D37.05 - Security and Transportation

SIGNIFICANCE AND USE
5.1 Information security programs and controls should be implemented by all cannabis businesses to protect information assets, which include information system infrastructure, architecture, analog (paper) and electronic data, files and records.  
5.2 The cannabis industry is in transition from an unregulated industry to a regulated industry, which involves substantial investment. Implementing an information security program helps organizations manage information security threats and protect the organization, employees, customers, vendors and other business partners from unauthorized access, misuse of information, crime, and costly exposure or loss.  
5.3 Cannabis customers and business partners place higher value on keeping information secure and have heightened concerns about information security due to the legal complexities and stigma around the industry.  
5.4 Information systems have multiple access points that present opportunities for vulnerabilities, such as user accounts, removable storage devices, internet connections, malicious malware and other attacks, scams, and poorly guided access controls.  
5.5 This practice intends to help organizations of all types and sizes find an acceptable balance of risks and costs of threat mitigation, recovery and remediation.  
5.6 When planning an information security program, a broad range of input from all departments (or functional areas), levels of staff, and areas of expertise (information technology, legal, compliance, human resources, tax/accounting) is ideal for identifying the highest information security risks to the organization and can make implementation go more smoothly.  
5.7 Information assets must be protected throughout the entire lifecycle (creation, transmission, review, storage, and destruction).  
5.8 Users of This Practice:  
5.8.1 This practice is written for cannabis business operations to be used by:  
5.8.1.1 Business owners and management to develop security controls to prevent, dete...
SCOPE
1.1 This practice covers recommendations for implementing an information security program to protect businesses operating in the regulated cannabis industry. An information security program is part of an overall security program that each business should implement.  
1.2 This practice applies to any legal business entity that handles cannabis products, including cultivation, processing, manufacturing, transportation, warehousing, lab testing, distribution, retail, home delivery, and waste. This practice will include protections for analog (paper) and digital information assets.  
1.3 Actual implementation will vary depending on organizational size and type, information asset types, sensitivity and volume of assets, risk tolerance and resource constraints of the organization, and mandates particular to the organization.  
1.4 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.5 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
3.1 The video surveillance system safeguards various areas considered critical to operations. The surveillance system uses cameras capable of capturing images and videos that can be compressed, stored, or sent over communication networks. The main difference between a digital video surveillance system and an analog video surveillance system is that a digital video surveillance system is capable of capturing and storing the video signal in a digital format. A digital video surveillance solution can be managed from anywhere and provide interoperability. The cameras can be networked and footage encrypted and digitally archived, which is considered crucial for most resin cannabis businesses because the video feed can be secured and shared with government authorities.
SCOPE
1.1 This guide covers the recommended video surveillance system for protecting resin cannabis, resin cannabis products, resin cannabis waste, currency, people, property, and assets.  
1.2 Units—The values stated in inch-pound units are to be regarded as the standard. The values given in parentheses are mathematical conversions to SI units that are provided for information only and are not considered standard.  
1.3 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations as defined by the Authority Having Jurisdiction (AHJ) prior to use.  
1.4 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
3.1 Access control system devices are installed at strategic locations, such as all exterior entrances, administrative offices, grow rooms, processing rooms, manufacturing rooms, storage areas, transaction areas, loading dock, vaults, and locker room.  
3.2 Access control system software tracks staff by recording access point ingress and egress activities while at the same time enhances the overall safety of the property.  
3.3 An access control system is especially important during an emergency to determine who is on and off the property.  
3.4 Individuals are permitted access after they have been subjected to background screening and issued credentials that allow for real-time monitoring and forensic analysis of employee or vendor on-site movement.  
3.5 All doors should also be secured with electric strike or magnetic locks that remain locked in the event of power loss (default secured).  
3.6 Limited access area door locks, unlocks, and opens through the use of a two-factor authentication consisting of at least two of the following: an access control credential (for example, badge, FOB, wireless device), personal identification number (PIN), or biometric, or combinations thereof with a keyed override system installed.  
3.7 Exterior door locks should be unlocked and opened through the use of a two-factor authentication consisting of at least two of the following: an access control credential (for example, badge, FOB, wireless device), personal identification number (PIN), or biometric, or combinations thereof with a keyed override system installed.  
3.8 Restricted access area, such as a vault and safe are protected by three-factor authentication consisting of at least three of the following: an access control credential (for example, badge, FOB, wireless device), personal identification number (PIN), or biometric, or combinations thereof.  
3.9 Growing, processing, manufacturing, transaction, product, and currency rooms should be protected by a minimum ...
SCOPE
1.1 This guide covers the recommended access control system for protecting resin cannabis, resin cannabis products, resin cannabis waste, currency, people, property, and assets.  
1.2 Units—The values stated in inch-pound units are to be regarded as standard. The values given in parentheses are mathematical conversions to SI units that are provided for information only and are not considered standard.  
1.3 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use. The recommendations herein are offered as the minimum requirement. All standards are subject to the requirements of the local Authority Having Jurisdiction (AHJ) in any given area.  
1.4 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.

SIGNIFICANCE AND USE
3.1 The intrusion detection system (IDS) safeguards various areas considered critical to operations. Intrusion detection devices include but are not limited to, door or window contact alarms that are activated when the device is separated, such as opening; and motion detection technology that uses a passive infrared to survey the area and sounds an audible notification alarm when a person or object moves into the protected space. Also included are glass-break detectors that use an audio sensor to pick up the actual frequency of broken glass. If the glass-break detector “hears” broken glass, an alarm is activated. If any of the devices are triggered when the system is armed, an alert is sent to a 24-h monitoring area for notification.
SCOPE
1.1 This guide covers the recommended intrusion detection system (IDS) for protecting resin cannabis, resin cannabis products, resin cannabis waste, currency, people, property, and assets.  
1.2 Units—The values stated in inch-pound units are to be regarded as standard. The values given in parentheses are mathematical conversions to SI units that are provided for information only and are not considered standard.  
1.3 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety, health, and environmental practices and determine the applicability of regulatory limitations prior to use.  
1.4 This international standard was developed in accordance with internationally recognized principles on standardization established in the Decision on Principles for the Development of International Standards, Guides and Recommendations issued by the World Trade Organization Technical Barriers to Trade (TBT) Committee.