Updated
Dispensary security requirements, state by state
A dispensary is the rare commercial building where the security system is written for you before you ever call an installer. Your state regulator sets the camera resolution, the frame rate, the areas that must be covered, how long recordings live, and who may stand in the room with the recorder. Get those wrong and it is a license problem, not an insurance problem. Everything below is quoted from the rule text, with the citation, so you can hand it to a bidder.
The fact that sets the spec
Retention minimums run from 30 days to six months, so the same camera count needs six times the storage in Ohio that it needs in Colorado.
Ohio requires dispensary recordings to be retained for at least six months (OAC 3796:6-3-16). Colorado's current rule requires 30 days (1 CCR 212-3, Rule 3-225). Using the standard planning figure of about 1 TB per camera per month at 1080p, a 16-camera system needs roughly 16 TB to satisfy Colorado and roughly 96 TB to satisfy Ohio. That is the single biggest line item difference between two otherwise identical dispensary bids, and it is why a quote that does not name your retention window in days cannot be compared to anything.
The systems
What a cannabis dispensaries security system needs
System by system, and why. Each links to the buying guide with the questions that separate a sound quote from a cheap one.
Cameras are the licensed spec, not a preference
Most states name a minimum resolution, a minimum frame rate, and a list of areas that must be recorded. California requires at least 1280 x 720 at 15 frames per second and coverage of limited-access areas, security rooms, the recorder room itself, and every entrance and exit from both indoor and outdoor vantage points. Michigan requires 720p. Missouri requires 1920 x 1080 at 15 frames per second and bars motion-only recording anywhere product is present. Ask your bidder to mark each required area on the floor plan and label the camera that covers it.
Video Surveillance & CCTV guideLimited-access areas, badges, and a visitor log you can produce
The access side is usually written as three separate obligations: electronic locks on the doors into limited and restricted areas, badges on staff, and a written log of every non-employee who enters. California requires a sign-in and sign-out procedure, an employee escort at all times for non-employees, and a record naming the individual, their company, their reason for entry, and the times in and out. Washington requires visitor badges and a log kept on the premises for three years. A card system that writes an auditable log is the cheap way to satisfy the inspection, because the alternative is a clipboard someone has to have filled in correctly on a day nobody remembers.
Access Control Systems guidePerimeter alarm, panic buttons, duress and holdup
Illinois requires a perimeter alarm on all entry points, glass-break protection and shatterproof film on perimeter windows, and a sufficient number of panic and holdup buttons plus a duress alarm and an after-hours intrusion alarm, each notifying the Public Safety Answering Point for the law enforcement agency with primary jurisdiction. Massachusetts and Ohio separately require a duress alarm, a panic alarm and a holdup alarm. These are three different devices with three different signals, and a bidder who quotes one button has not read the rule.
Commercial Alarm Systems guideContinuous monitoring is often explicit in the rule
New Jersey requires that both the security alarm system and the video surveillance system be continuously monitored 24 hours a day, seven days a week, and expressly allows that monitoring to be done off-site. Colorado requires that licensed premises be continuously monitored and allows a monitoring company to fulfill it. California requires the alarm system to be installed, maintained, monitored and responded to by a licensed alarm company operator or its registered alarm agents. Price monitoring as a required line, not an upsell.
Business Alarm Monitoring guideFire is a building code question, not a cannabis one
The cannabis rules are quiet on fire alarm because NFPA 72 and your local code already answer it, and extraction or manufacturing on site can pull in far heavier requirements around occupancy classification and hazardous materials. Treat fire as a separate scope with its own NICET-credentialed bidder. The one overlap worth naming early: access control on egress doors has to release on a fire alarm, and that interlock gets designed once or fixed expensively later.
Commercial Fire Alarm guide
The rules
The rules that set the spec for cannabis dispensaries
Every claim below was checked against a named source on the date shown. Rules change and vary by jurisdiction, so confirm the current version with the regulator or your AHJ before you sign a scope.
California: 90 days, 1280 x 720, 15 frames per second
4 CCR section 15044 requires a digital video surveillance system with a minimum camera resolution of 1280 x 720 pixels, cameras permanently mounted and fixed, placement that clearly records activity within 20 feet of all points of entry and exit, continuous recording 24 hours a day at a minimum of 15 frames per second, and retention of surveillance recordings for a minimum of 90 calendar days. Retailers must also record point-of-sale areas and display areas with enough clarity to determine identity. The system needs a failure notification system that alerts the licensee to any interruption.
What it does to the spec. Ninety days of continuous recording is the storage driver. At roughly 1 TB per camera per month at 1080p, a 20-camera California dispensary is planning for about 60 TB before headroom, and about 120 TB if the design goes to 4K.
Source:California Department of Cannabis Control, Medicinal and Adult-Use Cannabis Regulations (revised July 1, 2026), section 15044· checked 2026-09-18
Colorado: 30 days, not the 40 days most guides still quote
Rule 3-225 in the current 1 CCR 212-3 requires that all surveillance recordings be kept for a minimum of 30 days in a format that can be easily accessed for viewing, that camera placement identify activity within 20 feet of all points of ingress and egress, that point-of-sale coverage record facial features with sufficient clarity to determine identity, and that equipment carry battery backup for at least two hours. The Division must be notified of any loss of video capability lasting beyond four hours. Off-site monitoring and off-site recording storage are expressly allowed if the remote standards meet or exceed the on-site ones.
What it does to the spec. Colorado is one of the cheapest retention windows in the country, and a Colorado dispensary that copied a 90-day design from a California operator is buying triple the storage it needs. Check the current rule before you size the recorder, because the widely repeated 40-day figure is not what the official copy says.
Source:Code of Colorado Regulations, 1 CCR 212-3 Colorado Marijuana Rules, Rule 3-225 (official copy via Colorado Secretary of State)· checked 2026-09-18
Illinois: 90 days, PSAP-notifying panic alarms, licensed installer
68 Ill. Adm. Code 1291.300 requires the system be installed by an Illinois-licensed private alarm contractor or agency; a perimeter alarm on all entry points; glass-break protection and shatterproof film on perimeter windows; a failure notification system that alerts staff by phone or text within five minutes; panic and holdup buttons, a duress alarm and an after-hours intrusion alarm that notify the PSAP; surveillance monitors of 19 inches or larger; unobstructed coverage of all enclosed dispensary areas, the storefront, the parking lot and vehicle license plates; recording at a minimum of 8 frames per second; 90 calendar days of retention; and four hours of continued video operation during a power outage.
What it does to the spec. Two cost effects. The installer has to hold an Illinois private alarm contractor license, which narrows the bidder list. And the parking lot plus license plate requirement adds exterior cameras with their own pathway, lighting and pixels-per-foot problem that indoor-only designs price out of.
Source:Ill. Admin. Code tit. 68, section 1291.300 (Security Requirements), Cornell Legal Information Institute· checked 2026-09-18
Access, escorts and visitor records are their own rule
California section 15042 requires an identification and sign-in and sign-out procedure for everyone accessing a premises not open to the public, requires that non-employees be escorted by an employee at all times, and requires a record of every authorized non-employee entry naming the individual, their company, the reason for entry, and the times in and out, produced to the Department immediately on request. Section 15043 requires retail staff to display a laminated badge with the license number, the employee's first name, a unique employee number and a photograph. Washington requires visitor badges plus a log of name, badge number, arrival, departure and purpose, retained on the premises for three years.
What it does to the spec. This is what turns a dispensary access control system from a convenience into a record-keeping system. Specify card or mobile credentials on every limited-access door and confirm the software exports a date-stamped audit trail, because the inspection asks for the log, not for the door.
Source:WAC 314-55-083, Washington State Legislature (badges and visitor log); California section 15042 in the DCC regulations· checked 2026-09-18
Oregon requires a real-time off-site backup of the surveillance room
OAR 845-025-1450 requires cameras that record at a minimum resolution of 1280 x 720 at 10 frames per second, surveillance recordings kept for a minimum of 90 calendar days, off-site backup recordings kept for a minimum of 30 days, backup of the surveillance room or surveillance area recordings off-site and in real time, and notice to the Commission within 48 hours of any equipment failure or outage lasting 30 minutes or more. Failing the 90-day retention is graded by how short you fell: seven days or less is a Category I violation.
What it does to the spec. The real-time off-site backup is a bandwidth and subscription line, not a hardware line, and it is the item most often missing from an Oregon bid priced off a generic camera count. Ask what upload bandwidth the design assumes and who pays for the cloud retention.
Source:OAR 845-025-1450, Video Recording Requirements for Licensed Facilities (Oregon Administrative Rules text)· checked 2026-09-18
Incident footage outlives the retention clock everywhere
Every state checked has a hold rule. Illinois recordings may not be deleted without Department approval where the licensee knows of a loss or theft, a pending investigation or a legal proceeding. New York requires an unaltered copy retained until the investigation or proceeding closes, and in no event less than 60 days. Massachusetts requires recordings retained as long as necessary where the establishment is aware of a pending investigation. Colorado bars destruction where the licensee knows or should have known of a pending proceeding, and otherwise requires recordings be erased or destroyed before a sale or transfer of the business.
What it does to the spec. Your recorder needs a lock or export workflow that pulls incident clips out of the rolling window without stopping the overwrite cycle. Ask bidders to demonstrate the export and the hold, not describe them.
Source:9 NYCRR 125.3 (New York security and surveillance), Cornell Legal Information Institute· checked 2026-09-18
Reference
Dispensary video retention minimums and camera rules, by state
| State | Retention minimum | Resolution / coverage rule | Rule citation |
|---|---|---|---|
| California | 90 calendar days | Minimum 1280 x 720 pixels, 15 fps, continuous 24/7. Must record within 20 feet of every entry and exit, limited-access areas, security rooms, the recorder room, and point-of-sale areas clearly enough to determine identity. | 4 CCR section 15044 |
| Colorado | 30 days | No pixel count stated. Placement must identify activity within 20 feet of all ingress and egress; point-of-sale coverage must capture facial features; two-hour battery backup; off-site storage allowed if standards match. | 1 CCR 212-3, Rule 3-225 |
| Illinois | 90 calendar days | Minimum 8 fps. Unobstructed views of all enclosed dispensary areas, the storefront, the parking lot and license plates. Facial recognition images at a minimum of 80 pixels per camera. Monitors 19 inches or larger. | 68 Ill. Adm. Code 1291.300 |
| Massachusetts | 90 calendar days (30 days for delivery video) | Cameras in all areas that may contain marijuana, at safes and vaults, at all points of entry and exit and in any parking lot, appropriate for normal lighting, angled for clear and certain identification. | 935 CMR 500.110 |
| Michigan | 30 calendar days | Minimum 720p. Cameras fixed and permanently mounted, recording within 20 feet of all points of entry and exit, plus point-of-sale, storage, destruction areas and the recorder room. | Mich. Admin. Code R 420.209 |
| Missouri | 60 days | Minimum 1920 x 1080, at least 15 fps, continuous monitoring in all lighting levels, remotely accessible in real time by the department or law enforcement. Motion detection is not allowed as continuous monitoring where product is present. | 19 CSR 100-1.090 |
| New Jersey | 30-day archive | No pixel count stated. Interior and exterior premises equipped with electronic monitoring, video cameras and panic buttons; both alarm and video systems continuously monitored 24/7, which may be done off-site. | N.J.A.C. 17:30-9.10 |
| New York | 60 days | Cameras at entry and exit points and each point-of-sale area for clear and certain identification, directed at safes, vaults and sales areas, plus any parking lot. Continuous during operating hours, motion-activated at other times. | 9 NYCRR 125.3 |
| Ohio | At least six months | Cameras capable of at least 30 fps, constant streaming while the dispensary is closed, still images from any camera, plus duress, panic and holdup alarms and an automatic voice dialer. | OAC 3796:6-3-16 |
| Oregon | 90 calendar days (plus 30-day off-site backup) | Minimum 1280 x 720 at 10 fps, all lighting conditions, continuous 24/7 where product may be present. Surveillance-area recordings must be backed up off-site in real time. | OAR 845-025-1450 |
| Washington | 45 days | Minimum camera resolution of 640 x 470 pixels or analog equivalent, IP compatible, fixed cameras, 24/7 at a minimum of 10 fps. Controlled areas include point-of-sale, product areas, the recorder room, and 20 feet outside outdoor grow fencing. | WAC 314-55-083 |
| Florida | At least 45 days | No pixel count in the statute. Cameras fixed to allow clear identification of persons and activities in controlled areas, and at entrances and exits from both indoor and outdoor vantage points, with accurate time and date display. | Fla. Stat. 381.986 |
Twelve states verified on 2026-09-18 by reading the rule or statute text itself: California and Colorado from the regulator's own published regulation PDF, Washington and Florida from the state legislature's code site, Oregon from the published Administrative Rules text, and Illinois, Massachusetts, Michigan, Missouri, New Jersey, New York and Ohio from the Cornell Legal Information Institute's reproduction of the state code. Arizona and Nevada were attempted and deliberately left out, because the current rule text could not be reached from a primary or regulator source on that date. Cannabis rules change more often than any other spec on this site. Confirm the current retention number with your state regulator before you buy storage, and put the citation in your bid documents.
Source:Compiled from each state's rule text; see the compliance citations above for the per-state source· checked 2026-09-18
Ballpark pricing
What a cannabis dispensaries security system costs
Labeled ballparks for planning, not quotes. They are built up from the same per-unit ranges used elsewhere on this site: roughly $9,000 to $35,000 for an 8 to 24 camera commercial system and $35,000 and up past 24 cameras, and $3,000 to $5,000 per door for access control with hardware, labor and first-year software included. The variable that moves a dispensary number most is retention days, because storage scales linearly with it. Cultivation adds camera count and difficult environments rather than difficult rules.
| Building | Typical scope | Installed | Recurring |
|---|---|---|---|
| Single dispensary storefront | 16 – 28 cameras · 90-day retention · 4 – 8 controlled doors · monitored alarm with panic, duress and holdup | $30,000 – $75,000 | $300 – $900/mo |
| Dispensary plus cultivation or manufacturing on site | 40 – 80 cameras · vault and limited-access coverage · 10 – 20 controlled doors · separate surveillance room | $75,000 – $200,000 | $700 – $2,000/mo |
| Multi-site operator | 3+ licensed premises · per-site surveillance area or review station · one credential database · central reporting | $150,000 – $600,000+ | $2,000 – $8,000+/mo |
Labeled ballparks for planning, built from the site’s per-system cost guides. A quote comes from a contractor who has walked the building.
Before you sign
What to ask a cannabis dispensaries security bidder
The questions that are specific to this building type. A bidder who has done this work before will have answers; one who has not will have a brochure.
- 01
Which rule are you designing to, by citation?
Ask the bidder to name the section number and the retention figure in days they are sizing storage for. A bidder who says "90 days, that is standard" in a 30-day state is padding, and a bidder who says "30 days" in a 90-day state is setting you up for a violation.
- 02
Show me the required-area list marked on my floor plan
Every state lists areas that must be recorded. Limited-access areas, the room holding the recorder, both sides of every entrance, point of sale, waste destruction. Ask for the plan with a camera number against each required area, so the inspector and the installer are reading the same document.
- 03
What is the storage math, including codec and headroom?
Ask for total terabytes, the assumed bitrate per camera, the codec, and how much headroom is included. H.265 versus H.264 changes the answer substantially. Then ask what happens on day 91: does it overwrite cleanly, and can you place a legal hold on a clip without stopping the cycle?
- 04
Is the recorder on-site, off-site, or both, and does my state allow it?
Colorado allows off-site storage if the remote standards meet or exceed the on-site ones. Oregon requires a real-time off-site backup of the surveillance area. California requires that recordings be viewable and copyable at the licensed premises immediately upon request. Get the architecture matched to the rule in writing.
- 05
How many panic devices, of what type, reporting where?
Duress, panic and holdup are three different signals. Ask how many of each, where they are mounted, whether the signal goes to a central station or directly to the PSAP, and what the false-activation procedure is before someone leans on one.
- 06
Who holds the alarm license in my state, and what is the number?
Illinois requires an Illinois-licensed private alarm contractor. California requires a licensed alarm company operator to install, maintain, monitor and respond. Ask for the license number, then check it with the state board rather than taking the logo on the proposal as proof.
Straight answers
Cannabis Dispensaries security, FAQ
How long do dispensaries have to keep security camera footage?
Between 30 days and six months, depending on the state. Verified minimums as of September 2026: Colorado, Michigan and New Jersey at 30 days, Washington and Florida at 45, New York and Missouri at 60, California, Illinois, Massachusetts and Oregon at 90, and Ohio at six months. Oregon adds a separate 30-day off-site backup requirement. Every one of those states also requires you to hold incident footage beyond the minimum if you know of a pending investigation or proceeding. Confirm your own state's current number with the regulator before sizing storage, because these rules change often.
What resolution do dispensary security cameras have to be?
It depends on the state, and the floors are lower than you would expect. Missouri names 1920 x 1080. California and Oregon name 1280 x 720. Michigan names 720p. Washington names 640 x 470 pixels or analog equivalent. Colorado, New Jersey and Florida name no pixel count at all and instead require clear and certain identification of persons and activities, which is a performance standard, not a spec. In practice the binding constraint is usually pixels per foot at the register and the door, not the camera's headline megapixel number.
How much does a dispensary security system cost?
As a planning ballpark, $30,000 to $75,000 installed for a single storefront with 16 to 28 cameras, 90-day retention, four to eight controlled doors and a monitored alarm, and $300 to $900 a month in monitoring and software. A dispensary with cultivation or manufacturing on the same site typically runs $75,000 to $200,000. These are ranges for comparison, not quotes. The two things that move the number are retention days, which drive storage, and door count, which drives access control labor at roughly $3,000 to $5,000 per door installed.
Do dispensaries need 24/7 monitoring?
In several states, yes, and it is written into the rule. New Jersey requires both the security alarm system and the video surveillance system to be continuously monitored 24 hours a day, seven days a week, and allows that to be off-site. Colorado requires licensed premises to be continuously monitored and lets a monitoring company do it. California requires a licensed alarm company operator or its agents to install, maintain, monitor and respond to the alarm. Budget monitoring as a required recurring line rather than an optional add-on.
Can dispensary video be stored off-site or in the cloud?
Usually yes, with conditions, and in Oregon part of it is mandatory. Colorado expressly authorizes off-site monitoring and off-site recording storage as long as the remote standards meet or exceed the on-site ones. Oregon requires the surveillance area recordings to be backed up off-site in real time, with those backups kept at least 30 days. California requires that recordings be kept so the Department can view and copy them at the licensed premises immediately upon request, which shapes how a cloud-only design has to be built. Match the architecture to your own rule before you sign a cloud subscription.
What are the access control requirements for a dispensary?
Electronic locks on limited and restricted access doors, staff badges, and a written visitor log you can produce on demand. California requires a sign-in and sign-out procedure, an employee escort for every non-employee at all times, and a record of each non-employee entry with name, company, reason and times in and out. Washington requires visitor badges and a log of name, badge number, arrival, departure and purpose, kept on the premises for three years. A credential system that exports a date-stamped audit trail is the practical way to satisfy this.
Why are dispensary security quotes so much higher than other retail quotes?
Storage and door count, mostly. A 90-day continuous retention window on 20 cameras is roughly 60 TB at 1080p, and around 120 TB at 4K, against maybe 20 TB for a normal 30-day retail system. On top of that you are paying for electronic locks and audit logging on every limited-access door, three separate categories of panic device, a failure notification system, battery backup, and in some states an installer who has to hold a specific state alarm license. None of that is optional, which is also why the cheapest dispensary bid usually turns out to be the one that skipped a rule.
Other building types
The systems are the same. The rules they operate under are not.
Cost guides
Dated, sourced ranges for each system, with per-unit prices.
What commercial security systems cost in 2026Get your cannabis dispensaries priced.
One short form, contractors who already work under your rules, and pricing you can compare line for line. No obligation, no fee.