California Cannabis Security: The 2026 Compliance Guide
The world's largest legal cannabis market has some of the strictest security requirements. Here's everything you need to know to stay compliant—and protected.
Why California Matters
California isn't just another cannabis market—it's the cannabis market. With over $5 billion in annual legal sales and thousands of licensed operators, the Golden State sets the standard for the industry.
But that size comes with scrutiny. The California Department of Cannabis Control (DCC) doesn't mess around when it comes to security compliance. Violations can mean fines up to $30,000 per day, license suspension, or permanent revocation.
After the STIIIZY breach exposed 420,000+ customer records in early 2025, regulators are paying closer attention than ever. If you're operating in California, your security program needs to be bulletproof.
California's Regulatory Framework
The Department of Cannabis Control (DCC)
As of July 2021, the DCC consolidated what were previously three separate licensing authorities:
- Bureau of Cannabis Control (retail, distribution, testing, microbusiness)
- CalCannabis Cultivation Licensing (cultivation)
- Manufactured Cannabis Safety Branch (manufacturing)
This means one agency, one set of rules, and one enforcement body watching everything you do.
Key Regulations
California Code of Regulations, Title 4, Division 19 governs cannabis licensing. The security-specific requirements are scattered throughout, but the main sections you need to know are:
- §15044 - Video Surveillance System requirements
- §15045 - Security Personnel requirements
- §15046 - Locks and physical security
- §15047 - Alarm System requirements
- §15048 - Track and Trace (METRC) requirements
Video Surveillance Requirements (§15044)
California has some of the most detailed video surveillance requirements in any state.
Minimum Coverage Areas
Your camera system must cover:
- All areas where cannabis goods are weighed, packed, stored, loaded, or unloaded
- Limited-access areas (must be clearly identified)
- Security rooms containing surveillance monitoring equipment
- All points of entry and exit (interior and exterior)
- All areas where cannabis waste is destroyed, stored, or composted
- Anywhere cannabis goods are sold (dispensaries)
Technical Specifications
| Requirement | Specification |
|---|---|
| Resolution | Minimum 1280×720 pixels |
| Frame Rate | Minimum 15 FPS |
| Lighting | Must operate in all lighting conditions (IR required) |
| Date/Time Stamp | Accurate to within one minute, visible on all recordings |
| Retention | Minimum 90 days (some local jurisdictions require more) |
24/7 Monitoring vs. Recording
The DCC requires continuous recording during business hours but doesn't mandate 24/7 live monitoring. However, many local jurisdictions (especially Los Angeles and San Francisco) add their own requirements for:
- Live monitoring during operating hours
- Direct connection to local law enforcement
- Additional camera placements
Pro Tip: Always check your local city/county cannabis ordinances. They frequently exceed state minimums.
Access and Availability
Here's where many operators get tripped up:
- Recordings must be available immediately upon request by the DCC or law enforcement
- You must have a dedicated monitor on-site for viewing recordings
- The system must allow for export to USB/DVD or provide immediate electronic access
- A current list of authorized users must be maintained
Physical Security Requirements
Limited-Access Areas (§15000.1)
Every California cannabis license requires designated "limited-access areas" where cannabis is present. These areas must have:
- Clear signage identifying them as limited-access
- Physical barriers preventing unauthorized entry
- Access control systems that log all entries and exits
- A current roster of authorized personnel
Only licensees, employees, contractors performing specific work, and authorized visitors (escorted at all times) may enter these areas.
CannaSecure
