From medical to mainstream: Advice on security aspect of licence application
By Jeff Hannah
By Jeff Hannah
The process of securing a license to grow cannabis has, up to this point, been a difficult one. The actual ACMPR application form is fairly short and asks very broad questions.
Section 8 of the application, for example, simply states that applicants must provide a detailed description of how their proposed facility will comply with the Division C of the ACMPR. This consists of ten short sections addressing physical security requirements for cannabis production facilities.
Devil in the detail
The interesting thing about the ACMPR security requirements is that they are largely outcome-based. The regulation describes the desired outcome of a particular requirement without providing any detail as to how those outcomes are best achieved. Health Canada’s interpretation of those requirements has grown and evolved over time. Now, five years later, those standards are fairly well established that experienced service providers in the industry can provide accurate advice to help achieve compliance in workable and cost-effective ways.
As a consultant focused on providing the security portion of the application, my role is to be a repository of established and tested interpretations of the regulation. As an example, section 55 states that the intrusion detection system must “operate at all times.” As a practical interpretation, this means the security system must be connected to an emergency generator or other reliable, redundant power source. Historically, Health Canada has not shared that information directly with existing and/or prospective applicants.
Submitting an application that doesn’t specifically address the myriad of established interpretations can result in information requests that cause delays or the application to be deemed incomplete.
While there was widespread speculation before the publication of the Cannabis Act that the security requirements in the ACMPR would be significantly relaxed, that really did not happen. The security requirements for the Cannabis Act license classes, which are roughly equivalent to a licensed producer under the ACMPR, are substantially similar.
While that means there will still be a substantial cost associated with properly securing a commercial cannabis production facility, the bank of knowledge that exists today among successful consultants can help applicants secure licences under the new Act.
The most notable change is that Health Canada now requires that applicants submit and Organizational Security Plan (OSP) as part of their licence application. Section 6.8 of the Cannabis Licensing Application Guide issued by Health Canada provides a summary of the areas, which must be addressed in the OSP.
A plain reading of Division C of the ACMPR would leave any reasonable person to believe that the security strategy prescribed by the regulation is focused almost exclusively on the capabilities of the electronic security system. Most of Division C outlines requirements for video surveillance as well as the interior and exterior intrusion system. Additional sections address physical barriers, supervision, and logging requirements. Division C makes no mention of electronic access control. However, it’s only through experience that security consultants know licensed producers require a robust and full-featured electronic access management system.
In the past, many applicants made the mistake of focusing too much of their efforts on presenting the capabilities of their electronic security systems and not enough on other important aspects of physical security.
My personal experience dealing with Health Canada, which includes around 150 applications and counting, has helped me realize that a much more holistic approach to physical security is required. Submitting a complete section 8 minimizes information requests, thereby saving time. The submission should be a fulsome description of how policy, procedure, training, physical design elements, and electronic system combine to create a well-rounded and complete physical security program. This approach has always been well received by Health Canada and often results in none or very few requests for additional information.
I believe that introducing a requirement that applicants submit an Organizational Security Plan is Health Canada’s way of clarifying that point.
All existing ACMPR applicants will be required to modify their current application to meet the new requirements of the Cannabis Act after Oct.17th if they wish to remain under consideration for a licence. I encourage any current ACMPR applicant whose submission doesn’t currently provide a complete picture of their proposed facility’s physical security program to begin compiling the information needed to demonstrate an effective Organizational Security Plan.
Jeff Hannah is the owner and principal consultant at JH & Associates Security and Risk Management Consultants.
Email him at firstname.lastname@example.org.