Ill. Admin. Code tit. 68, § 1291.300 - Security Requirements

a) A dispensing organization shall develop and implement a security plan to deter and prevent improper entry into the dispensary and theft of cannabis or currency.

b) Security measures in the plan shall include, but not be limited to, the following:

1) Establishing a locked door or barrier between the dispensary's public entrance and the limited access area;

2) Preventing individuals from remaining on the premises if they are not engaging in activity permitted by the Act or this Part. Any physical removal shall comply with State and federal laws;

3) Maintaining a policy that addresses the maximum capacity;

4) Dispensing all cannabis from the restricted access area, which may include a pass-through window into the vaults. Any pass-through window from the vault to the restricted access area shall be capable of being closed and locked when not in use and shall not contain an opening greater than 9 inches;

5) Storing cannabis during all hours in an enclosed locked room or cabinet that is accessible only to dispensing organization agents;

6) Storing cannabis during non-operational hours in a locked reinforced vault room;

7) Storing currency during non-operational hours in a locked reinforced vault room or other location in a manner as to prevent diversion, theft or loss;

8) Keeping the reinforced vault room securely locked and protected from unauthorized entry at all times;

9) Keeping an electronic daily log of dispensing organization agents who access the reinforced vault room;

10) Maintaining all locks and security equipment in good working order including a manual lock on all doors leading to the exterior of the dispensing organization;

11) Maintaining an operational security and alarm system at all times;

12) Preventing keys from being left in locks or stored in a location accessible to individuals other than specifically authorized personnel;

13) Maintaining integrity of security systems, including, but not limited to, limiting access to combination numbers, passwords or other security measures to specifically authorized agents;

14) Ensuring the dispensary interior and exterior premises are sufficiently lit to facilitate surveillance;

15) Ensuring that trees, bushes and other foliage outside of the dispensary premises do not allow for an individual or individuals to conceal themselves and that trees, bushes, and other foliage outside of the dispensary premises do not obstruct the view of the perimeter of the dispensary;

16) Developing policies and procedures for immediately securing all product and currency following any instance of diversion, theft or loss of cannabis; for conducting an investigation into the cause of the diversion, theft, or loss; and to remediate any deficiencies that may have allowed the diversion, theft, or loss to occur;

17) Developing sufficient additional safeguards in response to any special security concerns, or as required by the Department; and

18) Installing counters which separate limited access areas from restricted access areas which are at least 48" in height, except counters spanning up to 36" in length may be reduced to no lower than 33" and not higher than 36" in height. Dispensing organizations operating before January 1, 2023, are exempt from this requirement until the time that they move locations.

c) A dispensing organization shall provide additional security measures as needed and appropriate for the community where it operates. (Section 15-100(f) of the Act)

d) Restricted Access Areas

1) All restricted access areas must be identified by the posting of a sign that shall be a minimum of 12" x 12" and that states "Do Not Enter - Restricted Access Area - Authorized Personnel Only" in lettering no smaller than 1" in height.

2) All restricted access areas shall be clearly described in the floor plan of the dispensing organization, in the form and format directed by the Department, reflecting walls, partitions, counters and all areas of entry and exit. The floor plan shall show all storage, disposal and retail sales areas.

3) All restricted access areas must be secure, with locking devices that prevent access from the limited access areas. (Section 15-100(g) of the Act)

e) Security and Alarm Systems

1) A dispensing organization shall have a security system designed to monitor, prevent and detect unauthorized intrusion, and theft or loss of cannabis or currency. The system shall use commercial grade equipment and be installed by an Illinois-licensed private alarm contractor or private alarm contractor agency. The system shall include, at a minimum:

A) A perimeter alarm on all entry points to the dispensary;

B) Glass break protection and security shatterproof film on perimeter windows;

C) A failure notification system that provides an alert to designated dispensing organization agents within five minutes of any operational failure of the surveillance system. The alert must be by phone or text message;

D) A sufficient number of panic and hold up buttons and alarms, a duress alarm, and an after-hours intrusion detection alarm, each of which will directly or indirectly notify the Public Safety Answering Point ("PSAP") for the law enforcement agency having primary jurisdiction;

E) Security equipment to deter and prevent unauthorized entrance into the dispensary, including electronic door locks on the doors in or providing access to limited and restricted access areas, and devices or a series of devices to detect unauthorized intrusion. Dispensing organizations must have video surveillance capable of producing images that allow for facial recognition at each door leading to the exterior of the dispensary;

F) Video surveillance monitors with 19-inch screens or larger;

G) Video surveillance that provides unobstructed views of all enclosed dispensary areas, unless prohibited by law. The surveillance equipment used must capture the image, with clear and certain identification, of any person entering or exiting the limited access area;

H) Video surveillance that provides unobstructed views of all outside areas, the storefront, and the parking lot. The surveillance equipment used must capture the image, with clear and certain identification, of any person entering or exiting the dispensary, the immediate surrounding area, and the license plates of vehicles in the parking lot;

I) Video surveillance at each point-of-sale terminal which captures the sale, the individuals, and the computer monitors used for the sale. The surveillance equipment used must capture the image, with clear and certain identification of any person involved in the sale;

J) Video surveillance, available for immediate viewing by the Department, that provides 24-hour recordings which are correctly time and date stamped. Recordings shall be retained for no less than 90 calendar days, and may not be deleted without Department approval if the dispensing organization is aware of the loss or theft of cannabis; a pending criminal, civil or administrative investigation; or a legal proceeding for which the recording may contain relevant information;

K) Video surveillance that will immediately and at any time produce a clear, color still photo from the surveillance video, either live or recorded;

L) Video surveillance that will export still images in a JPG, BMP, GIF, or JPEG image format. Exported video shall have the ability to be archived in a format that ensures authentication of the video and guarantees that no alteration of the recorded image has taken place. Exported video shall also have the ability to be saved in a file format that can be played on a standard computer operating system.

M) Any video surveillance that is required to produce facial recognition compliant images shall be at a minimum of 80 pixels per camera.

2) All security system equipment and recordings shall be maintained in good working order, in a secure location so as to prevent theft, loss, destruction or alterations.

3) Access to surveillance monitoring recording equipment shall be limited to persons that are essential to surveillance operations, law enforcement, security system service personnel and Department personnel. A current list of authorized dispensary agents and service personnel that have access to the surveillance equipment must be available to the Department upon request.

4) All security and video surveillance equipment shall be inspected and tested at regular intervals, not to exceed one month from the previous inspection and test to ensure the systems remain functional.

5) The security system shall provide protection against theft and diversion that is facilitated or hidden by tampering with computers or electronic records.

6) In the event of a power outage, the dispensary shall ensure all access doors remain secure and any video surveillance system remains fully operational for no less than four hours.

7) The dispensing organization must immediately report any security system outage to the Department, including, but not limited to, any loss of video recordings, and must submit an outage report in the form and format directed by the Department within five calendar days after the outage.

f) All electronic video surveillance monitoring must record at least the equivalent of 8 frames per second and be available to the Department and ISP 24 hours a day in real-time via a secure web-based portal with reverse functionality.

g) A dispensary shall have a reinforced vault built to the specifications of this subsection (g), unless it is a dispensing organization which operated before January 1, 2023. Dispensing organizations which operated before January 1, 2023, are exempt from this subsection (g) until the time that they move locations:

1) The walls, floors, and ceilings of a vault shall be constructed of:

A) At least 8" of reinforced concrete; or

B) All of the following:

i) 18-gauge studs made of galvanized sheet metal meeting requirements of American Society for Testing and Materials (ASTM) A1003;

ii) 9-gauge, Type II, Class 1 carbon steel security mesh and attachment clips meeting ASTM F1267 on either side of the studs; and

iii) Comparable materials and standards as approved by the Department.

2) The door and frame unit of the vault shall conform to the following specifications or the equivalent: 30 man-minutes against surreptitious entry, 10 man-minutes against forced entry, 20 man-hours against lock manipulation and 20 man-hours against radiological techniques;

3) A vault, if operations require it to remain open for frequent access, shall be equipped with a "day-gate" which is self-closing and self-locking, or the equivalent, for use during the hours of operation in which the vault door is open;

4) The walls or perimeter of a vault shall be equipped with an alarm, which upon unauthorized entry transmits a signal directly to a central station protection company, a local or State police agency which has a legal duty to respond or a 24-hour control station operation by the registrant; and

5) The door of a vault shall be equipped with contact switches.

h) Approved Vendor List. A dispensing organization shall submit a list to the Department of the names and contact information of all service professionals who will work at the dispensary for approval. The list shall include a description of the type of business or service provided. Changes to the approved vendor list shall be provided to the Department within five calendar days after any changes are made. No service professional shall work in the dispensary until the individual's name is provided to the Department on the approved vendor list and the Department confirms approval. A dispensing organization may permit a service professional who is not otherwise on the approved vendor list in the event of an emergency and after a good faith attempt to obtain the Department's pre-approval. In an emergency, the dispensing organization shall inform the Department as soon as possible of the event and the service professional's role. Examples of service professionals include, but are not limited to, cannabis transporters, IT professionals, security professionals, cleaning services, and other individuals whose work requires them to be within the actual dispensary.

Notes

Ill. Admin. Code tit. 68, § 1291.300

Added at 48 Ill. Reg. 13377, effective 8/20/2024