Colorado State Cannabis Security Requirements
Here are the requirements for Colorado state as listed in as listed in Chapter 6-14: Medical Marijuana 6-14-10. Legislative Intent and Purpose., sec. title: "Requirements Related to Monitoring and Security of Restricted Areas and Inventory?"
All components of the security plan submitted with the application, as it may be amended, shall be in good working order, monitored, and secured twenty-four hours per day. A separate security system is required for each business. The security plan must include, at a minimum, the following security measures:
(a) Cameras. The medical marijuana business shall install and use security cameras to monitor and record all areas of the premises (except in restrooms and consulting rooms while a patient is undressed), and where persons may gain or attempt to gain access to marijuana or cash maintained by the medical marijuana business. Cameras shall record operations of the business to the off-site location, as well as all potential areas of ingress or egress to the business with sufficient detail to identify facial features and clothing. Recordings from security cameras shall be maintained for a minimum of forty days* (this was originally 30 and later revised to 40 days) in a secure offsite location in the city or through a service over a network that provides on-demand access, commonly referred to as a "cloud." The offsite location shall be included in the security plan submitted to the city and provided to the Boulder Police Department upon request, and updated within seventy-two hours of any change of such location.
(b) Use of Safe for Storage. The medical marijuana business shall install and use a safe for storage of any processed marijuana and cash on the premises when the business is closed to the public. The safe shall be incorporated into the building structure or securely attached thereto. For medical marijuana-infused products that must be kept refrigerated or frozen, the business may lock the refrigerated container or freezer in a manner authorized by the city in place of use of a safe so long as the container is affixed to the building structure.
(c) Alarm System. The medical marijuana business shall install and use an alarm system that is monitored by a company that is staffed twenty-four hours a day, seven days a week. The security plan submitted to the city shall identify the company monitoring the alarm, including contact information, and updated within seventy-two hours of any change of monitoring company.
Revision:
*RETAIL MARIJUANA CODE 1 CCR 212-2 added a few more items
1. All camera views of all Limited Access Areas must be continuously recorded 24 hours a day. The use of motion detection is authorized when a Licensee can demonstrate that monitored activities are adequately recorded.
2. All surveillance recordings must be kept for a minimum of 40 days and be in a format that can be easily accessed for viewing. Video recordings must be archived in a format that ensures authentication of the recording as legitimately captured video and guarantees that no alteration of the recorded image has taken place.
How to Comply with the Colorado Regulations:
Recording
Colorado does not have as much in terms of recording requirements, other than having cameras.
Storage
Like most states, the storage requirements are the hard part.
We cover storage requirements in-depth on the main Cannabis regulations page. For Colorado, you would only need 88% of what a provider in Washington State (what we used as an example on that page) would need on the charts we have listed there.
The state of Colorado does a not so great job in their offsite / cloud storage regulation section, often confusing industry terms. As far as the requirement for offsite storage, ignore that as it would mean the hassle of you driving back and forth to a second location with copies of footage, that's a lot of hassle -- Instead, focus on the second half, the "or," in that regulation. Despite having a fundamental misunderstanding as to how the system works and essentially writing gibberish, we think that when they say "through a service over a network that provides on-demand access, commonly referred to as a 'cloud,'" that they mean, that you can watch the system remotely. This describes every surveillance system we carry and the majority on the market. What they got wrong was describing the technology as "cloud." The technology that surveillance systems use is Peer-to-Peer (P2P) rather than "cloud."
The speed of the average internet upload speed of a US internet connection is about 5Mbps. A single 720P camera creates 1-2Mbps of video footage a second. The average cannabis system is thirty to sixty cameras. What they wrote is impossible to upload all cameras to the cloud for most internet connections where a grow opp could operate. The data being created by sixty or so HD continuously recorded security cameras is about 1000x greater than the average rural internet upload speeds. because most locations do not have the ability to send all the data that simultaneously recorded to the cloud at the same time.
Modern Commercial grade camera solutions solve this problem by using P2P to send data to whoever is watching the cameras, based upon what they are actively watching. In other words, when you want to remotely watch cameras 4, 16, and 51 and 62, the only data leaving your network is for those cameras - not all 70 cameras. Commercial grade systems send video on demand to whoever is watching the system with no central server in the way (cloud means multiple redundant central servers). They usually send a full HD video stream when watching a single camera full screen and low-resolution streams when watching the cameras on a grid. When you are not remote, you can watch all the cameras all at once without having to upload and video at all. We understand regulators confusion with the terms here, as many providers call their P2P connections something like "SCWCloud," but with their brand name. We refuse to do so as that just creates product confusion.
Cloud cameras, like Google Nest, Samsung Arlo, or Ring doorbells, are primarily used by consumer devices with small camera counts. The don't have to deal with this network speed problem because most people don't use more than one or two cameras on their home, usually on their front door. A consumer cloud camera usually record video clips (not continuous video) when a motion sensor is triggered or allowing you to only watch one camera live at a time. There is no video stored on the camera for cloud cameras; even when you are on location, you have to talk to a server to see your video and so are limited by your internet upload speed. All video exists in the cloud (unless they are specifically labeled "hybrid cloud," which means that they use cloud for some clips and onsite and P2P for other footage.) The state of Colorado's recording requirements states that you must continuously record 24-hours a day, so you can't use a collection of consumer grade cloud only cameras. We suggest that the state of Colorado replace the usage of the term "cloud" with more commercial specific language as to not confuse industrial / commercial products with popular consumer products, as their regulation clearly requites. The statement "commonly referred to as cloud" only serves to confuse operators.
*We're not lawyers and laws do change. We try our best to keep this page updated with changes to the law, but you should always do your own research or hire your own lawyer to guarantee compliance with the law.