale, limited-access and storage areas, and — for grows — cultivation and processing rooms);
- keep footage for at least the state's minimum retention period;
- survive a power failure with battery/UPS backup for the required duration;
- let you retrieve and export specific footage for the regulator within a required window, at the required image quality.
Rather than tell you to "go verify the frame rate," here are the concrete numbers regulators actually check in the most-cited states. Confirm against your current state rule before you build — but this is the reference:
| State | Min. frame rate | Min. resolution / image quality | Backup power | Retention |
|---|---|---|---|---|
| California | 15 fps | 1280×720 (720p) | Required (system must remain functional; no fixed hours cited) | 90 days |
| Washington | 10 fps | Verify current rule | Required — verify duration | 45 days |
| New York | Verify current rule | Verify current rule | 8-hour battery/UPS backup | ~60 days adult-use (verify) |
| Ohio | 15 fps | Still images min. 600×600 dpi | Failure-notification + repair within 24 hrs | 45 days |
| Illinois | Verify current rule | Verify current rule | Battery backup required | 90 days |
California is the cleanest anchor: the DCC requires continuous recording at a minimum of 15 fps and 1280×720 resolution, retained a minimum of 90 days. Spec storage that comfortably exceeds your state's minimum — running out of storage a week before an audit is a self-inflicted violation.
What a compliant program actually costs (worked example)
Operators hear "six figures if you run 24/7" and stop there. The more useful number is the realistic business-hours program for a single-location storefront dispensary, built from 2026 market rates. These are planning estimates, not quotes — get a real quote for your address and hours.
Assumptions: one storefront, open ~12 hours/day, 7 days/week (~84 guard-hours/week); one unarmed floor officer during open hours; armed cash-transport a few runs per week; a one-time CCTV build sized for full required coverage plus 90-day retention; a vault and access-control hardware; monitored alarm.
| Line item | Basis (2026) | First-year | Ongoing / yr |
|---|---|---|---|
| Unarmed floor guard (open hours) | $22–$35/hr × ~84 hr/wk | ~$96,000–$153,000 | ~$96,000–$153,000 |
| Armed cash-transport (periodic) | $30–$48/hr (or off-duty police $40–$100+/hr), a few runs/wk | ~$6,000–$20,000 | ~$6,000–$20,000 |
| CCTV build (one-time) | $1,000–$5,000 for 4–10 cams; more for multi-zone + 90-day storage | ~$5,000–$15,000 | — |
| Vault + access-control hardware (one-time) | Safe/vault + badge access | ~$5,000–$20,000 | — |
| Alarm monitoring | $30–$200/mo | ~$360–$2,400 | ~$360–$2,400 |
| Camera storage / maintenance / testing | Cloud or NVR + monthly checks | ~$1,000–$4,000 | ~$1,000–$4,000 |
| Approximate total | ~$113,000–$214,000 | ~$103,000–$179,000 |
The takeaway: staffing dominates. Even a single business-hours guard post lands you in six figures a year before you touch a camera, because compliance means a continuous posted officer, not an occasional patrol. Hardware is a one-time bump; labor is the recurring reality. If your locality or license forces true 24/7 guarding, budget roughly $16,000–$25,600/month unarmed (about $190,000–$307,000/yr) for the 2–4 officers that around-the-clock coverage requires — and more if any of those posts are armed.
Security, insurance, and getting underwritten
A documented, inspection-ready security program isn't just a compliance cost — it's an insurance asset. Cannabis liability and crime/cash coverage is a specialty line with few carriers, and underwriters price it largely off the exact controls this article describes. In practice, an operator who can hand the carrier guard logs, a tested alarm with backup power, retained footage at the required frame rate, dual-authorization vault access, and a written security plan is a materially better risk than one who can't — which shows up as broader eligibility, higher cash sub-limits, and lower premiums.
Three concrete moves that pay off at renewal:
- Keep the paper trail your carrier wants. Retained footage, visitor and access logs, incident reports, and monthly alarm/camera test records are the artifacts a crime-loss adjuster asks for — and the ones that keep a claim from being denied for "failure to maintain required controls."
- Document backup-power testing. A camera or alarm system that was offline during the loss can void the very coverage you bought it to support. Test it, log the test.
- Treat armed vs. unarmed as an underwriting decision, not just an operations one (see the framework above) — the same posture can help one line and hurt another.
Typical retail cannabis security requirements by state
The table below summarizes commonly-cited requirements. Treat it as a starting map, not legal advice: cannabis rules are amended frequently, adult-use and medical programs differ, and local permits can be stricter. Where a cell says "verify," the state's rule is less settled or we couldn't confirm a hard posted-guard mandate — read your current state regulation and license conditions before relying on it.
| State | On-site guard? | Armed allowed? | CCTV retention (days) | Other notable mandates |
|---|---|---|---|---|
| California | Yes — ≥1 licensed guard on site during business hours (storefront retail; delivery-only/microbusiness treated differently) | Yes, if the officer holds CA armed credentials | 90 | Monitored alarm; limited-access areas; 24/7 recording (15 fps / 1280×720) |
| Illinois | Not a clear posted-guard mandate — verify; plan + approved vendor required | Permitted if licensed — verify | 90 | Vault secured at close; perimeter + glass-break alarm; battery backup |
| Arizona | Not clearly mandated — verify | Permitted if licensed — verify | ~30 (verify current rule) | POS + grow-room cameras; failure notification; short backup window |
| New York | Not clearly mandated — verify | Permitted if licensed — verify | ~60 adult-use (90 for legacy medical) — verify | Parking-lot coverage; 8-hour backup power; periodic testing; breach reporting |
| New Jersey | Not clearly mandated — verify; licensed staff named in plan | Permitted if licensed — verify | ~30 (verify current rule) | 24/7 alarm + video; panic buttons; neighbor notice provisions |
| Maryland | Not clearly mandated — verify | Permitted if licensed — verify | ~90 (verify current rule) | 24/7/365 recording; independent alarm; footage retrieval on request |
| Ohio | Not clearly mandated — verify | Permitted if licensed — verify | ~45 (rules unified for medical + adult-use) | Continuous 24-hour recording (15 fps); still images ≥600×600 dpi; real-time access for the division |
| Pennsylvania (medical) | Designated employee monitors; posted guard not explicit — verify | Permitted if licensed — verify | Baseline — verify; longer retention if flagged | 24/7 monitored alarm + video; perimeter coverage; access logs retained |
Your pre-license security-plan / inspection-readiness checklist
Most inspection failures are avoidable and boil down to the same short list. Walk your build-out against it before the regulator does. This is the same list our team uses to spec a compliant program — and you can request the full downloadable inspection-readiness checklist and a security-plan quote here.
- Cameras cover every required area — entrances/exits, full sales floor, every point of sale, limited-access and storage rooms, the vault/safe, and (for grows) cultivation and processing. No blind spots on cash-handling.
- Recording meets the technical minimums — 24/7 continuous (not motion-only) at your state's frame rate and resolution (e.g., CA 15 fps / 1280×720).
- Retention exceeds the minimum — storage sized to comfortably beat your state's day count (e.g., 90 in CA, 45 in WA/OH) with margin.
- Backup power is installed and tested — cameras and alarm survive an outage for the required duration (e.g., NY 8-hour), with a dated test log.
- Monitored intrusion alarm — perimeter doors/windows, glass-break, motion, and panic buttons where required; professionally monitored.
- Limited-access controls — badge/photo-ID access to restricted zones, escorted-visitor policy, and access logs retained for the required period.
- Vault/safe secured at close — product and cash locked down per your plan, with dual-authorization where required.
- Guard coverage matches your license and locality — licensed (and, if armed, armed-credentialed) officers; guard logs maintained.
- Records are producible on demand — footage export, visitor logs, incident reports, and monthly equipment-test records ready for the division.
- The written security plan matches reality — what you built equals what you submitted; update the plan if you changed anything.
How to hire a security company that passes inspection
Cannabis is a specialty. The provider you want has done licensed cannabis work in your state, reads your regulator's current rule the way an inspector does, and can produce the logs and footage an audit demands. When you evaluate vendors, ask: Have you built to this state's cannabis security plan requirements before? Can your camera system hit our required frame rate, resolution, and retention with backup power — and prove it? Are your guards licensed (and armed-credentialed if we go armed)? Will you supply the guard logs, incident reports, and equipment-test records our regulator and our insurer will ask for? A vendor who answers those crisply is worth more than the cheapest hourly rate. Compare vetted, state-appropriate cannabis security providers here.
]]>Frequently asked questions
Does every dispensary legally need an on-site security guard?+
How much does dispensary security cost?+
How long do I have to keep dispensary camera footage?+
Can dispensary security guards be armed?+
Why are dispensaries such a cash-heavy security risk?+
Share this guide
Sources
- Ohio Administrative Code Rule 1301:18-8-05 — Dispensary minimum security and surveillance requirements (24-hour recording, 15 fps, 45-day retention)
- California Department of Cannabis Control — DCC regulations (Title 4 CCR, Article 5 security measures; storefront guard, 15 fps / 1280×720, 90-day retention)
- California DCC delivery / non-storefront retailer regulations overview
