Illinois cannabis businesses operate under some of the most detailed physical security requirements in the country. The Illinois Cannabis Regulation and Tax Act (CRTA), which took effect January 1, 2020, established mandatory security standards that dispensaries, cultivation centers, craft growers, transporters, and processors must meet to obtain and maintain their licenses. A weak or incomplete security plan is one of the most common reasons applications are denied — and gaps in ongoing compliance can result in license suspension or revocation.

This guide covers what Illinois cannabis security requirements actually demand, what a compliant security plan needs to include, and how to structure your physical security infrastructure to meet the Illinois Department of Financial and Professional Regulation (IDFPR) standards.

Illinois Cannabis Security Requirements: Who They Apply To

Security requirements apply to all cannabis business license types in Illinois, though the specific standards vary by operation type:

Dispensing organizations (dispensaries) — Retail-facing operations with the most detailed requirements around customer access, point-of-sale security, and cash handling
Cultivation centers — Large-scale growing operations with extensive perimeter and indoor surveillance requirements
Craft growers — Smaller cultivation operations subject to similar but scaled requirements
Processors — Facilities handling cannabis products, requiring controlled access and product security
Transporters — Vehicle and route security requirements including GPS tracking and secure transport protocols
Infusers — Manufacturing operations with product security and access control requirements

The IDFPR reviews security plans as part of the initial license application and may conduct inspections at any point during the license period. Compliance is ongoing — not a one-time checkbox.

Illinois Cannabis Security Plan Requirements

The security plan submitted with your license application is a formal document that must address specific requirements outlined in the CRTA and corresponding administrative rules. It needs to demonstrate not just what systems you’ll install, but how they’ll be operated and maintained.

Video Surveillance

Video surveillance requirements are among the most detailed in the CRTA. Key requirements include:

Coverage areas: All areas where cannabis is stored, processed, or sold must be covered. This includes all points of entry and exit, all areas of the sales floor, all areas where cannabis products are displayed or stored, cash handling areas, and the exterior of the facility including parking lots and loading areas.
Resolution: Cameras must be capable of recording at sufficient resolution to clearly identify individuals. The IDFPR specifies minimum resolution standards — ensure your security camera systems meet or exceed these.
Recording retention: Footage must be retained for a minimum of 90 days. Some operations maintain longer retention as a best practice.
Continuous recording: Systems must record 24 hours a day, 7 days a week. Motion-only recording does not satisfy the requirement.
Redundancy: Recording systems must have backup power to continue functioning during power outages.
Access to footage: Recorded footage must be made available to the IDFPR upon request within a defined timeframe.

Camera placement must be documented in the security plan with a site map showing camera locations, coverage areas, and any identified blind spots with justification for why coverage is not feasible.

Access Control Systems

Illinois cannabis operations are required to implement access control systems that restrict access to cannabis storage and processing areas to authorized personnel only. Requirements include:

Electronic access control on all doors leading to cannabis storage, processing, and handling areas
A documented system for managing who has access to restricted areas, including credential issuance and revocation procedures
Access logs that record every entry and exit from restricted areas with employee identification and timestamps
Immediate revocation capability — the ability to remove an employee’s access instantly upon termination or suspension
Visitor management procedures for vendors, inspectors, and contractors who require temporary access to restricted areas

The access control system must be described in detail in the security plan, including the technology being used, how credentials are managed, and how access logs are maintained and made available for inspection.

Alarm Systems

Cannabis facilities must have monitored intrusion detection and alarm systems covering all points of entry, including doors, windows, and roof access points. Requirements include:

24/7 professional monitoring with response protocols
Panic or duress alarms for employees in the event of a robbery or emergency
Alarm systems that are independent of — or have backup from — the main power supply
Documentation of alarm response procedures in the security plan

Physical Security and Facility Design

Beyond electronic systems, the CRTA imposes physical security standards on the facility itself:

Exterior lighting sufficient to support camera surveillance at all hours
Secured perimeter fencing for cultivation and processing operations
Reinforced doors and windows on cannabis storage areas
A limited-access reception or lobby area separating public access from cannabis areas in dispensaries
Secured, separate storage for cannabis products, with inventory control procedures documented

Cash Handling Security

Because cannabis remains federally illegal, most cannabis businesses operate primarily in cash. The CRTA requires specific security measures around cash handling:

Documented cash handling procedures including counting, storage, and transport protocols
Secured cash storage (safes) that meet IDFPR specifications
Video surveillance coverage of all cash handling areas at all times
Procedures for cash transport, including security protocols for moving cash off-site

Employee Security Training

The security plan must include documented procedures for employee security training covering:

Recognition of suspicious activity and diversion attempts
Emergency response procedures including robbery, intrusion, and fire
Proper use of the access control and surveillance systems
Reporting procedures for security incidents

Training must be documented, with records of when employees completed training and what was covered.

Building Your Illinois Cannabis Security Plan

The security plan is a formal submission, not an informal description. It needs to be specific, detailed, and tied to your actual facility layout. A generic plan that doesn’t reference your specific building will not satisfy IDFPR reviewers.

A complete security plan typically includes:

Facility floor plan and site map showing camera locations, access control points, alarm zones, and restricted areas
Camera specification and coverage diagram documenting each camera’s model, resolution, placement, and field of view
Access control system description including technology, credential management procedures, and log retention policies
Alarm system description including monitoring provider, response protocols, and backup power
Cash handling procedures tied to specific locations in the facility
Employee training program including curriculum, schedule, and documentation procedures
Incident response procedures for robbery, intrusion, medical emergency, and other scenarios
Vendor and visitor management procedures for temporary access to restricted areas

Common Illinois Cannabis Security Plan Mistakes

Based on common application failures, these are the issues that most frequently result in security plan deficiencies:

Camera coverage gaps: Missing coverage of cash handling areas, exterior loading areas, or specific storage rooms that reviewers flag during plan review
Insufficient resolution specifications: Specifying cameras without confirming they meet IDFPR resolution requirements
Vague access control descriptions: Describing “an access control system” without specifying the technology, credential types, or log retention procedures
No backup power documentation: Failing to address how surveillance and alarm systems maintain operation during a power outage
Missing cash handling procedures: Security plans that address cannabis security but don’t adequately cover cash handling get flagged consistently
Generic training descriptions: Submitting a training outline without documenting how training will be tracked and records maintained

Working with a Security Integrator on Your Cannabis Application

Most successful Illinois cannabis license applications include a security plan developed in partnership with a licensed security integrator who understands IDFPR requirements. An integrator provides:

A site assessment that identifies coverage requirements and documents them to IDFPR standards
System specifications that confirm compliance with resolution, retention, and coverage requirements
A facility map and camera placement diagram ready for submission
Accurate equipment and installation quotes for the budget section of your application
Post-approval installation and ongoing maintenance to ensure continued compliance

Umbrella Security Systems works with Illinois cannabis businesses on both the security plan development and physical installation. If you’re preparing a cannabis license application or need to bring an existing operation into compliance, contact us to discuss your project.

Frequently Asked Questions

What security systems are required for an Illinois cannabis dispensary?

Illinois dispensaries must have 24/7 continuous video surveillance covering all cannabis areas, entry/exit points, and cash handling areas with minimum 90-day retention; electronic access control on all restricted areas with documented credential management and access logs; a monitored intrusion alarm system with panic capabilities; exterior lighting; and documented cash handling and employee training procedures. All requirements must be detailed in a security plan submitted with the license application.

How detailed does the security plan need to be for an Illinois cannabis application?

Very detailed. The IDFPR reviews security plans specifically for completeness and specificity. A plan that describes general security measures without tying them to your specific facility layout, camera specifications, access control technology, and documented procedures will be flagged as deficient. The plan needs to include facility maps, camera placement diagrams, system specifications, and procedure documentation — not just a description of your intentions.

Can a weak security plan cause a cannabis license application to be denied?

Yes. Security plan deficiencies are one of the most common reasons Illinois cannabis applications are rejected or returned for revision. The IDFPR takes physical security requirements seriously because cannabis businesses handle regulated products and significant cash. A plan that doesn’t demonstrate comprehensive, compliant security coverage will not clear review.

How long must Illinois cannabis businesses retain surveillance footage?

The CRTA requires a minimum of 90 days of video footage retention. The recording system must operate continuously — 24/7 — not just on motion detection. Footage must be available to the IDFPR upon request, so the storage and retrieval system needs to be accessible and reliable.

Do Illinois cannabis security requirements apply to transporters?

Yes, though the requirements are specific to transport operations. Transporters must have GPS tracking on all transport vehicles, secure transport containers, documented chain-of-custody procedures, driver training on security protocols, and communication systems that allow real-time contact with dispatch. Transport routes and manifests must be documented and made available to the IDFPR.

Illinois Cannabis Security Requirements: Building a Compliant Security Plan