Navigating the Cannabis Regulations – How can the Cloud Help?

Cannabis is more than just a medicinal or leisure drug. It is big business, with a “global revenue of 22 billion dollars in 2020 and an expected compound annual growth rate (CAGR) of approximately 28% between 2021 and 2026,” expecting to top 134 billion dollars globally by 2026. //finance.yahoo.com/news/28-cagr-legal-marijuana-market-195000388.html. This growth has created opportunity for the Craft Grower, the hobby grower that has now taken the side hustle to the market.

With big business typically comes regulation, such as oil and gas with NERC CIP, FDA rules for pharmaceutical drugs, or NFPA 72 for the fire-alarm industry.  The regulation ensures each state adheres to the same set of rules.  Surprisingly with the growth of the cannabis industry, it does not currently have federal regulations.  Each state has their own rules and how to apply those rules.  Within those states some local governments have more stringent requirements.  Since cannabis is big business, with a very large risk factor, insurance companies have additional regulatory requirements.  The state and local governments, and the insurance companies are the Authorities Having Jurisdiction or AHJs.  To date more than 36 states have an operational marijuana industry and have published or established security requirements for cannabis growers and sellers.  Regulations differ based on where in the process the cannabis product is; cultivation, manufacturing, processing, testing, transporting, or dispensary; medicinal or legalized facility.  The individualized security plan that each cannabis company is required to submit will dictate how they will address the requirements, including video surveillance which accounts for a majority of the security costs the company will ultimately incur. 

Examples of some of the more common video surveillance requirements are:

  • Long Retention Times for Video (30 days to 2 Years minimum requirements)
  • Minimum Quality and Frame Rates (2MP Cameras at 15fps)
  • End-to-End Video Encryption
  • Minimum Battery Backup (15 minutes to 24 hours for all security devices)
  • Other Jurisdiction specific requirements

AHJs not only create regulations for the cannabis companies, but many dictate Key Performance Indicators (KPIs) that the companies must align.  A KPI is a quantifiable measure of performance over time for a specific objective. The biggest threats to cannabis manufacturers and retails may not be an actual theft of product, but rather the KPIs dictated around downtime mitigation or mandatory uptimes.  KPIs may dictate additional security measures to be put in place in the event of a failure.  While some of these KPIs may seem benign, they can become very expensive. 

Examples of some of the more common video surveillance KPIs are:

  • Mandatory Uptimes
    • Device failure reported within 24 hours
  • Downtime Mitigation
    • Additional human guards in the event of a device or system failure.
    • Failure to mitigate in “reasonable” time could force a facility to shutter operations until the failure is mitigated.

Downtime Prevention for the Craft Grower

Cannabis companies are faced with overwhelming costs to meet the requirements and KPIs.  Not all Cannabis companies are large multi-state organizations which have an enterprise security plan to ensure they are compliant across multiple jurisdictions.  The Craft Grower is the most at risk, and have the most to lose.  Many Craft Growers know the business of Cannabis, but not security.  Security requirements are another unexpected cost, but one that can have detrimental effects on the business if not met. 

Downtime Prevention is a KPI instituted by many AHJs, both governmental and insurance carriers, to ensure the cameras are recording any abnormality, both internal and external threats.

The enterprise system is typically a fault-tolerant system with high-availability, possibly requiring multiple power feeds to the building for redundancy.  To meet the demands of video resolution, frame rate, and retention, the system needs to have significant amount of storage, upwards of a petabyte or more.  This type of system may include an active-active cluster configuration.

The Craft Grower has a much smaller need and a much smaller budget (if any) for cameras. The requirement is to have the appropriate number of cameras for the type of business, medicinal or legalized facility, and that those cameras must be recorded at a specified frame rate. Then there is the KPI for downtime mitigation; a KPI can shutter a Craft Grower in short order, causing loss of business. While the intent of the KPI is to minimize system downtime to prevent theft, a catastrophic failure can sink the business.

Typical Mitigation Strategy

  • Upon failure of device or system, contact the AHJ(s) within 24 hours
  • Upon failure of device or system, implement backup (if possible)
  • Upon failure of device or system, contact security vendor to remediate the situation. 
    • Depending on the level of mitigation needed or the type of equipment failed, this could mean days, weeks, or longer to receive parts. 
  • Upon failure of device or system, hire or hire additional physical security guards to walk the dispensary / growing Facility 24/7.  Guards must be onsite and visible to prevent theft. 

Depending on the level of failure, and the individual AHJ requirement, the facility may be required to close until the system is back into full functionality.  Loss of business not only stops the flow of money, but costly repairs on top of a closure can force a Craft Grower onto very difficult times, possibly forcing them to permanently close the business. 

The Craft Grower has options to prevent failures though. 

  • Do Nothing.  A simple solution.  Wait and hope a failure does not occur.  It costs the least amount initially, but could be the costliest in the event of a failure.
  • Advanced RMA.  An advanced RMA is sold through the manufacturer directly or through the system integrator to reduce downtime and site trips while parts arrive.  This has a minimal cost, with a significantly reduced wait time (2-3 days normally).  It is a budget conscious decision that offers protection, without an overwhelming spends.
  • Failover Appliances, server appliances or cloud instances that are configured as an active-passive cluster configuration, powered and ready to receive cameras if a failure occurs.  Significantly more cost to keep an additional camera system on hand, ready in the event of failure, but reducing downtime from days to minutes.  It is a mitigation strategy when minutes matter, or the cost of physical guards outweighs the cost of an additional appliance. 
  • A Disaster Recovery (DR) site, a fully redundant offsite data storage location, requiring additional real-estate, utilities, and potential staff.  This can be physical or cloud hosted.  This system may be an extension of the active-active cluster configuration.   This is a premium system with full redundancy, reducing downtime from minutes to seconds.  This is an enterprise mitigation strategy requiring an extensive budget. 

How Can the Cloud Help?

Cannabis companies need to meet the AHJ requirements as cost-conscious as they can, like most other businesses.  There are choices and they do not all require money to grow on trees, or plants in this case. 

Public clouds require no upfront investments, and are always there. They are managed, reliable, and scalable to meet the business needs. How to take advantage of it?

Rasilient Systems 

Introducing Rasilient Systems as the solution provider to meet this KPI and all other cannabis specific video surveillance requirements. 

Rasilient Systems, the No Frames Dropped (NFD™) surveillance appliance manufacturer, helps the Craft Grower meet the requirements and avoid costly KPIs at a fraction of the cost of similar systems.  Rasilient Systems, established in 2001, provides server, storage, and cloud recording platforms that are VMS agnostic using best-in-class technology. 

Rasilient Systems has a number of tools in our tool belt.  One of those tools is Emergency Cloud Recording (ECR).  ECR is an Advanced RMA tool that is a quick and inexpensive failsafe to allow customers to continue recording even after local storage has failed, by recording to the cloud.  ECR allows the Craft Grower to have short-term failover at a fraction of the cost.  ECR can be used to alleviate downtime concerns as the RMA is initiated and video is temporarily recorded to the cloud. 

At Rasilient Systems, we know the struggles the Craft Grower faces.  We provide downtime protection at a minimal cost, allowing the Craft Grower to maximize their business.  Contact us or one of our VMS/VSaaS partners to take advantage of our enhanced recording platform to mitigate downtime requirements and maximize revenue.

Download the white paper.