Cannabis Facility IT Buildout Checklist:

What IT Infrastructure Does a Cannabis Facility Need?

A cannabis facility IT buildout should address 11 connected areas: internet redundancy, structured cabling, Wi-Fi, network segmentation, video surveillance, access control, environmental systems, POS and seed-to-sale integrations, employee access, cybersecurity and backups, and preopening testing. These systems should be planned together because a decision in one area—such as camera placement or cloud-managed controls—can change the network, storage, power, and support requirements elsewhere.

In This Guide

1. Internet service and backup connectivity
2. Structured cabling and telecommunications rooms
3. Facility-wide Wi-Fi
4. Network segmentation
5. Surveillance cameras and video storage
6. Access control and alarms
7. Environmental controls and connected equipment
8. POS, inventory, and seed-to-sale systems
9. User accounts and employee onboarding
10. Cybersecurity and backups
11. Testing before inspection and opening day

Bring IT Into the Project Early

One of the most expensive buildout mistakes is bringing in the IT provider after construction is already underway—or after it is complete.

Cabling, camera placement, wireless coverage, access control, equipment rooms, and environmental systems all depend on decisions made during design. Once the walls are finished, correcting those decisions becomes slower, more disruptive, and more expensive.

I recommend involving your IT and low-voltage teams while the architect and general contractor are still working through the plans. A provider experienced in cannabis IT services can help the other trades understand how their systems depend on the network. The technology review should include:

• Surveillance coverage and storage requirements for the applicable license
• Locations and capacity for telecommunications rooms or network closets
• Pathways for data, cameras, wireless access points, access control, POS, and connected equipment
• Power, cooling, physical security, and expansion space for technology equipment
• Coordination among the architect, general contractor, security provider, HVAC or controls contractor, POS provider, and seed-to-sale vendor
• A clear division of responsibility for installation, configuration, testing, documentation, and ongoing support

The goal is to resolve conflicts on the drawing—not after equipment arrives.

1. Internet Service and Backup Connectivity

Most cannabis facilities rely on cloud services and state tracking platforms. Metrc, for example, supports integrations that can send required data from POS and ERP systems through its API. Reporting procedures and allowable downtime processes vary by jurisdiction, so operators should confirm the current requirements with their regulator and software providers.

Regardless of the specific system, an internet outage can interrupt sales, inventory synchronization, communications, remote support, cloud-managed security, and compliance workflows.

Start with business-grade internet sized for the facility’s actual needs. The right capacity depends on the number of users, cloud applications, cameras, remote connections, and connected systems—not an arbitrary minimum speed.

I also recommend planning for a second connection or cellular failover when an outage could interrupt sales, compliance workflows, security, or environmental monitoring. Just as important, test that failover before opening. A backup connection is not much help if no one knows whether it works.

At minimum, the connectivity plan should include:

• Commercial routing and firewall equipment that supports monitoring, segmentation, and failover
• Battery backup for critical network and recording equipment
• A written outage procedure explaining what continues to work and how data will be reconciled

For cultivation and manufacturing operations, also determine what happens to environmental controls and production systems when internet service fails. Local control should not disappear simply because a cloud dashboard is temporarily unavailable.

2. Structured Cabling and Telecommunications Rooms

Structured cabling is the physical foundation of the facility. If it is poorly designed or undocumented, every connected system becomes harder to install, troubleshoot, and expand.

The Telecommunications Industry Association develops the TIA-568 family of structured-cabling standards. Category 6A is often a strong choice for new commercial construction because it provides useful bandwidth and future capacity, but the correct cable and pathway design should be based on distance, equipment, environment, applicable codes, and budget.

The cabling plan should account for every permanent connection: POS stations, workstations, phones, cameras, wireless access points, access-control equipment, alarms, environmental sensors, and building controls. Fiber may be appropriate between telecommunications rooms or buildings when distance, bandwidth, or electrical conditions make copper a poor choice.

The environment matters, too. Cable, conduit, and enclosures should be rated for the temperature, moisture, wash-down procedures, chemicals, and physical conditions where they will be installed. Every permanent run should land on a patch panel, be labeled at both ends, and be tested before the installation is accepted.

Do not close the project without accurate as-built drawings. Three years later, when a camera or sensor fails, your team should be able to identify its pathway and switch port without guessing.

Each telecommunications room should have adequate power, cooling, lighting, grounding, physical security, rack space, and room for future equipment. Do not place critical technology in a hot storage closet simply because there was leftover space on the floor plan.

3. Facility-Wide Wi-Fi

Reliable Wi-Fi requires more than placing access points where they look convenient. Cannabis facilities can be difficult wireless environments because of metal racks, dense walls, equipment, water, reflective surfaces, customer traffic, and changing room layouts.

Wireless coverage must be designed for both capacity and coverage. A predictive design can guide access-point placement, but it should be validated in the finished space. Hardwire access points back to managed switches, keep fixed critical systems such as POS terminals wired whenever practical, and isolate guest access from internal systems.

The real test is whether the network works where employees use scanners, tablets, sensors, and mobile workstations. Document every access point, switch port, name, and configuration so future support does not begin with detective work.

Cultivation rooms, production areas, warehouses, and retail floors have different wireless demands. One design should not be copied across every part of the building without testing.

4. Network Segmentation

A flat network places unrelated systems in the same security zone. If a poorly secured camera, guest device, sensor, or employee computer is compromised, an attacker may have an easier path to other systems.

CISA and NIST both recognize network segmentation as an important way to control traffic and limit the impact of a security incident. For a cannabis facility, logical security zones may include:

• Surveillance cameras and recording infrastructure
• POS and payment-related systems
• Seed-to-sale and inventory systems
• Business workstations and administrative devices
• Access control and physical-security equipment
• Environmental controls and other connected operational technology
• Employee mobile devices
• Guest Wi-Fi

The correct design depends on how the systems need to communicate. Segmentation should be enforced through managed switches, firewall rules, identity and access controls, and documented exceptions—not simply by creating several network names and assuming they are isolated.

5. Surveillance Cameras and Video Storage

Surveillance is one of the most regulated and storage-intensive systems in a cannabis facility. It is also one of the hardest systems to correct after construction. Our guide to designing cannabis video surveillance around the business explains why camera selection should follow the operational and regulatory plan—not come before it.

Requirements vary significantly by state, locality, license type, and sometimes by the specific area within a facility. California, for example, requires qualifying licensed premises to meet detailed standards for camera placement, image quality, protected coverage areas, recording, and failure notifications. Current Illinois rules require at least 90 days of retention for several license categories, although the permitted location and access method can vary by category. Use CTP’s cannabis security compliance by state resources as a planning starting point, then confirm the current rule with the appropriate regulator.

Before finalizing a surveillance design, verify:

• Required areas and viewpoints
• Minimum image resolution and frame rate
• Whether continuous or event-based recording is permitted
• Required retention period
• Requirements for timestamps, failure alerts, exports, still images, and regulator access
• Whether storage must be on-site, off-site, or accessible through a secure portal
• Rules for securing the recorder and limiting access to surveillance equipment
• Whether cameras are required in POS, storage, loading, waste, restricted-access, or recording-equipment areas

Size storage from actual settings

Avoid relying on a generic storage estimate. Required capacity changes based on:

• Number of cameras
• Resolution
• Frame rate
• Codec and compression settings
• Bitrate
• Continuous versus permitted event-based recording
• Scene complexity
• Audio, if used and allowed
• Retention period
• Redundancy and spare capacity

Have the vendor provide a written storage calculation based on the final camera schedule and recording settings. Then validate actual retention after the system has been running.

Also plan for drive failure, recorder failure, theft, fire, network interruption, and export requests. RAID can improve resilience against a drive failure, but it is not a backup. Where off-site or cloud storage is required—or justified by the organization’s risk—confirm upload capacity, recovery procedures, security, and the effect of an internet outage.

6. Access Control and Alarms

Access control should protect restricted areas while producing a usable record of who entered, where, and when. The design should address restricted doors, unique employee credentials, access logs, forced- or propped-door alerts, and prompt removal of access when someone changes roles or leaves.

Depending on the facility and applicable rules, the plan may also include monitored intrusion detection, panic or duress alarms, and links between alarm events and the corresponding video. Control panels, network connections, and power supplies need physical protection as well. A sophisticated access system is still vulnerable if its controller is mounted where anyone can reach it.

The fire alarm, intrusion alarm, and access-control systems must be designed and installed in accordance with applicable codes and authority requirements. Coordinate with the fire marshal, building officials, licensed security contractors, and the cannabis regulator rather than treating them as one interchangeable system.

7. Environmental Controls and Connected Equipment

For cultivators, environmental monitoring can be as operationally important as the business network. Connected systems may monitor temperature, humidity, carbon dioxide, lighting, irrigation, substrate conditions, HVAC, pumps, fans, filtration, and other production conditions.

The technology plan should answer:

• Which functions continue locally if cloud access or internet service fails?
• How are alarms delivered, and who receives them after hours?
• Are controllers and sensors on a protected network segment?
• How are firmware, credentials, remote vendor access, and software updates managed?
• Is historical environmental data backed up and retained?
• Are wireless sensors reliable in the actual room conditions?
• Is there a documented manual procedure if automation fails?

Automation can improve consistency, but it also creates dependencies. A dashboard is not a resilience plan unless the controls, alerts, network, and recovery procedures have been tested together.

8. POS, Inventory, and Seed-to-Sale Systems

POS, inventory, and seed-to-sale systems sit at the intersection of compliance and daily operations. Metrc uses software and RFID technology to provide end-to-end tracking, and its validated integrators can connect POS, ERP, and other systems through approved APIs. Other jurisdictions and license types may use different platforms and workflows.

Before opening, confirm which state system applies, which platforms are approved to integrate, and which system is the source of truth for each kind of information. Walk through how products, packages, units, and locations are mapped and how failed transactions or inventory discrepancies will be identified.

Then test the operational details. Staff should know what to do during an outage, how information will be reconciled when service returns, who investigates discrepancies, and how vendor support is reached during an incident. Scanners, printers, labels, and other required devices should be tested as part of the complete workflow—not one at a time in isolation.

Do not assume that buying two compatible products guarantees a reliable workflow. Integration still depends on configuration, permissions, product mapping, connectivity, staff procedures, and the capabilities of each vendor.

Protect these systems with role-based access, MFA where supported, endpoint security, patching, logging, and appropriate network controls. Payment security requirements should be confirmed with the POS provider, payment provider, and acquiring partners for the payment methods actually used.

9. User Accounts and Employee Onboarding

Shared accounts and unchanged default passwords can undermine an otherwise well-designed facility.

Every employee who needs system access should receive an individual account with permissions tied to the job. Default credentials must be changed on cameras, recorders, switches, access panels, controllers, and other devices. MFA should be enabled wherever supported, especially for administrative, remote-access, email, financial, and cloud accounts.

The process matters as much as the setup. Document who approves access, establish same-day offboarding for departing employees, and review privileged and vendor accounts regularly. Employees also need practical training on phishing, credential safety, incident reporting, and the systems they are expected to use.

Good access control is not only about keeping people out. It is about making sure the right people have the right access for the right amount of time.

10. Cybersecurity and Backups

Cannabis businesses combine valuable inventory, sensitive operational data, regulated systems, connected security equipment, and multiple vendors. That makes basic cybersecurity part of facility readiness—not a separate project to consider later. CTP’s managed security services for cannabis businesses provide additional information about protecting these environments.

NIST’s small-business guidance recommends MFA, strong passwords, regular backups, and measures to protect and test those backups. CISA similarly recommends maintaining offline, encrypted backups and testing recovery.

A practical baseline begins with knowing what you have: devices, software, cloud services, vendors, and administrative accounts. From there, implement MFA, endpoint protection, timely patching, email security, restricted remote access, logging, and alerts appropriate to the risk.

Employees need security-awareness training, and leadership needs an incident-response plan with current contacts and responsibilities. Backups should be protected from the production environment and restored in regular tests. A report saying the backup job completed is not proof that the business can recover.

Backups should be designed around defined recovery needs. Determine what data and configurations must be protected, how much data the business can afford to lose, how quickly each system must be restored, and who is responsible for recovery.

11. Test Before the Inspection—and Before Opening Day

Do not wait until the week of inspection to discover dead camera angles, an undersized recorder, failed internet failover, or missing user permissions.

Run a documented preopening test that includes:

• Reviewing every camera view against the current regulatory plan
• Retrieving and exporting recorded footage
• Confirming timestamps, retention, image quality, and failure alerts
• Testing primary-internet failure and automatic failover
• Testing UPS operation and safe shutdown procedures
• Verifying that POS, inventory, and state-tracking workflows operate as designed
• Confirming access-control logs and alarm notifications
• Testing employee onboarding and offboarding
• Confirming environmental sensors, controls, and alerts from the actual rooms
• Restoring representative data or configurations from backup
• Confirming vendor escalation contacts and after-hours procedures
• Recording results, open issues, responsible parties, and completion dates

A successful test should demonstrate how the full workflow operates—not merely that each individual device turns on.

Facility-Specific Priorities

Dispensaries

Pay particular attention to:

• POS and inventory workflows
• Camera views at entrances, exits, sales areas, product displays, storage, cash-handling, and restricted areas as required
• Reliable wired connections for fixed POS equipment
• Separate guest and internal networks
• Payment, scanner, receipt-printer, and label-printer requirements
• After-hours support and outage procedures
• Access controls for inventory, cash, and surveillance equipment

Cultivation Facilities

Pay particular attention to:

• Environmental controls and local operation during connectivity failures
• Wireless performance in each room
• Environmentally appropriate cable, conduit, devices, and enclosures
• Tracking workflows from plant or clone through harvest and packaging, as applicable
• Coverage of cultivation, storage, waste, loading, and perimeter areas as required
• Redundant communications and alerting for crop-critical systems
• Secure vendor access to HVAC, irrigation, lighting, and control platforms

Manufacturing and Processing Facilities

Pay particular attention to:

• Receiving, weighing, transformation, production, packaging, labeling, storage, and shipping workflows
• Batch and inventory tracking
• Coverage of regulated and restricted production areas
• Connected production and monitoring equipment
• Network access in areas with metal equipment, wash-down, heat, dust, or other environmental challenges
• Separation between business systems and operational equipment

 

Download the 30-Day Cannabis Facility IT Readiness Checklist

Technology problems become more expensive as opening day approaches. We created a downloadable checklist to help owners, project managers, contractors, and technology vendors confirm that critical systems are installed, documented, and tested before inspection.

DOWNLOAD CHECKLIST

The checklist covers:

Preopening Phase (30-Day Target)	Core Verification Requirements	Compliance & Operational Purpose
1. Connectivity	Primary ISP, backup ISP, automatic failover test, UPS on critical nodes	Prevent seed-to-sale and POS synchronization downtime.
2. Cabling & Telecom Rooms	Permanent labeled Cat6A/fiber, as-built drawings delivered, rack cooling/power	Ensure low-voltage compliance and long-term hardware reliability.
3. Network & Wi-Fi	Firewall/VLAN isolation, tested internal vs. guest Wi-Fi, secure remote access	Protect critical transaction and surveillance subnets.
4. Surveillance	Camera views vs. state regulations, retention verification, export procedures	Fulfill license requirements (e.g., DCC, IL Admin Code).
5. Access Control & Safety	Reader logs, forced-door alerts, panic buttons, fire marshal sign-off	Secure vault, inventory, and restricted facility zones.
6. Seed-to-Sale & POS	Metrc API accounts, package/location mapping, end-to-end transaction test	Avoid inventory reconciliation penalties and transaction stalls.
7. Environmental Systems	Sensor calibration, off-hours alerts, local operation during ISP loss	Safeguard cultivation crops and climate-control automation.
8. Cybersecurity & Backups	Individual accounts, MFA enforced, immutable backups restored in test	Meet NIST CSF 2.0 and CISA small-business baselines.

 

Download the 30-Day Cannabis Facility IT Readiness Checklist

Use it with your project manager, IT provider, security contractor, and operational vendors. Every item should be complete or in active testing at least 30 days before opening.

 

Frequently Asked Questions About Cannabis Facility IT Buildouts

When should an IT provider become involved in a cannabis facility buildout?

Bring the IT and low-voltage teams into the project during design, while the architect and general contractor can still adjust pathways, equipment rooms, power, cooling, camera locations, wireless access points, and system responsibilities. Waiting until construction is nearly complete can make corrections slower and more expensive.

Does every cannabis facility need backup internet?

Not every facility has the same risk, but backup connectivity should be considered whenever an outage could stop sales, disrupt compliance workflows, prevent remote access to security systems, or interfere with environmental monitoring. The backup connection and automatic failover should be tested before opening.

How much surveillance storage does a cannabis facility need?

There is no reliable one-size-fits-all number. Storage depends on the number of cameras, resolution, frame rate, bitrate, compression, recording method, scene complexity, redundancy, and the retention period required for the license. Request a written calculation based on the final camera schedule, then verify actual retention after recording begins.

Should cannabis POS terminals use Wi-Fi?

Fixed POS terminals should generally use wired network connections whenever practical. A wired connection provides more predictable performance and reduces dependence on wireless conditions. Wi-Fi may still provide a backup or support mobile devices, depending on the POS platform and facility design.

What should be tested before a cannabis facility inspection?

Test the complete workflows—not only individual devices. That includes camera views and footage exports, recording retention, failure alerts, internet failover, UPS operation, POS and seed-to-sale transactions, access-control logs, alarms, environmental alerts, user permissions, backups, and vendor escalation procedures.

Review the Plans Before the Walls Close

The best time to correct a technology problem is while it is still a line on a drawing.

Cannabis Technology Partners has supported cannabis technology environments since 2012 as a division of Silver Linings Technology. We help operators plan and manage networks, cybersecurity, surveillance, cloud services, help-desk support, compliance-related technology, and long-term IT strategy. For businesses planning beyond opening day, our cannabis-focused vCIO services connect technology decisions to growth, risk, and budget priorities.

If you are planning a new dispensary, cultivation facility, or manufacturing operation, we can review the technology plan before equipment is purchased and construction is complete. We will help identify gaps, coordinate system dependencies, and build a practical roadmap for opening day and the growth that follows.

Contact Cannabis Technology Partners to schedule a preconstruction technology review.

Sources and Further Reading

• Metrc: How POS and ERP Systems Integrate With Metrc
• Metrc: Validated Integrators
• California Department of Cannabis Control regulations cited in a 2026 enforcement decision
• Illinois Administrative Code, Section 1291.300: Security Requirements for Dispensing Organizations
• Illinois Administrative Code, Section 1300.385: Security
• Telecommunications Industry Association Standards
• NIST Cybersecurity Framework 2.0 Small Business Quick-Start Guide
• NIST Cybersecurity Basics
• CISA Cybersecurity Performance Goals
• CISA StopRansomware Guidance

This article is for planning and educational purposes and does not constitute legal advice. Confirm current requirements with the applicable cannabis regulator, building department, fire authority, licensed contractors, and technology vendors before finalizing a facility design.