Massachusetts cannabis dispensary security compliance rests on four operational pillars you need to handle now: monthly equipment audits, 24-hour incident reporting to police and the Commission, properly signed and controlled Limited Access Areas, and secure storage with tracked credentials. If any of these are undocumented or inconsistent, schedule a security risk assessment before your next inspection.
TL;DR:
- Monthly audits of cameras, alarms, and sensors are mandatory and must be documented in writing under Massachusetts regulations.
- Incident reports for theft, theft-related crimes, or safety breaches must be submitted to authorities within 24 hours of discovery to avoid deficiencies.
- Signage, badge issuance, escort requirements, and exterior lighting must meet specific size, visibility, and security standards prescribed by the regulatory bodies.
- Staff training should include verifying identities, managing digital credentials securely, and conducting mock emergency alarms to ensure proper response.
- Outside security assessments can identify vulnerabilities, help develop comprehensive security plans, and improve interaction with local law enforcement.
Table of Contents
- Quick Compliance Checklist: Operational Items to Run Today
- What 935 CMR Requires: Plain-Language Translation of the Rules That Matter
- Practical Systems and SOPs: CCTV, Alarms, Access Control, and Staff Protocols
- Records, Audits, and Incident Response: the Paperwork That Proves Compliance
- Coordinating With Police, Fire, and the Cannabis Control Commission
- When to Hire a Professional Security Firm: What an Assessment Delivers
- Security as License Protection
- How Hub Investigative Group Helps Dispensaries: Services and Next Steps
- Primary Sources and Official Guidance for Operators
- Sources
- FAQ
Quick Compliance Checklist: Operational Items to Run Today
Before an inspector walks in, you want your documentation and equipment already squared away. Here is what to verify this week.
- Test cameras, alarms, and door sensors, then log the date, result, and any repairs in a dedicated file.
- Place and test panic or duress alarms at every point of sale and in the vault area, checking them on a set schedule.
- Confirm your safe or vault meets your security plan’s specifications and that cash handling follows a documented two-person rule.
- Post Limited Access Area signage, issue visible employee badges, and require visitor escorts and sign-in logs at every LAA entry.
- Check exterior lighting after dark and confirm product displays don’t allow a clear view from the sidewalk or parking lot.
Monthly equipment checks aren’t optional. Under 935 CMR 500.110, licensees must conduct and document monthly audits of cameras, alarms, and sensors, a requirement inspectors check first because it’s the easiest gap to spot on paper.
What 935 CMR Requires: Plain-Language Translation of the Rules That Matter
The regulatory text is dense, but the obligations underneath it are specific and checkable. Here’s what the Commission actually expects you to have in place.
- Monthly audits of all security equipment, including sensors, cameras, and alarms, documented in writing under 935 CMR 500.110 and 501.110.
- Any criminal action, theft, or incident requiring a public safety or private security response reported to local police and the Commission within 24 hours of discovery.
- Limited Access Area signs that meet the minimum size and readability requirements specified in regulations, paired with a facility diagram showing every LAA boundary filed with your plan.
- Controlled access to storage areas through keys, passcodes, or biometric credentials, with an alternate security provision process available if a standard requirement doesn’t fit your site.
These aren’t suggestions. Commission bulletins have repeatedly reminded licensees that even a “false alarm” triggering a police or fire response counts as reportable, and missing that window is a common cause of deficiency letters.
Practical Systems and SOPs: CCTV, Alarms, Access Control, and Staff Protocols
Meeting the letter of the regulation and actually deterring a break-in are two different projects, though they overlap more than most operators expect. Camera coverage should include every entry point, the sales floor, the vault, and LAAs, with footage retained long enough to support both an internal review and a Commission request. Placement matters as much as count: cameras aimed at cash handling areas and LAA doorways close more gaps than a dozen wide exterior shots.
Alarm systems typically fall into three categories: general intrusion alarms, silent duress alarms triggered discreetly during a threat, and holdup alarms for active robbery situations. Each should route to a monitoring service that can confirm dispatch, not just a local siren.
- Issue badges only after a documented background check and revoke them immediately at termination.
- Require visitor escorts in every LAA and log entry and exit times.
- Train staff to verify identity before opening doors, since social engineering, not force, opens most breaches.
- Protect digital credentials for alarm panels and camera systems with unique logins, not shared passwords.
Pro Tip: Run a mock duress-alarm test during a slow shift so staff react by instinct, not memory, when it counts.
Records, Audits, and Incident Response: the Paperwork That Proves Compliance
Good documentation shortens inspections and gives you a defense if an incident escalates into a Commission review. Build these records now.
- Log every monthly equipment audit with date, equipment checked, pass or fail status, and repair follow-up.
- Keep visitor logs and employee badge records current, with LAA diagrams matching what’s posted on-site.
- Reconcile inventory on a set cadence and note chain-of-custody details for any product disposal.
- Maintain an incident response sheet with police, fire, and Commission contact information, plus the immediate steps staff should take.
- Notify the Commission within 24 hours of any reportable incident, keeping a copy of that notification with your records.
Weekly checks exceed the regulatory minimum but build a stronger paper trail. The 935 CMR 500.110 audit requirement only sets a monthly floor, and licensees who verify weekly tend to catch equipment failures before they become reportable incidents.
Coordinating With Police, Fire, and the Cannabis Control Commission
Your local police and fire departments should have your floor plan, alarm procedures, and after-hours contact list on file before you ever need them. Commission guidance on municipal coordination recommends sharing these documents and updating them whenever your security plan changes materially.
- Share floor plans and alarm response procedures with your local police department directly.
- Request an alternate security provision through the Commission if a standard requirement doesn’t suit your site; the request goes to your municipality’s chief law enforcement officer, who has 30 days to respond.
- Invite officers for a familiarization walkthrough so they know your layout before an emergency call.
When to Hire a Professional Security Firm: What an Assessment Delivers
Some signals mean it’s time to bring in outside expertise rather than patch things together internally: repeat incidents or near-misses, LAAs that have grown more complex than your original plan accounts for, cash transport needs, or written policies that haven’t kept pace with your operation. A proper engagement should deliver more than a punch list.
- A site survey identifying gaps in camera coverage, lighting, and access control.
- A security plan written for direct inclusion in your Management and Operations Profile.
- Alarm and CCTV specifications matched to your layout and risk profile.
- Staff SOPs covering visitor escorts, badge protocols, and incident response.
- A law-enforcement liaison plan for sharing documents and scheduling familiarization visits.
Hub Investigative Group brings over seventy-five years of combined law enforcement and loss prevention experience to these engagements, with a cannabis dispensary security compliance service built specifically around this regulatory framework.
Security as License Protection
We’ve seen operators treat security purely as theft prevention, right up until a missed 24-hour report or an unposted LAA sign turned a minor incident into a licensing headache. Documentation and a working relationship with local police do more than satisfy an inspector: they protect the license itself.
Security, viewed this way, becomes part of how you run the business, not an afterthought bolted onto it.
— Derek
How Hub Investigative Group Helps Dispensaries: Services and Next Steps
Running a dispensary means your security plan has to satisfy the Commission and stand up to a real threat, and doing both without outside help stretches most operators thin. This practice was developed to bridge that gap, combining law enforcement and loss prevention expertise with a lean team designed to keep costs lower than larger firms carrying heavier overhead.
- Cannabis dispensary security compliance planning built around your MOP.
- Security risk assessments that identify gaps before an inspector does.
- CCTV and surveillance assessments for camera placement and retention.
- On-site guard services and policy or SOP drafting.
A discovery call starts with your current plan and any recent inspection notes. From there, we recommend a site assessment as the first concrete step. Explore our full services and schedule yours today.
Primary Sources and Official Guidance for Operators
The obligations covered here come directly from Massachusetts regulation and Commission guidance: 935 CMR 500.110 and 935 CMR 501.110 cover security equipment and reporting, 935 CMR 502.000 addresses alternate security provisions, and the Commission’s public safety guidance and incident bulletin explain how these rules get enforced. For technical access control guidance, see this access control resource.
Sources
- 935 CMR 500.110 — Security and alarm requirements (Cornell Legal Information Institute)
- Bulletin: Armed robberies / break-in attempts / social engineering schemes; incident reporting reminder (Cannabis Control Commission)
FAQ
Why Do Dispensaries Have Security Guards?
Dispensaries handle cash and a regulated, high-value product, which makes them a target for robbery and theft. Guards support the access control, monitoring, and incident response duties that Massachusetts regulation requires licensees to maintain.
Can Out-Of-State Residents Use Massachusetts Dispensaries?
Adult-use dispensaries in Massachusetts can serve anyone of legal age regardless of state residency, while medical dispensaries generally require a Massachusetts medical card. Security and identification checks apply the same way to every customer at the point of sale.
Do Massachusetts Dispensaries Track You?
Dispensaries verify identification at entry and point of sale to confirm age and, for medical patients, program eligibility, and they retain security footage as part of their compliance obligations under 935 CMR 500.110. This is a compliance and safety measure, not a marketing tracking system.
Can Anyone Buy From a Dispensary in Massachusetts?
Anyone of legal age with valid identification can purchase from an adult-use dispensary in Massachusetts. Medical dispensaries require a valid Massachusetts medical marijuana card in addition to identification.