(1)
General Requirements. An MTC shall implement
sufficient security measures to deter and prevent unauthorized entrance into
areas containing Marijuana, theft of Marijuana and ensure the safety of MTC
employees, Qualifying Patients and the general public. Security measures to
protect the Premises, Registered Qualifying Patients, Personal Caregivers, and
MTC agents of the MTC shall include, but are not limited to, the following:
(a) Positively identifying and allowing only
Registered Qualifying Patients, Personal Caregivers, MTC agents, Marijuana
Courier agents, as applicable, and, subject to the requirements of 935 CMR
501.110(4)(e), outside vendors, contractors, and Visitors, access to the
MTC;
(b) Preventing individuals
from remaining on the Premises of the MTC if they are not engaging in activity
expressly or by necessary implication permitted by M.G.L. c. 94I, and
935
CMR 501.000;
(c) Disposing of Marijuana in accordance with
935
CMR 501.105(12), in excess
of the quantity required for normal, efficient operation as established within
935
CMR 501.105;
(d) Securing all entrances to the MTC to
prevent unauthorized access;
(e)
Establishing Limited Access Areas which, after receipt of a final License,
shall be accessible only to specifically authorized personnel limited to
include only the minimum number of employees essential for efficient
operation;
(f) Storing all finished
Marijuana in a secure, locked safe or vault and in such a manner as to prevent
diversion, theft, and loss;
(g)
Keeping all safes, vaults, and any other equipment or areas used for the
production, cultivation, harvesting, Processing, or storage, including prior to
disposal, of Marijuana and MIPs securely locked and protected from entry,
except for the actual time required to remove or replace Marijuana;
(h) Keeping all locks and security equipment
in good working order;
(i)
Prohibiting keys, if any, from being left in the locks, or stored or placed in
a location accessible to persons other than specifically authorized personnel;
(j) Prohibit accessibility of
security measures, such as combination numbers, passwords, or electronic or
biometric security systems, to persons other than specifically authorized
personnel;
(k) Ensure that the
outside perimeter of the MTC is sufficiently lit to facilitate
surveillance;
(l) Ensuring that all
Marijuana Products are kept out of plain sight and are not visible from a
public place, outside of the MTC, without the use of binoculars, optical aids
or aircraft;
(m) Develop emergency
policies and procedures for securing all product following any instance of
diversion, theft, or loss of Marijuana, and conduct an assessment to determine
whether additional safeguards are necessary;
(n) Develop sufficient additional safeguards
as required by the Commission for MTCs that present special security concerns;
(o) At MTCs where transactions are
conducted in cash, establishing procedures for safe cash handling and cash
transportation to financial institutions to prevent theft, loss and associated
risks to the safety of employees, customers and the general public;
(p) Sharing the MTC's floor plan or layout of
the facility with Law Enforcement Authorities in a manner and scope as required
by the municipality and identifying when the use of flammable or combustible
solvents, chemicals or other materials are in use at the MTC;
(q) Sharing the MTC's security plan and
procedures with Law Enforcement Authorities, in the municipality where the MTC
is located and periodically updating Law Enforcement Authorities if the plans
or procedures are modified in a material way; and
(r) Inside the MTC, all Marijuana shall be
kept in a Limited Access Area inaccessible to any persons other than MTC
agents, except for displays allowable under 935 CMR 501.105(4)(a 4. Inside the
MTC, all Marijuana shall be stored in a locked, access-controlled space in a
Limited Access Area during nonbusiness hours.
(2)
Alternative Security
Provisions.
(a) Notwithstanding
the requirements specified in 935 CMR 501.110(1) and (5) through (7), if an MTC
has provided other, specific safeguards that may be regarded as an adequate
substitute for those requirements, such measures may be taken into account by
the Commission in evaluating the overall required security measures. For
purposes of cash handling and cash transportation, only alternative safeguards
that comply with the requirements of 935 CMR 501.110(7)(b) shall be considered
to be adequate substitutes.
(b) The
applicant or Licensee shall submit a request for an alternative security
provision to the Commission on a form as determined and made available by the
Commission. Upon receipt of the form, the Commission shall submit the request
to the chief law enforcement officer in the municipality where the MTC is
located or will be located. The Commission shall request that the chief law
enforcement officer review the request and alternative security provision
requested and, within 30 days;
1. Certify the
sufficiency of the requested alternate security provision; or
2. Provide the Commission with a statement of
reasons why the alternative security provision is not sufficient in the opinion
of the chief law enforcement officer.
(c) The Commission shall take the chief law
enforcement officer's opinion under consideration in determining whether to
grant the alternative security provision, provided that it may not be
determinative. If no response is received from the chief law enforcement
officer or a delegee within 30 days of submitting the request to the chief law
enforcement officer, the Commission shall proceed with a
determination.
(3)
Buffer Zone. An MTC Entrance may not be closer than
500 feet from the nearest School Entrance, unless a city or town adopts an
ordinance or bylaw that reduces the distance requirement.
(a) The buffer zone distance of 500 feet
shall be measured in a straight line from the geometric center of the MTC
Entrance to the geometric center of the nearest School Entrance unless there is
an Impassable Barrier within those 500 feet; in these cases, the buffer zone
distance shall be measured along the center of the shortest publicly-accessible
pedestrian travel path from the geometric center of the MTC Entrance to the
geometric center of the nearest School Entrance.
(b) The buffer zone distance of 500 feet may
be reduced if a city or town adopts an ordinance or bylaw that reduces the
distance requirement.
(4)
Limited Access Areas.
(a) All Limited Access Areas shall be
identified by the posting of a sign that shall be a minimum of 12" x 12" and
which states: "Do Not Enter - Limited Access - Area Access Limited to
Authorized Personnel Only" in lettering no smaller than one inch in
height.
(b) All Limited Access
Areas shall be clearly described by the filing of a diagram of the licensed
Premises, in the form and manner determined by the Commission, reflecting
walls, partitions, counters, and all areas of entry and exit, including loading
areas. Said diagram shall also show all Propagation, Vegetation, Flowering,
Processing, production, storage, disposal, and retail sales areas.
(c) At all times following receipt of a final
License, access to Limited Access Areas shall be limited to persons that are
essential to operations in these areas and specifically permitted by the MTC,
representatives of the Commission acting in accordance with their authority
under the adult use, medical use and CMO laws; Commission Delegee(s); and local
law enforcement authorities, fire safety personnel and emergency medical
services acting within their lawful jurisdiction and official
capacity.
(d) An MTC agent shall
visibly display an identification badge issued by the MTC or the Commission at
all times while at the MTC or transporting Marijuana.
(e) Following receipt of a final License, all
outside vendors, contractors, and Visitors shall obtain a Visitor
Identification Badge prior to entering a Limited Access Area, and shall be
escorted at all times by an MTC agent authorized to enter the Limited Access
Area. The Visitor Identification Badge shall be visibly displayed at all times
while the Visitor is in any Limited Access Area. All Visitors shall be logged
in and out, and that log shall be available for inspection by the Commission at
all times. All Visitor Identification Badges shall be returned to the MTC upon
exit.
(5)
Security and Alarm Systems.
(a) An MTC shall have an adequate security
system to prevent and detect diversion, theft, or loss of Marijuana or
unauthorized intrusion, utilizing commercial grade equipment, which shall, at a
minimum, include:
1. A perimeter alarm on all
entry and exit points and perimeter windows;
2. A failure notification system that
provides an audible, text, or visual notification of any failure in the
surveillance system. The failure notification system shall provide an alert to
designated employees of the MTC within five minutes after the failure, either
by telephone, email, or text message;
3. A Duress Alarm, Panic Alarm, or Holdup
Alarm connected to local public safety or law enforcement
authorities;
4. Video cameras in
all areas that may contain Marijuana, vaults or safes for the purpose of
securing cash, at all points of entry and exit, and in any parking lot, which
shall be appropriate for the normal lighting conditions of the area under
surveillance. The cameras shall be directed at all safes, vaults, sales areas,
and areas where Marijuana is cultivated, harvested, Processed, prepared,
stored, handled, Transferred or dispensed, or where cash is kept and Processed.
Cameras shall be angled to allow for the capture of clear and certain
identification of any individual entering or exiting the MTC or area;
5. 24-hour recordings from all video cameras
that are available for immediate viewing by the Commission upon request and
that are retained for at least 90 calendar days. Recordings may not be
destroyed or altered, and shall be retained as long as necessary if the MTC is
aware of a pending criminal, civil, or administrative investigation, or legal
proceeding for which the recording may contain relevant information;
6. The ability to immediately produce a
clear, color, still image (live or recorded);
7. A date and time stamp embedded on all
recordings. The date and time shall be synchronized and set correctly and may
not significantly obscure the picture;
8. The ability to remain operational during a
power outage for a minimum of four hours and, if it appears likely that the
outage will last for more than four hours, the MTC takes sufficient steps to
ensure security on the premises in consultation with the Commission;
and
9. A video recording that
allows for the exporting of still images in an industry standard image format,
including.jpg,.bmp, and.gif. Exported video shall have the ability to be
archived in a proprietary format that ensures authentication of the video and
guarantees that no alteration of the recorded image has taken place. Exported
video shall be able to be saved in an industry standard file format that can be
played on a standard computer operating system. All recordings shall be erased
or destroyed prior to disposal.
(b) All security system equipment and
recordings shall be maintained in a secure location to prevent theft, loss,
destruction, and alterations.
(c)
In addition to the requirements listed in 935 CMR 501.110(5), the MTC shall
have a back-up alarm system, with all capabilities of the primary system,
provided by a company supplying commercial grade equipment, which may not be
the same company supplying the primary security system, or shall demonstrate to
the Commission's satisfaction alternate safeguards to ensure continuous
operation of a security system.
(d)
Access to surveillance areas shall be limited to persons that are essential to
surveillance operations, law enforcement authorities acting within their lawful
jurisdiction, fire safety personnel, security system service personnel,
representatives of the Commission as authorized by M.G.L. c. 94I, and
935 CMR
501.000, and Commission Delegee(s).
(e) A current list of authorized employees
and service personnel that have access to the surveillance room shall be
available to the Commission upon request. If on-site, surveillance rooms shall
remain locked and may not be used for any other function.
(f) All security equipment shall be in good
working order and shall be inspected and tested at regular intervals, not to
exceed 30 calendar days from the previous inspection and test.
(g) Trees, bushes and other foliage outside
of the MTC shall be maintained so as to prevent a person or persons from
concealing themselves from sight.
(6)
Security and Alarm
Requirements for MTCs Operating Outdoors.
(a) An MTC that is an operating outdoors
shall implement adequate security measures to ensure that outdoor areas are not
readily accessible to unauthorized individuals and to prevent and detect
diversion, theft or loss of Marijuana which shall, at a minimum, include:
1. A perimeter security fence designed to
prevent unauthorized entry to the cultivation facility with signs notifying
observers that it is a Limited Access Area;
2. Commercial-grade, nonresidential
locks;
3. A security alarm system
that shall:
a. Be continuously monitored,
whether electronically, by a monitoring company or other means determined to be
adequate by the Commission; and
b.
Provide an alert to designated employees of the MTC within five minutes after a
notification of an alarm or a system failure, either by telephone, email or
text message.
4. Video
cameras at all points of entry and exit and in any parking lot which shall be
appropriate for the normal lighting conditions of the area under surveillance.
The cameras shall be directed at all safes, vaults, sales areas, and areas
where Marijuana is cultivated, harvested, Processed, prepared, stored, handled,
Transferred or dispensed and for the purpose of securing cash. Cameras shall be
angled so as to allow for the capture of clear and certain identification of
any person entering or exiting the MTC or area;
5. Recordings from all video cameras which
shall be enabled to record 24 hours each day and be available for immediate
viewing by the Commission on request for at least the preceding 90 calendar
days or the duration of a request to preserve the recordings for a specified
period of time made by the Commission, whichever is longer. Video cameras may
use motion detection sensors to begin recording, so long as the motion
detection sensor system provides an alert to designated employees of the MTC in
a manner established in the MTC's written security procedures and approved by
the Commission or a Commission Delegee. If an MTC receives notice that the
motion detection sensor is not working correctly, it shall take prompt action
to make corrections and document those actions. Recordings may not be destroyed
or altered, and shall be retained as long as necessary if the MTC is aware of a
pending criminal, civil or administrative investigation or legal proceeding for
which the recording may contain relevant information;
6. The ability to immediately produce a
clear, color still image whether live or recorded;
7. A date and time stamp embedded in all
recordings, which shall be synchronized and set correctly at all times and may
not significantly obscure the picture;
8. The ability to remain operational during a
power outage for a minimum of four hours and, if it appears likely that the
outage will last for more than four hours, the MTC takes sufficient steps to
ensure security on the premises in consultation with the Commission;
and
9. A video recording that
allows for the exporting of still images in an industry standard image format,
including.jpg,.bmp and.gif. Exported video shall have the ability to be
archived in a proprietary format that ensures authentication of the video and
guarantees that no alteration of the recorded image has taken place. Exported
video shall also have the ability to be saved in an industry standard file
format that may be played on a standard computer operating system. All
recordings shall be erased or destroyed prior to disposal.
(b) All security system equipment and
recordings shall be maintained in a secure location so as to prevent theft,
loss, destruction and alterations.
(c) In addition to the requirements listed in
935 CMR 501.110(5), the MTC shall have a back-up alarm system, with all
capabilities of the primary system, provided by a company supplying commercial
grade equipment, which may not be the same company supplying the primary
security system, or shall demonstrate to the Commission's satisfaction
alternate safeguards to ensure continuous operation of a security
system.
(d) Access to surveillance
areas shall be limited to persons that are essential to surveillance
operations, law enforcement authorities acting within their lawful
jurisdiction, fire safety personnel, security system service personnel and the
Commission. A current list of authorized employees and service personnel that
have access to the surveillance room shall be available to the Commission on
request. If the surveillance room is on-site of the MTC, it shall remain locked
and may not be used for any other function.
(e) All security equipment shall be in good
working order and shall be inspected and tested at regular intervals, not to
exceed 30 calendar days from the previous inspection and test.
(f) Security plans and procedures shared with
law enforcement authorities pursuant to 935 CMR 501.110(1)(q) shall include:
1. A description of the location and
operation of the security system, including the location of the central control
on the Premises;
2. A schematic of
security zones;
3. The name of the
security alarm company and monitoring company, if any;
4. A floor plan or layout of the facility in
a manner and scope as required by the municipality; and
5. A safety plan for the manufacture and
production of Marijuana Products as required pursuant to
935 CMR
501.101(1)(c).
(7)
Cash
Handling and Transportation Requirements.
(a) An MTC with a contract to deposit funds
with a financial institution that conducts any transaction in cash shall
establish and implement adequate security measures and procedures for safe cash
handling and cash transportation to financial institutions or Massachusetts
Department of Revenue (DOR) facilities to prevent theft and loss, and to
mitigate associated risks to the safety of employees, customers and the general
public. Adequate security measures shall include:
1. An on-site secure locked safe or vault
maintained in an area separate from retail sales areas used exclusively for the
purpose of securing cash;
2. Video
cameras directed to provide images of areas where cash is kept, handled and
packaged for transport to financial institutions or DOR facilities, provided
that the cameras may be motion-sensor activated cameras and provided, further,
that all cameras be able to produce a clear, still image whether live or
recorded;
3. A written process for
securing cash and ensuring transfers of deposits to the MTC's financial
institutions and DOR facilities on an incremental basis consistent with the
requirements for deposit by the financial institution or DOR
facilities;
4. Use of an armored
transport provider that is licensed pursuant to M.G.L. c. 147, § 25
(watch, guard or patrol agency) and has been approved by the financial
institution or DOR facility.
(b) Notwithstanding the requirement of 935
CMR 501.110(7)(a)4., an MTC may request an alternative security provision under
935 CMR 501.110(2) for purposes of cash transportation to financial
institutions and DOR facilities. Any approved alternative security provision
shall be included in the security plan shared with law enforcement in the
municipality in which the MTC is licensed and periodically updated as required
under 935 CMR 501.110(1)(q). To be determined to provide a sufficient
alternative, any such alternative safeguard shall include, but may not be
limited to:
1. Requiring the use of a locked
bag for the transportation of cash from an MTC to a financial institution or
DOR facility;
2. Requiring any
transportation of cash be conducted in an unmarked vehicle;
3. Requiring two registered MTC Agents
employed by the Licensee to be present in the vehicle at all times during
transportation of deposits;
4.
Requiring real-time GPS tracking of the vehicle at all times when transporting
cash;
5. Requiring access to
two-way communications between the transportation vehicle and the
MTC;
6. Prohibiting the
transportation of Marijuana or Marijuana Products at the same time that cash is
being transported for deposit to a financial institution or DOR facility;
and
7. Approval of the alternative
safeguard by the financial institution or DOR facility.
(c) All written safety and security measures
developed under this section shall be treated as security planning documents,
the public disclosure of which would jeopardize public safety.
(8)
Security
Requirements for MTC Home Delivery Operations.
(a) An MTC authorized to perform home
delivery (MTC) or a Marijuana Courier performing deliveries to Patients and
Caregivers on behalf of an MTC, shall implement adequate security measures to
ensure that each vehicle used for transportation of Marijuana and Marijuana
Products are not readily accessible to unauthorized individuals and to prevent
and detect diversion, theft or loss of Marijuana. Security measures shall, at a
minimum, include for each operational delivery vehicle:
1. A vehicle security system that includes an
exterior alarm;
2. A secure, locked
storage compartment that is a part of the vehicle and not easily removable for
the purpose of transporting the Marijuana or Marijuana Products.
3. A secure, locked storage compartment that
is secured to the vehicle and not easily removable for the purpose of
transporting and securing cash used as payment for deliveries of Marijuana or
Marijuana Products.
4. A means of
secure communication between each vehicle and the MTC's or Marijuana Courier's
dispatching location which shall be capable of being monitored at all times
that a vehicle is performing a delivery route. Means of communication shall
include:
a. Two-way digital or analog radio
(UHF or VHF);
5. A global positioning system
(GPS) monitoring device that is:
a. Not a
mobile device and that is attached to the vehicle at all times that the vehicle
contains Marijuana or Marijuana Products; and
b. Monitored by the MTC or Marijuana Courier
at a fixed location during the transportation of Marijuana or Marijuana
Products for the purpose of home delivery with location checks occurring at
least every 30 minutes. The MTC or Marijuana Courier may delegate monitoring of
the GPS to the Third-party Technology Platform Provider with which the MTC or
Marijuana Courier has a contract, provided that the MTC Licensee or Marijuana
Courier shall be responsible for ensuring that monitoring occurs as required
935 CMR 501.110(8) and the contract is made available for inspection and on
request, submitted to the Commission.
6. A video system that includes one or more
video cameras in the storage area of the vehicle and one or more video cameras
in the driver area of the vehicle and which shall remain operational at all
times during the entire transportation process and which shall have:
a. The ability to produce a clear color still
photo whether live or recorded; and
b. A date and time stamp embedded in all
recordings which shall be synchronized and set correctly at all times and may
not significantly obscure the picture.
7. All security equipment on vehicles shall
be in good working order and shall be inspected and tested at regular
intervals, no to exceed 30 calendar days from the previous inspection and
test.
(b) An MTC
transporting Marijuana and Marijuana Products for home delivery shall ensure
that all vehicles used for deliveries are staffed with a minimum of two MTC
Agents. At least one MTC Agent shall remain with the vehicle at all times that
the vehicle contains Marijuana or Marijuana Products.
(c) The Commission may establish required
training programs for MTC and Marijuana Courier Agents that shall be completed
within a reasonable period of time and at the expense of the MTC or Marijuana
Courier. Trainings shall include, but may not be limited to, the requirements
of
935
CMR
501.105(2)(b)7.:
(d) An MTC agent shall document and report
any unusual discrepancy in inventory to the Commission and local law
enforcement within 24 hours of the discovery of such a discrepancy.
(e) An MTC shall report to the Commission and
local law enforcement any vehicle accidents, diversions, losses, or other
reportable incidents that occur during transport immediately and, under no
circumstances, more than 24 hours of becoming aware of any accidents,
diversions, losses, or other reportable incidents and shall otherwise comply
with the incident reporting requirements set forth under 935 CMR
501.110(9).
(f) The following
individuals shall have access to MTC operations and vehicles, including video
recordings:
1. Representatives of the
Commission in the course of responsibilities authorized by
935
CMR 501.000;
2. Representatives of other state agencies of
the Commonwealth of Massachusetts acting within their jurisdiction;
and
3. Law Enforcement Authorities
and emergency medical services in the course of responding to an
emergency.
(g)935
CMR 501.000 may not be construed to prohibit access to
authorized law enforcement personnel or local public health, inspectional
services, or other permit-granting agents acting within their lawful
jurisdiction.
(h) All vehicles used
by the MTC for home delivery are subject to inspection and approval by the
Commission prior being put into use. It shall be the MTCs responsibility to
make the Commission aware of its intent to introduce a new vehicle into
operation and ensure an inspection of the vehicle prior to commencing
operation.
(i) Firearms are
strictly prohibited from MTC vehicles and from MTC agents performing home
deliveries.
(9)
Incident Reporting
(a) An MTC shall immediately notify
appropriate Law Enforcement Authorities and the Commission any breach of
security or other reportable incident defined herein immediately and, in no
instance, more than 24 hours following discovery of the breach or incident.
Notification shall occur, but not be limited to, during the following
occasions:
1. Discovery of inventory
discrepancies;
2. Diversion, theft,
or loss of any Marijuana Product;
3. Any criminal action involving the MTC or
an MTC Agent or occurring on or in the MTC Premises;
4. Any suspicious act involving the sale,
cultivation, distribution, Processing, or production of Marijuana by any
person;
5. Unauthorized destruction
of Marijuana;
6. Any loss or
unauthorized alteration of records related to Marijuana, Registered Qualifying
Patients, Personal Caregivers, or MTC Agents;
7. An alarm activation or other event that
requires response by public safety personnel including, but not limited to,
local law enforcement, municipal fire departments, public works or municipal
sanitation departments, and municipal inspectional services department, or
security personnel privately engaged by the MTC;
8. The failure of any security alarm system
due to a loss of electrical power or mechanical malfunction that is expected to
last longer than eight hours;
9. A
significant motor vehicle crash that occurs while transporting or delivering
Finished Marijuana Products and would require the filing of a Motor Vehicle
Crash Operator Report pursuant to M.G.L. c. 90 § 26; provided however that
a motor vehicle crash that renders the Licensee's vehicle inoperable shall be
reported immediately to state and local law enforcement so that Marijuana or
Marijuana Products may be adequately secured; or
10. Any other breach of security.
(b) An MTC shall, within
ten calendar days, provide notice to the Commission of any incident described
in 935 CMR
501.110(9)(a), by submitting
an incident report in the form and manner determined by the Commission which
details the circumstances of the event, any corrective actions taken, and
confirmation that the appropriate Law Enforcement Authorities were
notified.
(c) All documentation
related to an incident that is reportable pursuant to
935
CMR 501.110(9)(a) shall be
maintained by an MTC for no less than one year or the duration of an open
investigation, whichever is longer, and made available to the Commission and to
Law Enforcement Authorities acting within their lawful jurisdiction upon
request.
(10)
Security Audits. An MTC shall, on an annual basis,
obtain at its own expense a security system audit by a vendor approved by the
Commission. A report of such audit shall be submitted, in a form and manner
determined by the Commission, no later than 30 calendar days after the audit is
conducted. If the audit identifies concerns related to the MTC's security
system, the MTC shall also submit a plan to mitigate those concerns within ten
business days of submitting the audit.