New York State Cannabis Security Requirements
Here are the requirements for New York Cannabis Farms and Grow Opps as listed in as listed in "New York Chapter XIII, Part 1004: Security Camera System Requirements for Cannabis Farms and Dispensaries"
Security requirements for manufacturing and dispensing facilities.
(a) All facilities operated by a registered organization, including any manufacturing facility and dispensing facility, shall have a security system to prevent and detect diversion, theft or loss of marihuana and/or medical marijuana products, utilizing commercial grade equipment, which shall, at a minimum, include:
(1) a perimeter alarm;
(2) motion detectors;
(3) video cameras in all areas that may contain marihuana and at all points of entry and exit, which shall be appropriate for the normal lighting conditions of the area under surveillance. The manufacturing facility or dispensing facility shall direct cameras at all approved safes, approved vaults, dispensing areas, marihuana sales areas and any other area where marihuana is being produced, harvested, manufactured, stored, handled or dispensed. At entry and exit points, the manufacturing facility or dispensing facility shall angle cameras so as to allow for the capture of clear and certain identification of any person entering or exiting the facility;
(4) twenty-four hour recordings from all video cameras, which the manufacturing facility or dispensing facility shall make available for immediate viewing by the department or the department’s authorized representative upon request and shall be retained for at least 90 days. The registered organization shall provide the department with an unaltered copy of such recording upon request. If a registered organization is aware of a pending criminal, civil or administrative investigation or legal proceeding for which a recording may contain relevant information, the registered organization shall retain an unaltered copy of the recording until the investigation or proceeding is closed or the entity conducting the investigation or proceeding notifies the registered organization that it is not necessary to retain the recording;
(5) a duress alarm, which for purposes of this section means a silent security alarm system signal generated by the entry of a designated code into an arming station in order to signal that the alarm user is being forced to turn off the system;
(6) a panic alarm, which for purposes of this section, means an audible security alarm system signal generated by the manual activation of a device intended to signal a life threatening or emergency situation requiring a law enforcement response;
(7) a holdup alarm, which for purposes of this section, means a silent alarm signal generated by the manual activation of a device intended to signal a robbery in progress;
(8) an automatic voice dialer, which for purposes of this section, means any electrical, electronic, mechanical, or other device capable of being programmed to send a prerecorded voice message, when activated, over a telephone line, radio or other communication system, to a law enforcement, public safety or emergency services agency requesting dispatch;
(9) a failure notification system that provides an audible, text or visual notification of any failure in the surveillance system. The failure notification system shall provide an alert to the manufacturing facility or dispensing facility within five minutes of the failure, either by telephone, email, or text message;
(10) the ability to immediately produce a clear color still photo that is a minimum of 9600 dpi from any camera image (live or recorded);
(11) a date and time stamp embedded on all recordings. The date and time shall be synchronized and set correctly and shall not significantly obscure the picture; and
(12) the ability to remain operational during a power outage.
(b) A registered organization shall ensure that any manufacturing facility and dispensing facility maintains all security system equipment and recordings in a secure location so as to prevent theft, loss, destruction or alterations.
(c) In addition to the requirements listed in subdivision (a) of this section, each manufacturing facility and dispensing facility shall have a back-up alarm system approved by the department that shall detect unauthorized entry during times when no employees are present at the facility and that shall be provided by a company supplying commercial grade equipment, which shall not be the same company supplying the primary security system.
(d) A registered organization shall limit access to any surveillance areas solely to persons that are essential to surveillance operations, law enforcement agencies, security system service employees, the department or the department’s authorized representative, and others when approved by the department. A registered organization shall make available to the department or the department’s authorized representative, upon request, a current list of authorized employees and service employees who have access to any surveillance room. A manufacturing facility and dispensing facility shall keep all on-site surveillance rooms locked and shall not use such rooms for any other function.
(e) A registered organization shall keep illuminated the outside perimeter of any manufacturing facility and dispensing facility that is operated under the registered organization’s license.
(f) All video recordings shall allow for the exporting of still images in an industry standard image format (including .jpeg, .bmp, and .gif). Exported video shall have the ability to be archived in a proprietary format that ensures authentication of the video and guarantees that no alteration of the recorded image has taken place. Exported video shall also have the ability to be saved in an industry standard file format that can be played on a standard computer operating system. A registered organization shall erase all recordings prior to disposal or sale of the facility.
(g) A registered organization shall keep all security equipment in full operating order and shall test such equipment no less than monthly at each manufacturing facility and dispensing facility that is operated under the registered organization’s registration. Records of security tests must be maintained for five years and made available to the department upon request.
(h) The manufacturing facility of the registered organization must be securely locked and protected from unauthorized entry at all times.
How to Comply with the New York Regulations:
Alarms, Panic Buttons, Motion Detectors, Voice Dialer, Printer, and Computer
Before we get into the surveillance end, we do want to draw your attention to the requirements for either an alarm system with panic buttons, motion detectors and an auto-dialer. Also, you are required to produce a photograph on demand, so you will want a printer and a PC or Mac onsite as you cannot connect a printer to your NVR.
Battery Backup or a Generator
So, requirement number 12, "the ability to remain operational during a power outage" should strike you as incredibly odd, if you have read any of the other state regulations. Normally states add a timeframe after this; Nevada says "5 minutes," for example. Why? Because battery backups don't work forever. APC.com has a great tool for calculating and suggesting battery backup products based on time and load. Once you have a quote from us, our staff can tell your approximate power draw for our products. If you were any other state, you then you could pick out the appropriate battery backup that would last the amount of time regulated by that state. New York (and Massachusetts who seems to have copied it word for word) is unique; there's no timeframe listed. The only way to have 100% certainty that you are within the law is to have a local generator that automatically turns on when power is lost; we doubt that this is what was intended by this regulation, but it does appear to be what it says. Additionally, it isn't clear from this regulation what is required to remain operational during a power outage. Talk to a lawyer.
Registered Organizations
We assume this means that there is a list of companies that provide security walkthroughs and certifications in a manner synonymous to the Fire Marshal.
The "Failure Notification System" Recording Requirement
All of NVRs and cameras have notices that go out if the cameras are tampered with, disconnected, damaged, or moved. You can also enabled motion detection alerts and many other video analytics on our cameras. However, it seems more likely that this regulation is referencing the alarm or access control system, but it is pretty unclear. Either way, you should be fine.
9600 dpi
The "9600 dpi" requirement is absurd nonesense. Honestly, whoever wrote this requirement should be embarrassed. Number one, security cameras don't even use this sort of format to convey resolution; scanners and printers do, and number two, this just isn't enough information here to be meaningful. 1080P video is 1,920 × 1,080 pixels for the image frame.
Let's convey this as an example. Pretend that you and I both have 1080P TVs; mine is a small 12 inch 1080P TV and yours is a larger 60 inch 1080P TV. The small TV actually has more dots per inch (dpi) than the larger one (same number of dots in either TV as they are both 1080P), but no one would argue that the small TV is better - even though the 60 inch TV is nowhere near 9600 dpi and the 19 inch is well above it.
As another way to put this, if you printed a 9x7 photo of a 1080P image it would have a dpi of over 32,000, but if you blew it up to be 36x28 poster, you would no longer be compliant, despite having a larger, more useful print. To convey meaningful information about printing, you need to state both a resolution and an image size; to convey resolution for a file which isn't physical and thus doesn't have inches, you need pixel dimensions.
The phrasing of this regulation is just terrible; we have no idea what this regulation even means or how you would apply it. Assuming that they meant a 8.5x11 photo, you'll be fine with 1080P, but 720P wouldn't cut it. If you printed that 720P picture at 9x7, however, it would be over 9600 dpi. See the problem?
Date and Time stamps.
Just about every surveillance system does this. You can turn them off with most camera systems, but they should be on by default.
Image Export Filetypes.
Again, just about every surveillance system does this.
Storage Regulations:
You are required to have 24/7 recording.
So, motion detection based recording as a way to conserve space is out.
You are required to have 90 days of recording.
We cover storage requirements pretty in depth on the main Cannabis regulations page. For New York, you would only need 2X of what a provider in Washington State (who we used as an example) would need on the charts we have listed there.
*We're not lawyers and laws do change. We try our best to keep this page updated with changes to the law, but you should always do you own research or hire your own lawyer to guarantee compliance with the law.