Bulletin | Armed Robberies / Break-In and Thefts Attempts / Social Engineering Schemes / Reminder for Incident Reporting Requirements | August 8, 2022

To: Marijuana Establishments and Medical Marijuana Treatment Centers licensed pursuant to 935 CMR 500.000 and 501.000
From: Shawn Collins, Executive Director
Date: August 8, 2022
Subject: Armed Robberies/Break-In Attempts/Thefts/Social Engineering Schemes and Frauds/Reminder for Incident Reporting

This Notice applies to licensed Marijuana Establishments and Medical Marijuana Treatment Centers (collectively the “Licensees”). The Cannabis Control Commission (“Commission”) has received reports regarding armed robberies, attempted break-ins, thefts and social engineering schemes and frauds committed at various Licensees’ Marijuana Establishments and Medical Marijuana Treatment Centers. The Commission has also received reports regarding the Occupational Safety and Health Administration (“OSHA”) conducting inspections and interviews at  various Licensees’ Marijuana Establishments and Medical Marijuana Treatment Centers. The Commission is aware of these incidents and this Notice serves to remind Licensees of their regulatory obligations as well as to alert Licensees of the continued need to remain cautious and vigilant. The health and safety of Licensees and their agents, patients, caregivers, consumers and the general public is of the utmost important to the Commission. Adherence to the regulations and measures outlined in this Bulletin will not only help ensure compliant operations across the Commonwealth, but will also help to ensure that the industry is able to operate and function in a safe manner.

Pursuant to 935 CMR 500.110(1) and 935 CMR 501.110(1), Licensees are responsible for implementing sufficient security measures to deter theft of Marijuana and Marijuana Products, prevent unauthorized entrance into areas containing Marijuana and Marijuana Products and ensure the safety of Marijuana Establishment and Medical Marijuana Treatment Center employees, Registered Qualifying Patients, Consumers and the general public. Such measures shall include, but not be limited to the following:

1. Positively identifying individuals, Registered Qualifying Patients, Personal Caregivers, MTC agents, Marijuana Establishment agents, Marijuana Courier agents seeking access to the Premises of the Marijuana Establishment/MTC or to whom or Marijuana Products are being transported pursuant to 935 CMR 500.105(13) or delivered pursuant to 935 CMR 500.145 to limit access solely to individuals 21 years of age or older;
2. Adopting procedures to prevent loitering and ensure that only individuals engaging in activity expressly or by necessary implication permitted by 935 CMR 500.000 and its enabling statute and 935 CMR 501.000 are allowed to remain on the Premises;
3. Disposing of Marijuana in accordance with 935 CMR 500.105(12) and 935 CMR 501.105(12) in excess of the quantity required for normal, efficient operation as established within 935 CMR 500.105 and 935 CMR 501.105;
4. Securing all entrances to the Marijuana Establishment/MTC to prevent unauthorized access;
5. Establishing Limited Access Areas pursuant to 935 CMR 500.110(4) and 935 CMR 501.110(4), which, after receipt of a final License, shall be accessible only to specifically authorized personnel, limited to include only the minimum number of employees essential for efficient operation;
6. Storing all Finished Marijuana Products in a secure, locked safe or vault in such a manner as to prevent diversion, theft and loss;
7. Keeping all safes, vaults, and any other equipment or areas used for the production, cultivation, harvesting, Processing or storage, including prior to disposal, of Marijuana or Marijuana Products, securely locked and protected from entry, except for the actual time required to remove or replace Marijuana;
8. Keeping all locks and security equipment in good working order;
9. Prohibiting keys, if any, from being left in the locks or stored or placed in a location accessible to persons other than specifically authorized personnel;
10. Prohibiting accessibility of security measures, such as combination numbers, passwords or electronic or biometric security systems, to persons other than specifically authorized personnel;
11. Ensuring that the outside perimeter of the Marijuana Establishment/MTC is sufficiently lit to facilitate surveillance, where applicable;
12. Ensuring that all Marijuana Products are kept out of plain sight and are not visible from a public place, outside of the Marijuana Establishment/MTC, without the use of binoculars, optical aids or aircraft;
13. Developing emergency policies and procedures for securing all product following any instance of diversion, theft or loss of Marijuana, and conduct an assessment to determine whether additional safeguards are necessary;
14. Developing sufficient additional safeguards as required by the Commission for Marijuana Establishments/MTCs that present special security concerns;
15. At Marijuana Establishments/MTCs where transactions are conducted in cash, establishing procedures for safe cash handling and cash transportation to financial institutions to prevent theft, loss and associated risks to the safety of employees, customers and the general public;
16. Sharing the Marijuana Establishment’s/MTC’s floor plan or layout of the facility with Law Enforcement Authorities, and in a manner and scope as required by the municipality and identifying when the use of flammable or combustible solvents, chemicals or other materials are in use at the Marijuana Establishment/MTC; and
17. Sharing the Marijuana Establishment’s/MTC’s security plan and procedures with Law Enforcement Authorities (in the municipality where the Marijuana Establishment and MTC area located) ,police and fire departments, if the plans or procedures are modified in a material way, including the addition of plans to deliver directly to Consumers in the case of a Marijuana Retailer or Marijuana Establishment with a Delivery Endorsement.

Consistent with that objective, Licensees might also consider taking additional measures and precautions such as:

• Ensuring that all Marijuana Establishment, MTC and Transportation Vehicle security equipment, sensors, cameras and alarms remain operational and in good working order. Marijuana Establishments and MTCs should be conducting monthly checks of all security equipment, sensors, cameras and alarms and these audits should be recorded and logged;
• Ensuring that any and all Marijuana, Marijuana Products and money is transported from the Marijuana Establishment and/or Marijuana Treatment Centers by a licensed transporter;
• Conducting additional training for staff regarding emergency standard operating procedures, including steps that need to be followed in case of an emergency;
• Ensuring that daily cash counting inventory checks are conducted and logged;
• Verifying that all email domain names, phone calls and text messages are coming from a reliable source before taking action;
• Special attention should be paid to any misspellings, grammatical errors and the time and date that the phone call, text message or email was received.
• Ensuring through written operating procedures and through trainings that Licensee agents are not sharing password, pins or other credentials utilized to access email accounts and point-of-sale system.

Pursuant to 935 CMR 500.110(9)(a)(3) and 935 CMR 501.110(9)(a)(3), any criminal action involving or occurring in a Marijuana Establishment or Medical Marijuana Treatment Center shall be reported to the local police department and the Commission immediately, but in no instance, more than twenty-four (24) hours following the discovery of the incident. Pursuant to 935 CMR 500.110(9)(a)(7) and 935 CMR 501.110(9)(a)(7), an alarm activation or other event that requires response by public safety personnel, including but not limited to local law enforcement, police and fire departments, public works of municipal sanitation departments, and municipal inspectional services departments, or security personally privately engaged by the Marijuana Establishment or the Medical Marijuana Treatment Center shall be reported to the local police department and the Commission immediately, but in no instance, more than twenty-four (24) hours following the discovery of the incident. The Commission considers any event which requires a response by a local, state, or federal public safety or public health agency to fall within the intent of 935 CMR 500.110(9)(a)(7) and 935 CMR 501.110(9)(a)(7).

The health and safety of patients, caregivers, consumers, Licensees, Licensee agents and the general public is of paramount concern and importance to the Commission. Adherence to the regulations and measures outlined in this Bulletin will help to ensure that Licensees not only maintain compliance with Commission regulations, but will also assist to ensure that Licensees and Licensee agents are able to operate in safe, confident manner. The regulations and measures contained in this Bulletin will also help to ensure that Licensees and Licensee agents will be able to service patients, caregivers and consumers in a manner that keeps all parties involved safe. The Commission urges all Licensees to review: Regulations 935 CMR 500.110(1)(10) and 935 CMR 501.110(1)(10); security measures and operating procedures for all Marijuana Establishment and Medical Marijuana Treatment Centers, particularly retail locations. Licensees are encouraged to submit questions about this Notice to their assigned Investigator or Compliance Officer, or to Inspections@CCCMass.com.