Cannabis storage security requirements come from two directions at once: federal DEA controlled-substance rules under 21 CFR Part 1301, and state cannabis licensing regulations that typically mirror or exceed them. Every legal market expects the same core elements — reinforced vaults or safes, continuous video surveillance, electronic access control, alarm systems, background-checked employees, and real-time inventory tracking. The specifics shift from state to state, so a facility compliant in Colorado may fall short in Massachusetts, but the framework is consistent.
How Federal and State Rules Stack
The DEA’s baseline regulation requires every registrant handling controlled substances to maintain “effective controls and procedures to guard against theft and diversion.”1eCFR. 21 CFR 1301.71 – Security Requirements Generally Compliance is judged on the quantity and type of substance handled, building construction, alarm systems, employee supervision, and visitor-handling procedures.
State cannabis agencies layer their own rules on top, often with far more granular standards for cameras, software, logging, and waste handling. Because recreational cannabis and most medical cannabis remain Schedule I at the federal level, the stricter DEA storage standards still set the floor for licensed facilities.2Federal Register. Schedules of Controlled Substances: Rescheduling of FDA-Approved Products
Vaults and Safes
For Schedule I and II substances, the DEA sets a high structural bar. A vault constructed after September 1, 1971 must have walls, floors, and ceilings of at least eight inches of reinforced concrete (or structural equivalent), reinforced with half-inch steel rods tied at six-inch centers. The vault door and frame must resist surreptitious entry for at least 30 man-minutes, forced entry for at least 10 man-minutes, and lock manipulation for at least 20 man-hours.3eCFR. 21 CFR 1301.72 – Physical Security Controls for Controlled Substances in Schedules I and II A vault that stays open during business hours needs a self-closing, self-locking day-gate.
When the quantity stored is small enough, a safe or steel cabinet can substitute. The safe must meet resistance standards equivalent to the vault door, and any safe weighing under 750 pounds must be bolted or cemented to the floor or wall so it cannot be readily moved.3eCFR. 21 CFR 1301.72 – Physical Security Controls for Controlled Substances in Schedules I and II Many state programs reference the TL-30 safe rating, which certifies the door can withstand a skilled attack with common burglary tools for at least 30 minutes. Commercial-grade vault doors run anywhere from $2,000 to $30,000 or more.
Several states push past the federal baseline, requiring reinforced steel doors (sometimes specifying 18-gauge or heavier) set in metal frames anchored into the surrounding structure, and some mandate locked, secured rooms even within the vault area.
Surveillance and Alarm Systems
Continuous video coverage of storage areas is universal. Cameras must run around the clock and produce footage clear enough to identify any individual on screen. Most states require HD resolution at a minimum (1280×720 pixels) and a recording rate of at least 15 frames per second. Blurry or choppy footage is useless in a theft investigation, and regulators know it.
Retention windows range from 30 to 90 days, with longer storage required for footage tied to specific incidents. Off-site cloud backups or hardened on-site servers protected from tampering are standard. If the surveillance system goes down, most states require prompt notice to the regulator, with 24 hours the practical consensus.
Alarm systems work alongside the cameras. Federal rules require vault alarms to transmit a signal directly to a central monitoring station, local or state police, or a 24-hour control station operated by the registrant.3eCFR. 21 CFR 1301.72 – Physical Security Controls for Controlled Substances in Schedules I and II States typically add motion sensors throughout the storage area and glass-break sensors on windows and glass doors. Backup power, usually through an uninterruptible power supply, must keep alarm and surveillance systems running during a blackout, with four to eight hours a common benchmark.
Access Control and Entry Logs
Who walks in is where inspectors focus. Electronic systems like magnetic key cards and biometric scanners have largely replaced traditional locks because they generate an automatic record of every entry and exit, including identity, date, and exact time. If inventory goes missing, the access log is the first thing regulators pull.
Storage areas are designated “limited access areas” and marked with signage warning unauthorized individuals not to enter. Contractors, delivery drivers, and inspectors must wear a visible ID badge and stay with an authorized escort until they leave the restricted zone. Paper visitor logs run as a redundant backup to the electronic system, capturing the visitor’s name, affiliation, purpose, and the escort’s signature. Most states require facilities to keep access records for at least two years. Gaps in those logs almost always trigger fines or compliance orders.
Employee Background Checks
Nobody gets access to a storage area without clearing a background check. Disqualifying offenses vary, but there is a pattern: convictions for drug distribution involving minors, fraud, embezzlement, and certain violent offenses typically bar employment in a licensed cannabis facility. Many states apply a lookback period of five years, measured from conviction, completion of probation, or release from incarceration, whichever came last. Some states allow applicants to show rehabilitation and obtain a waiver, but that requires affirmative proof.
Biometric Data
If the facility uses fingerprint scanners or similar biometric access controls, additional obligations attach. Several states have biometric privacy laws restricting how employee biometric data is collected, stored, and shared. Even in states without a standalone statute, cannabis-specific rules may limit access to the biometric system to individuals specifically authorized to handle cannabis. Mishandling this data can trigger regulatory penalties and private lawsuits.
Seed-to-Sale Inventory Tracking
Physical security keeps people out. Inventory tracking makes sure nothing disappears from inside. Nearly every state cannabis program mandates a real-time digital system following each plant and product from cultivation through final sale. Metrc, the most widely adopted platform, is used in roughly 28 states and territories. It assigns a unique identifier to every piece of inventory and uses RFID technology to maintain an unbroken chain of custody.
Licensees must use approved software that integrates with the state’s back-end database through an API, transmitting data in real time whenever product is moved, processed, tested, sold, or destroyed. Spreadsheets and paper records are explicitly prohibited in most programs. At the end of each business day, physical inventory must match what the tracking system shows. Any discrepancy triggers reporting obligations, and significant gaps typically require notification to the regulator within 24 hours. The system also doubles as a recall mechanism, letting regulators trace a contaminated or mislabeled product back through every facility it touched.
Environmental Controls
Secure product that degrades in storage is still a loss. Temperature and humidity are the variables that matter most. Industry practice calls for storing cannabis between 60 and 70 degrees Fahrenheit, with relative humidity between 59% and 63%. Above 77 degrees, mold and mildew growth accelerates, and excess humidity creates conditions for microbial contamination that renders product unsaleable or dangerous.
Ventilation needs to cycle air frequently enough to prevent hot spots and moisture buildup. Shelving should be non-porous and easy to sanitize. Some states write these standards into regulation; others leave them to the facility’s standard operating procedures. Either way, an inspector who finds mold in your storage room won’t care which column it fell under.
Fire Safety and Hazardous Solvents
p>Storage gets significantly more dangerous when extraction solvents are in the building. Butane, propane, and ethanol are all highly flammable, and facilities storing them alongside finished product must comply with fire codes that predate the cannabis industry. Flammable solvents go in specialized double-walled steel cabinets with proper venting. Fire marshals enforce strict limits on how much solvent can be stored in a single fire-rated zone.
NFPA 1 (the Fire Code) already includes Chapter 38 addressing cannabis growing, processing, and extraction facilities. A standalone standard, NFPA 420, is under development with a first edition targeted for 2027.4National Fire Protection Association. What Is the New NFPA 420 Until then, facilities comply with existing NFPA codes and local fire marshal requirements.
Finished product must be stored at a safe distance from any hazardous chemicals. Explosion-proof lighting is standard where solvent vapors could accumulate. Fire suppression systems, whether pre-action sprinklers or clean-agent systems, must protect both the inventory and the chemical storage, and all suppression equipment requires regular testing and maintenance. Fire code enforcement runs on a separate track from the state cannabis agency; a facility can be fully compliant with its licensing body and still be shut down by the fire marshal.
Cannabis Waste Storage and Disposal
Expired, recalled, or contaminated cannabis cannot go in a dumpster. Before disposal, the material must be rendered unrecognizable and unusable. The standard method is finely grinding the cannabis and mixing it with a safe, non-toxic material like soil, compost, or cat litter until the mixture is at least 50% non-cannabis waste by volume. Grinding and mixing happen in a secured, locked area visible to a surveillance camera.
Once mixed, the waste stays in a locked container until final disposal. The container can sit outside the building as long as it remains within view of a camera. If a license expires or gets revoked, the facility generally has a short window — often just 72 hours — to destroy all remaining inventory. After disposal, the business weighs what was destroyed, updates its tracking records, and notifies the regulator in writing within a set number of business days, reporting the form, weight, and quantity destroyed. Regulators audit waste records against inventory tracking data, and numbers that don’t reconcile trigger diversion investigations.
Child-Resistant Packaging in Storage
Consumer products in storage must be in child-resistant packaging. Most states reference the testing protocol from ASTM D3475, and some incorporate the federal Poison Prevention Packaging Act, codified at 16 CFR Part 1700, by reference.5eCFR. 16 CFR Part 1700 – Poison Prevention Packaging
One boundary worth knowing: the federal packaging regulation explicitly excludes bulk shipping containers used to move product between manufacturers, processors, and distributors. The finished consumer packages on your shelves need to be child-resistant; the larger bins or totes you use to organize bulk inventory do not. Shelving and handling practices still cannot compromise the child-resistant seals on consumer packages.
Transportation Between Facilities
Cannabis in transit is cannabis at its most vulnerable, and storage obligations extend to the vehicle. State rules generally require real-time GPS tracking on all transport vehicles, continuous video surveillance inside cargo areas, secure locking mechanisms with access logs, and proof-of-delivery documentation with timestamps and personnel identification. Before any shipment moves, sending and receiving facilities must generate transport manifests that match the seed-to-sale tracking system.
Many states require two employees in the vehicle at all times and the route logged in advance. Unmarked vehicles are typical. The manifest must accompany the shipment and be available for inspection by law enforcement at any point during transit. A mismatch between the manifest and the actual contents triggers the same reporting obligations as any in-facility inventory gap.
What Happens When You Fall Short
Storage violations carry real consequences. The lightest outcome is a compliance order requiring corrective action within a set deadline. More serious breaches — particularly unsecured inventory, disabled surveillance, or falsified records — can lead to immediate license suspension. Regulators in most states can impose administrative fines that scale with severity, and repeated violations or evidence of diversion typically result in permanent license revocation.
Fire code violations run through local fire marshals, who have independent authority to issue immediate closure orders. Contesting a penalty generally means an administrative hearing before the regulatory agency, with the right to appeal a final decision to a state appellate court. The process takes months, and the business often remains suspended while it plays out. Building compliance into daily operations costs far less than fixing it after an inspector files a report.