Section 1291.300 Security Requirements

Section 1291.300  Security Requirements

a)         A dispensing

organization shall develop and implement a security plan to deter and prevent

improper entry into the dispensary and theft of cannabis or currency.

b)         Security measures in the

plan shall include, but not be limited to, the following:

1)         Establishing

a locked door or barrier between the dispensary's public entrance and the

limited access area;

2)         Preventing

individuals from remaining on the premises if they are not engaging in activity

permitted by the Act or this Part.  Any physical removal shall comply with State

and federal laws;

3)         Maintaining

a policy that addresses the maximum capacity;

4)         Dispensing

all cannabis from the restricted access area, which may include a pass-through

window into the vaults. Any pass-through window from the vault to the

restricted access area shall be capable of being closed and locked when not in

use and shall not contain an opening greater than 9 inches;

5)         Storing

cannabis during all hours in an enclosed locked room or cabinet that is

accessible only to dispensing organization agents;

6)         Storing

cannabis during non-operational hours in a locked reinforced vault room;

7)         Storing

currency during non-operational hours in a locked reinforced vault room or

other location in a manner as to prevent diversion, theft or loss;

8)         Keeping

the reinforced vault room securely locked and protected from unauthorized entry

at all times;

9)         Keeping

an electronic daily log of dispensing organization agents who access the reinforced

vault room;

10)       Maintaining

all locks and security equipment in good working order including a manual lock

on all doors leading to the exterior of the dispensing organization;

11)       Maintaining

an operational security and alarm system at all times;

12)       Preventing

keys from being left in locks or stored in a location accessible to individuals

other than specifically authorized personnel;

;

10)       Maintaining

all locks and security equipment in good working order including a manual lock

on all doors leading to the exterior of the dispensing organization;

11)       Maintaining

an operational security and alarm system at all times;

12)       Preventing

keys from being left in locks or stored in a location accessible to individuals

other than specifically authorized personnel;

13)       Maintaining

integrity of security systems, including, but not limited to, limiting access

to combination numbers, passwords or other security measures to specifically

authorized agents;

14)       Ensuring

the dispensary interior and exterior premises are sufficiently lit to

facilitate surveillance;

15)       Ensuring

that trees, bushes and other foliage outside of the dispensary premises do not

allow for an individual or individuals to conceal themselves and that trees,

bushes, and other foliage outside of the dispensary premises do not obstruct

the view of the perimeter of the dispensary;

16)       Developing

policies and procedures for immediately securing all product and currency

following any instance of diversion, theft or loss of cannabis; for conducting

an investigation into the cause of the diversion, theft, or loss; and to

remediate any deficiencies that may have allowed the diversion, theft, or loss

to occur;

17)       Developing

sufficient additional safeguards in response to any special security concerns,

or as required by the Department; and

18)       Installing

counters which separate limited access areas from restricted access areas which

are at least 48" in height, except counters spanning up to 36" in

length may be reduced to no lower than 33" and not higher than 36" in

height. Dispensing organizations operating before January 1, 2023, are exempt

from this requirement until the time that they move locations.

c)

A dispensing

organization shall provide additional security

measures

as needed and

appropriate for the community where it operates

in height, except counters spanning up to 36" in

length may be reduced to no lower than 33" and not higher than 36" in

height. Dispensing organizations operating before January 1, 2023, are exempt

from this requirement until the time that they move locations.

c)

A dispensing

organization shall provide additional security

measures

as needed and

appropriate for the community where it operates

.  (Section 15-100(f) of the

Act)

d)

Restricted Access

Areas

1)

All

restricted access areas must be identified by the posting of a sign that shall

be a minimum of 12" x 12" and that states "Do Not Enter –

Restricted Access Area – Authorized Personnel Only" in lettering no

smaller than 1" in height.

2)

All

restricted access areas shall be clearly described in the floor plan

of the

dispensing organization,

in the form and

format directed

by the

Department, reflecting walls, partitions, counters and all areas of entry and

exit.  The floor plan shall show all storage, disposal and retail sales areas.

3)

All

restricted access areas must be secure, with locking devices that prevent

access from the limited access areas.

(Section 15-100(g) of the Act)

e)         Security and Alarm

Systems

1)         A dispensing

organization shall have a security system designed to monitor, prevent and

detect unauthorized intrusion, and theft or loss of cannabis or currency.  The

system shall use commercial grade equipment and be installed by an

Illinois-licensed private alarm contractor or private alarm contractor agency.

The system shall include, at a minimum:

A)        A

perimeter alarm on all entry points to the dispensary;

B)        Glass

break protection and security shatterproof film on perimeter windows;

C)        A

failure notification system that provides an alert to designated dispensing organization

agents within five minutes of any operational failure of the surveillance

system

contractor agency.

The system shall include, at a minimum:

A)        A

perimeter alarm on all entry points to the dispensary;

B)        Glass

break protection and security shatterproof film on perimeter windows;

C)        A

failure notification system that provides an alert to designated dispensing organization

agents within five minutes of any operational failure of the surveillance

system.  The alert must be by phone or text message;

D)        A

sufficient number of panic and hold up buttons and alarms, a duress alarm, and

an after-hours intrusion detection alarm, each of which will directly or

indirectly notify the Public Safety Answering Point ("PSAP") for the

law enforcement agency having primary jurisdiction;

E)        Security

equipment to deter and prevent unauthorized entrance into the dispensary,

including electronic door locks on the doors in or providing access to limited

and restricted access areas, and devices or a series of devices to detect unauthorized

intrusion.  Dispensing organizations must have video surveillance capable of

producing images that allow for facial recognition at each door leading to the

exterior of the dispensary;

F)         Video

surveillance monitors with 19-inch screens or larger;

G)        Video

surveillance that provides unobstructed views of all enclosed dispensary areas,

unless prohibited by law.  The surveillance equipment used must capture the

image, with clear and certain identification, of any person entering or exiting

the limited access area;

H)        Video

surveillance that provides unobstructed views of all outside areas, the

storefront, and the parking lot.  The surveillance equipment used must capture

the image, with clear and certain identification, of any person entering or

exiting the dispensary, the immediate surrounding area, and the license plates

of vehicles in the parking lot;

I)         Video

surveillance at each point-of-sale terminal which captures the sale, the individuals,

and the computer monitors used for the sale

he parking lot.  The surveillance equipment used must capture

the image, with clear and certain identification, of any person entering or

exiting the dispensary, the immediate surrounding area, and the license plates

of vehicles in the parking lot;

I)         Video

surveillance at each point-of-sale terminal which captures the sale, the individuals,

and the computer monitors used for the sale.  The surveillance equipment used

must capture the image, with clear and certain identification of any person

involved in the sale;

J)         Video

surveillance, available for immediate viewing by the Department, that provides

24-hour recordings which are correctly time and date stamped.  Recordings shall

be retained for no less than 90 calendar days, and may not be deleted without

Department approval if the dispensing organization is aware of the loss or

theft of cannabis; a pending criminal, civil or administrative investigation;

or a legal proceeding for which the recording may contain relevant information;

K)        Video

surveillance that will immediately and at any time produce a clear, color still

photo from the surveillance video, either live or recorded;

L)        Video

surveillance that will export still images in a JPG, BMP, GIF, or JPEG image

format.  Exported video shall have the ability to be archived in a format that

ensures authentication of the video and guarantees that no alteration of the

recorded image has taken place.  Exported video shall also have the ability to

be saved in a file format that can be played on a standard computer operating

system.

M)       Any

video surveillance that is required to produce facial recognition compliant

images shall be at a minimum of 80 pixels per camera.

2)         All

security system equipment and recordings shall be maintained in good working

order, in a secure location so as to prevent theft, loss, destruction or

alterations

a file format that can be played on a standard computer operating

system.

M)       Any

video surveillance that is required to produce facial recognition compliant

images shall be at a minimum of 80 pixels per camera.

2)         All

security system equipment and recordings shall be maintained in good working

order, in a secure location so as to prevent theft, loss, destruction or

alterations.

3)         Access

to surveillance monitoring recording equipment shall be limited to persons that

are essential to surveillance operations, law enforcement, security system

service personnel and Department personnel.  A current list of authorized

dispensary agents and service personnel that have access to the surveillance

equipment must be available to the Department upon request.

4)         All

security and video surveillance equipment shall be inspected and tested at

regular intervals, not to exceed one month from the previous inspection and

test to ensure the systems remain functional.

5)         The

security system shall provide protection against theft and diversion that is

facilitated or hidden by tampering with computers or electronic records.

6)         In

the event of a power outage, the dispensary shall ensure all access doors

remain secure and any video surveillance system remains fully operational for

no less than four hours.

7)         The dispensing

organization must immediately report any security system outage to the

Department, including, but not limited to, any loss of video recordings, and

must submit an outage report in the form and format directed by the Department

within five calendar days after the outage.

f)         All

electronic video surveillance monitoring must record at least the equivalent of

8 frames per second and be available to the Department and ISP 24 hours a day

in real-time via a secure web-based portal with reverse functionality

loss of video recordings, and

must submit an outage report in the form and format directed by the Department

within five calendar days after the outage.

f)         All

electronic video surveillance monitoring must record at least the equivalent of

8 frames per second and be available to the Department and ISP 24 hours a day

in real-time via a secure web-based portal with reverse functionality.

g)         A

dispensary shall have a reinforced vault built to the specifications of this

subsection (g), unless it is a dispensing organization which operated before

January 1, 2023. Dispensing organizations which operated before January 1,

2023, are exempt from this subsection (g) until the time that they move

locations:

1)         The

walls, floors, and ceilings of a vault shall be constructed of:

A)        At

least 8" of reinforced concrete; or

B)        All of

the following:

i)          18-gauge

studs made of galvanized sheet metal meeting requirements of American Society

for Testing and Materials (ASTM) A1003;

ii)         9-gauge,

Type II, Class 1 carbon steel security mesh and attachment clips meeting ASTM

F1267 on either side of the studs; and

iii)        Comparable

materials and standards as approved by the Department.

2)         The

door and frame unit of the vault shall conform to the following specifications

or the equivalent:  30 man-minutes against surreptitious entry, 10 man-minutes

against forced entry, 20 man-hours against lock manipulation and 20 man-hours

against radiological techniques;

3)         A

vault, if operations require it to remain open for frequent access, shall be

equipped with a "day-gate" which is self-closing and self-locking, or

the equivalent, for use during the hours of operation in which the vault door

is open;

4)         The

walls or perimeter of a vault shall be equipped with an alarm, which upon

unauthorized entry transmits a signal directly to a central station protection

company, a local or State police agency which has a legal duty to respond or a

24-

a "day-gate" which is self-closing and self-locking, or

the equivalent, for use during the hours of operation in which the vault door

is open;

4)         The

walls or perimeter of a vault shall be equipped with an alarm, which upon

unauthorized entry transmits a signal directly to a central station protection

company, a local or State police agency which has a legal duty to respond or a

24-hour control station operation by the registrant; and

5)         The

door of a vault shall be equipped with contact switches.

h)         Approved

Vendor List.  A dispensing organization shall submit a list to the Department

of the names and contact information of all service professionals who will work

at the dispensary for approval.  The list shall include a description of the

type of business or service provided.  Changes to the approved vendor list

shall be provided to the Department within five calendar days after any changes

are made.  No service professional shall work in the dispensary until the individual's

name is provided to the Department on the approved vendor list and the

Department confirms approval.  A dispensing organization may permit a service

professional who is not otherwise on the approved vendor list in the event of

an emergency and after a good faith attempt to obtain the Department's

pre-approval. In an emergency, the dispensing organization shall inform the

Department as soon as possible of the event and the service professional's

role.  Examples of service professionals include, but are not limited to,

cannabis transporters, IT professionals, security professionals, cleaning

services, and other individuals whose work requires them to be within the

actual dispensary.