Physical Security & Cybersecurity Integration Guide

Bridging the Gap Between Locks and Firewalls in Cannabis Facilities

Your IP cameras are on the same network as your POS system. Your access control badges are managed by cloud software. Your alarm system calls out over the internet. Physical security IS cybersecurity—and most cannabis operators don't realize it until after the breach.

WHY THIS GUIDE MATTERS

The cannabis industry has some of the strictest physical security requirements of any sector. States mandate cameras, access controls, alarm systems, vault storage, and security guards.

But here's what regulators didn't anticipate: every physical security device you install is now a computer on your network.

Your "physical" security is actually:

• IP cameras running Linux firmware with known vulnerabilities
• Access control systems connected to cloud management platforms
• Alarm panels communicating over cellular or internet connections
• DVR/NVR systems storing terabytes of footage on networked drives
• Environmental sensors reporting to cloud dashboards
• Smart safes with wireless connectivity

When attackers compromise these systems, they can:

• Disable cameras before a break-in
• Unlock doors remotely
• Suppress alarm notifications
• Watch your facility in real-time to plan robberies
• Use cameras as entry points to your entire network
• Harvest footage of employees entering safe combinations
• Access your POS, Metrc, and business systems through lateral movement

Real-World Incidents:

• 2023: Cannabis cultivation facility in California had IP cameras compromised through default credentials. Attackers watched operations for weeks before a coordinated theft.
• 2024: Colorado dispensary's NVR was infected with ransomware that spread to their POS system through an unsegmented network—both physical security footage AND sales data were encrypted.
• 2024: Oregon grow operation discovered their "secure" access control system had been backdoored, with badge access logs being exfiltrated to track employee schedules.
• 2025: Multi-state operator found that a vulnerability in their cloud-connected safe management system exposed safe combinations across 12 locations.

This guide shows you how to:

• Understand where physical and cyber security intersect
• Secure your cameras, access control, and alarm systems
• Properly segment your network to isolate security devices
• Implement monitoring that catches both physical AND cyber threats
• Meet compliance requirements while building real security
• Create integrated incident response procedures