Cannabis IT compliance
requirements by state.

Surveillance & Video Storage

Every legal cannabis state requires video surveillance. The differences are in resolution, coverage, and — critically — how long you must retain the footage. This directly determines your NVRiNetwork Video Recorder — server storing surveillance footage. storage sizing, backup strategy, and infrastructure costs.

This is a representative sample. Requirements vary by license type and municipality. Contact us for a complete assessment of your state's specific mandates.

Access Control Requirements

Nearly all states require electronic access control for limited-access areas where cannabis is stored, processed, or handled. Common requirements include employee badge systems with photo ID, visitor management with sign-in/sign-out logging, immediate badge deactivation upon employee termination, and access logs maintained for 3+ years. Some states (California, Illinois) mandate or strongly recommend biometric access for vault and storage areas.

Seed-to-Sale Tracking

METRCiMarijuana Enforcement Tracking Reporting Compliance — state-mandated seed-to-sale tracking used in 28+ U.S. states. operates in 29 states and territories, serving over 300,000 users and 39,000+ licensed operators. BioTrack covers approximately 9 additional states. Your IT infrastructure must support reliable API connectivity to your state's tracking system, backup internet (cellular failover) for continuous reporting, offline data capture capability during system outages, and RFIDiRadio-Frequency Identification — wireless tags on cannabis packages for automatic supply chain tracking./barcode scanning hardware for package tag management. METRCiMarijuana Enforcement Tracking Reporting Compliance — state-mandated seed-to-sale tracking used in 28+ U.S. states. outages are a documented operational risk — California has experienced outages lasting up to 9 hours, and Maryland outages forced emergency sales exceptions five times in two weeks.

Data Protection & Privacy

Illinois leads in explicit cybersecurity mandates, requiring HIPAA compliance (45 CFR 164) for medical cannabis dispensaries, encryption at rest and in transit, multi-factor authentication, separated networks, and industry-standard firewalls. Violations carry $10,000 per citation penalties. California applies CCPA/CPRA to cannabis customer data, with statutory damages of $100–$750 per consumer per incident for data breaches. Massachusetts requires annual third-party security audits for cannabis licensees.