Cannabis facilities in Ontario operate under a security framework that is unlike any other commercial industry. Health Canada's Cannabis Regulations prescribe specific security requirements as a condition of licensing — and non-compliance isn't a fine or a warning. It is grounds for licence suspension or revocation. For a licensed producer investing millions in infrastructure, staff, and inventory, a compliance failure in the security domain can end the business.
Understanding the regulatory floor — and where most facilities fall short of it — is essential for anyone operating or managing a licensed cannabis facility in Ontario.
What Health Canada Actually Requires
The Cannabis Regulations (SOR/2018-144) set out security requirements under Part 5 that apply to all classes of licence. The specific requirements vary by licence class and activity type, but the core framework includes:
Physical barriers. A secured room or area for all cannabis storage and production — with physical security measures (locks, access control) to prevent unauthorized access. The barrier requirements escalate based on the class of cannabis activity and the quantity of cannabis on-site.
Intrusion detection. The facility must have a system capable of detecting unauthorized entry and transmitting an alert. For most production licences, this means a monitored intrusion alarm system — not just a recording camera. The intrusion detection must cover all points of unauthorized access to areas where cannabis is stored or produced.
Video surveillance. Cameras must cover all points of entry to and exit from areas where cannabis is held. Footage must be retained for a minimum period — Health Canada specifies 30 days as the retention baseline for standard licences. Cameras must operate 24 hours a day, 7 days a week, and must record continuously.
Access control. Only persons with legitimate reason to access the area where cannabis is held may do so. This requires a documented access control system — not just a key — that limits access based on role and logs every entry.
Perimeter security. Depending on the licence class and scale of operations, perimeter security measures including fencing, lighting, and camera coverage of the facility exterior may be required.
Where Ontario Cannabis Facilities Fall Short
Camera systems that don't meet the regulatory standard. Health Canada requires continuous recording with 30-day retention. Many facilities installed camera systems without verifying whether the NVR or cloud storage meets the 30-day retention requirement across all cameras. Systems that overwrite after 14 days, or that have cameras failing without alerting an administrator, are non-compliant.
Intrusion detection that isn't properly monitored. A motion sensor connected to a self-monitored app is not the same as a professionally monitored alarm system. Health Canada's requirement for intrusion detection that "transmits an alert" is interpreted by compliance reviewers as requiring a monitored central station — not an owner receiving a push notification on their phone. Facilities that self-monitor their intrusion detection may face compliance questions during inspections.
Inadequate camera coverage of all access points. The regulatory requirement covers all points of entry to and exit from areas where cannabis is held. This includes emergency exits, loading dock access, and mechanical room access if those areas connect to a cannabis zone. Camera audits at Ontario facilities frequently reveal that emergency exits — covered by regulatory language but not by camera — are missed.
Access control that doesn't log entries. A key or combination lock provides physical restriction but no access log. The Cannabis Regulations require that you be able to identify who accessed a cannabis area and when. A physical log signed by employees meets a bare minimum but is not as defensible as an electronic access control system with automatic timestamped logging.
No formal security plan documentation. Health Canada licence applications and renewals require a written security plan. Many operators treat this as a one-time document submitted during initial licensing, not an operational document that reflects current security configuration. When the physical setup changes — new production areas, expanded storage, modified access routes — the security plan should be updated to match.
What a Properly Secured Ontario Cannabis Facility Looks Like
A compliant Ontario cannabis facility has a security architecture that was designed with the Cannabis Regulations as a baseline, not as an afterthought.
Camera coverage is continuous, covers all cannabis access points (including emergency exits), retains 30 days of footage, and has a monitoring alert for recording failures. The camera system is professionally installed by an integrator who understands the regulatory requirements and can provide documentation for compliance review.
Intrusion detection is connected to a licensed monitoring central station. A break-in or unauthorized entry generates an immediate alert to the monitoring station, which follows a dispatch protocol including law enforcement notification.
Access control is electronic, with timestamped logging of every entry and exit to cannabis zones. The access log is available for review on demand — by Health Canada inspectors, by the licence holder, and by law enforcement if needed. Access credentials are managed in a system that allows immediate deactivation.
The security plan is a current document that matches the physical security configuration. When the configuration changes, the plan is updated. When the plan is audited by Health Canada, it reflects what is actually installed and operational.
For a detailed breakdown of security systems designed for Ontario cannabis facilities, see our cannabis facility security page.
