Cannabis Security Compliance by State

Why State Regulations Vary So Much

Cannabis laws are still evolving across the United States. Each state has created its own rules based on different priorities and concerns. Some states focus heavily on medical use, while others have embraced both medical and recreational markets

The Cost of Getting It Wrong

Non-compliance isn’t just a minor inconvenience. The cannabis industry faces serious consequences when they don’t follow state regulations properly including heavy fines, license suspension, or even criminal charges.

How IT Systems Make or Break Compliance

Your technology systems are the backbone of regulatory compliance. Every sale, every gram of product, and every customer interaction must be tracked and reported according to state rules. This includes:

• Seed-to-sale tracking through every step
• Capturing customer and product data at the point of sale.
• Surveillance systems and access control systems that meet state standards
• Data backup and storage that protects sensitive information
• Regular reporting that happens automatically and accurately

Why Generic IT Services Aren’t Enough

Most IT companies don’t understand cannabis regulations. They might be great at fixing computers or setting up networks, but they don’t know the specific compliance requirements your business faces.

This gap in knowledge can lead to:

• Missing data regulators demand
• Gaps in security that put your license at risk
• Preventable compliance failures

The Cannabis Technology Partners Advantage

At Cannabis Technology Partners, we live and breathe cannabis compliance. We’ve made it our mission to understand the specific IT requirements and security protocols for cannabis businesses in every legal state.

Contact us for more information about your state’s requirements and to learn more about our Cannabis Security Solutions

Overview of Each State’s IT Security Requirements

Regulations change fast. We track changes across the U.S. and summarize the IT-relevant requirements—seed-to-sale integrations, POS data capture, video surveillance, access control, retention, and reporting. To keep you aligned with your state’s current rules, the spreadsheet links directly to each regulator’s site.

How to use this resource

• Start with your state’s row, then click the Regulator/Program link to confirm the latest rules.
• Treat our notes as an implementation guide for IT and security—not a substitute for the posted regulations.
• If anything looks unclear or has recently changed, contact us and we’ll validate and update.

Our commitment to accuracy
We monitor regulator updates, bulletins, and rule changes and refresh this overview on a regular cadence. When states issue emergency rules or guidance, we prioritize updates that impact:

• Camera specs/coverage and retention windows
• POS/track-and-trace integrations and reporting intervals
• Data retention, encryption, backup, and audit requirements

Important notice (read this part)
This resource is for informational and operational planning purposes and does not constitute legal advice. Final compliance obligations are determined by your state regulator(s) and controlling statutes/rules. Always verify requirements using the regulator link provided for your state.

Want it handled correctly the first time?
Cannabis Technology Partners designs, implements, and manages compliant IT for multi-site operators and single-store teams alike. We’ll map your workflows to state rules, harden your systems, and set up monitoring so reporting is automatic and audit-ready.

• Compliance readiness review (track-and-trace, POS, video, access control)
• Gap assessment with a prioritized remediation plan
• Policy templates and audit evidence packages
• Ongoing monitoring and change-tracking when rules shift

Last reviewed: October 9, 2025 • Questions or updates? Contact: info@cannabistechnologypartners.com

State	Video Surveillance	Access Control	Technology & Data Security	Notes
AK	24/7 HD surveillance; 40-day retention; coverage of all areas incl. transport zones	Badge or biometric access; alarm systems; visitor logs	Secure server storage; encrypted data; GPS tracking for transport	Adult-use legalized by ballot (Measure 2, 2014).
AL	Medical cannabis legalized; 24/7 surveillance; 30-day retention	Badge system; restricted access zones; alarm systems	Secure server storage; encrypted data; audit logs	Implementation phase; licensing underway
AR	Medical cannabis only; 24/7 surveillance; 90-day retention	Badge system; restricted access zones; alarm integration	Secure server storage; encrypted backups; audit logs	No recreational use; strict medical rules
AZ	24/7 surveillance; 30-day retention; coverage of all activity zones	Controlled access to limited areas; visitor logs	Secure local storage; recommended encryption; audit logs	Medical and adult-use under ADHS
CA	24/7 HD surveillance; 90-day retention; real-time access for regulators	Biometric access; alarm systems; restricted zones clearly marked	Cybersecurity protocols; GPS tracking for transport; encrypted data backups	Most mature regulatory framework; detailed SOPs required
CO	24/7 HD surveillance; 40-day retention; coverage of all areas incl. storage	Badge system; restricted access zones; alarm systems	Secure local storage; audit logs; encryption recommended	Mature market; detailed MED rules2
CT	24/7 HD surveillance; 60-day retention; coverage of all areas incl. vaults	Badge or biometric access; alarm systems; visitor logs	Secure server storage; encrypted data; remote access prohibited	Adult-use legalized in 2021; DCP enforces strict SOPs
DE	24/7 coverage of all marijuana areas + entries; 90 days (routine) and up to 36 months if significant; secure on-site or third-party storage; Commissioner must have 24/7 remote access; document outages and follow failure procedures	Store all marijuana/products in locked & secured areas; limit entry to authorized personnel; visitors/contractors supervised; commercial-grade locks on perimeter doors; perimeter lighting sufficient for cameras within 10 ft; operational alarm with third-party monitoring & automatic notifications; monthly alarm inspections; maintain visitor logs (retain 1 year)	Use state seed-to-sale and retain electronic transport manifests 5 years; report theft/diversion within 1 business day; keep alarm/video maintenance & incident documentation ≥24 months; implement SOPs for record keeping, personnel security, disaster plan, and business continuity	Adult-use legalized in 2023; rules pending
FL	24/7 surveillance; 45-day retention; camera placement must cover all activity zones	Access logs; badge system; restricted access to vaults and grow areas	Data security plan required; encrypted storage; remote access allowed with safeguards	Medical-only market; strict physical security rules1
GA	Limited medical cannabis; 24/7 surveillance; 90-day retention	Controlled access to production areas; visitor logs	Secure server storage: encryption required	Only low-THC oil allowed; strict production rules
HI	Medical cannabis only; 24/7 surveillance; 30-day retention	Controlled access to grow and vault areas; visitor logs	Secure local storage; encryption required; remote access prohibited	Medical-only market; dispensary rules vary by island
IA	Limited medical cannabis; 24/7 surveillance; 30-day retention	Controlled access to production areas; visitor logs	Secure local storage; encryption recommended	Low-THC medical program only
ID	No legal cannabis program	N/A	N/A	CBD-only laws; no medical or recreational cannabis
IL	24/7 surveillance; 90-day retention; coverage of all ingress/egress points	Badge system; restricted access zones; alarm integration	Secure server storage; encryption required; audit logs	Adult-use and medical aligned under IDFPR
IN	No legal cannabis program	N/A	N/A	CBD-only laws; no medical or recreational cannabis
KS	No legal cannabis program	N/A	N/A	CBD-only laws; no medical or recreational cannabis
KY	Medical cannabis legalized in 2023; regulations pending	TBD	TBD	Implementation underway; no finalized security rules yet
LA	Medical cannabis only; 24/7 surveillance; 30-day retention	Badge system; restricted access zones	Secure local storage; encrypted backups; audit logs	Licensed pharmacies only; limited grower licenses
MA	24/7 HD surveillance; 90-day retention; coverage of all areas incl. vaults	Badge or biometric access; visitor logs; alarm systems	Cybersecurity plan required; encrypted data; remote access prohibited	CCC mandates detailed SOPs
MD	24/7 surveillance; 45-day retention; coverage of all activity zones	Badge or biometric access; alarm systems; visitor logs	Secure server storage; encryption required; audit logs	Medical-only until July 2023; now adult-use included
ME	24/7 HD surveillance; 60-day retention; coverage of all areas incl. transport zones	Badge or biometric access; alarm systems; visitor logs	Secure server storage; encrypted data; GPS tracking for transport	Adult-use legalized in 2016; robust compliance framework
MI	24/7 surveillance; 30-day retention; coverage of all ingress/egress points	Controlled access to limited areas; visitor logs; alarm integration	Secure server storage; audit logs; encryption recommended but not mandated	Medical and adult-use rules aligned under CRA
MN	24/7 HD surveillance; 90-day retention; coverage of all areas incl. delivery zones	Badge system; biometric access optional; alarm integration	Cybersecurity plan required; GPS tracking; encrypted data backups	Adult-use legalized; OCM enforces strict compliance
MO	24/7 surveillance; 60-day retention; coverage of all activity zones	Badge system; restricted access zones; alarm systems	Secure server storage; encryption required; audit logs	Adult-use legalized in 2022; unified medical/adult-use rules
MS	Medical cannabis legalized; 24/7 surveillance; 60-day retention	Controlled access to grow and vault areas; visitor logs	Secure local storage; encryption required; remote access prohibited	Medical-only market; active dispensary licensing
MT	24/7 surveillance; 30-day retention; coverage of all activity zones	Badge system; restricted access zones; alarm integration	Secure server storage; encrypted backups; audit logs	Adult-use legalized in 2020; unified rules
NC	No legal cannabis program	N/A	N/A	Only CBD allowed under limited conditions
ND	Medical cannabis only; 24/7 surveillance; 30-day retention	Badge system; restricted access zones; alarm integration	Secure server storage; encrypted backups; audit logs	Adult-use failed ballot; medical-only market
NE	No legal cannabis program	N/A	N/A	Legislative efforts ongoing; not yet legalized
NH	Medical cannabis only; 24/7 surveillance; 30-day retention	Controlled access to grow and vault areas; visitor logs	Secure local storage; encryption required; audit logs	Adult-use bills pending; medical-only market
NJ	24/7 surveillance; 60-day retention; coverage of all areas incl. transport zones	Badge system; restricted access zones; alarm systems	Cybersecurity protocols; encrypted data; remote access allowed with safeguards	CRC mandates strict transport rules
NM	24/7 HD surveillance; 30-day retention; coverage of all areas incl. transport zones	Badge system; restricted access zones; alarm systems	Secure server storage; encrypted data; audit logs	Adult-use legalized in 2021; strong compliance rules
NV	24/7 coverage; 30-day retention; tiered specs by facility area	Biometric or badge access; alarm systems; visitor logs	Cybersecurity protocols; GPS tracking for transport; encrypted data required	Tiered security based on license type
NY	24/7 HD surveillance; 60-day retention; coverage of all areas incl. storage	Biometric or badge access; logs for all entries	Data encryption; cybersecurity plan required; cloud storage allowed with safeguards	Separate rules for medical vs. adult-use facilities1
OH	24/7 surveillance; 45-day retention; coverage of all ingress/egress points	Controlled access to restricted areas; visitor logs	Secure local storage; encrypted backups; audit trails	Medical-only market; adult-use pending implementation
OK	Medical cannabis only; 24/7 surveillance; 90-day retention	Badge system; restricted access zones; alarm integration	Secure server storage; encrypted backups; audit logs	One of the largest medical markets; strict compliance rules
OR	24/7 HD surveillance; 90-day retention; resolution minimums (1280×720)	Badge or biometric access; alarm integration	Secure server storage; encrypted backups; remote access allowed with safeguards	Detailed tech specs per facility type
PA	24/7 coverage;  retention per current DOH rule; extended retention if footage is tied to an investigation; HD resolution; real-time monitoring required	Restricted access zones; badge system; visitor logs	Secure servers; audit trails; remote access prohibited; encryption required	Among strictest retention policies in the U.S.
RI	24/7 surveillance; 60-day retention; coverage of all activity zones	Controlled access to grow and vault areas; visitor logs	Secure local storage; encryption required; audit logs	Adult-use legalized in 2022; medical rules still apply
SC	No legal cannabis program	N/A	N/A	Legislative efforts ongoing; not yet legalized
SD	Medical cannabis only; 24/7 surveillance; 60-day retention	Controlled access to grow and vault areas; visitor logs	Secure local storage; encryption required; remote access prohibited	Adult-use repealed; medical-only market
TN	No legal cannabis program	N/A	N/A	CBD-only laws; no medical or recreational cannabis
TX	Low-THC medical program under Texas DPS Compassionate Use Program (CUP); 24/7 surveillance; 90-day retention	Restricted access to cultivation/processing/storage; metal security doors with secure locks; areas kept closed & locked; signage restricting access to DPS-registered individuals; visitor badging + continuous escort; visitor log; alarm system with door switches, motion sensors, fire/smoke detection and ability to alert law enforcement; post-cultivation storage in safe/metal container	N/A	Use CURT (state registry) for dispensing verification; maintain trip plans & transport logs for every delivery  and close out on return; report inventory discrepancy/loss/theft or fire to DPS within 2 days; align POS to capture required patient/guardian ID at point of dispense.
UT	Medical cannabis only; 24/7 surveillance; 45-day retention	Controlled access to production and dispensing areas; visitor logs	Secure local storage; encryption required; remote access prohibited	Medical-only market; strict pharmacy rules
VA	Medical cannabis only; 24/7 surveillance; 60-day retention	Badge system; restricted access zones; alarm integration	Secure server storage; encrypted backups; audit logs	Adult-use legalization repealed; medical-only market
VT	24/7 surveillance; 90-day retention; coverage of all activity zones	Badge system; restricted access zones; alarm systems	Secure server storage; encrypted data; remote access prohibited	Adult-use legalized in 2022; strict retail rules
WA	24/7 coverage; 45-day retention; frame rate requirements; real-time access for LCB	Controlled access to restricted areas; visitor logs	Integrated systems: cybersecurity plan recommended	Recreational-only market; strict camera specs
WI	No legal cannabis program	N/A	N/A	CBD-only laws; no medical or recreational cannabis
WV	Medical cannabis only; 24/7 surveillance; 30-day retention	Controlled access to production areas; visitor logs	Secure local storage; encryption required; audit logs	Limited dispensary footprint
WY	No legal cannabis program	N/A	N/A	CBD-only laws; no medical or recreational cannabis