Setting Up Security for a New Cannabis Dispensary

You're deep into the build-out. The lease is signed, the architect is drawing up the floor plan, and your licensing consultant is walking you through DCC paperwork. Somewhere in that stack is the DCC-LIC-018, the Security Procedures form that makes your new dispensary security setup the first thing the state evaluates before approving your license.

The form asks you to describe every element of your security system in detail. Camera placements and count. Alarm company name and license number. Guard plans. Every lock on every door. Badge procedures. Video maintenance protocols. How footage gets produced on a DCC request.

You can't leave it blank. You can't be vague. And consulting companies charge $497 just for a template to help you fill it out.

This is what the form actually asks, what your system needs to include, and how to avoid the mistakes that force operators to reinstall six months after opening.

The DCC-LIC-018: What It Asks and Why It Matters

The DCC-LIC-018 is the Security Procedures form required for all California cannabis license applications. It has seven questions covering security responsibility, physical access points, employee access and visitor rules, badge compliance, video surveillance across seven sub-parts, guard details, and alarm system info. Every license type requires it: dispensary, cultivation, manufacturing, distribution, and microbusiness. What you write on this form becomes what inspectors check against once you're open.

Question 1 covers security responsibility. Who's responsible for implementing the Security Operating Procedures? DCC wants names, titles, and specific responsibilities assigned to specific people. "The manager handles security" won't do it.

Question 2 addresses physical access points. You'll describe how you secure every entrance, exit, window, and doorway, including the types of locks used. Most applicants rush through this section because it feels basic. It's the foundation DCC evaluates first.

Question 3 deals with employee access and visitor rules across three sub-parts. You'll list employees who have access and their roles (3a), explain how only authorized persons enter the premises and limited-access areas (3b), and describe how you track visitors per section 5042 of DCC regulations (3c).

Question 4 asks about employee badge compliance per section 5043. That means how you assign employee numbers and your procedures when an employee changes roles or leaves the company.

Video, Personnel, and Alarm Requirements

Question 5 is the longest section with seven sub-parts. It covers camera types and storage gear (5a), camera placements and count (5b), and maintenance steps (5c). It also asks how you'll know about system failures (5d), how the system is monitored (5e), how you'll hand over footage on request (5f), and sharing with co-tenants (5g).

Question 6 covers guards in five sub-parts. You'll say whether they're employees or contracted and include the company name, license numbers, and contact info (6a). You'll describe where they're posted (6b), their hours (6c), co-tenant sharing (6d), and whether they're armed or unarmed (6e).

Question 7 covers the alarm in five sub-parts. It asks for the company name, license number, address, phone, and contact person (7a). Then it covers service frequency (7b), features like motion detectors (7c), response steps including police notification (7d), and co-tenant sharing (7e).

Each answer needs specific, verifiable detail. Not "we will install cameras." Think more like: fourteen 4MP IP cameras recording at 20 FPS to a 32TB NVR with 120 days of storage. That kind of detail separates applications that move forward from ones that stall.

What Your New Dispensary Security Setup Has to Include

Every technical requirement below maps directly to a question on the DCC-LIC-018 and to what inspectors will check once you're open.

Physical Access and Locks

Before cameras and alarms, DCC wants to know how you're physically securing the building. Every entrance, exit, window, and doorway needs to be described, including lock types. Commercial-grade deadbolts on all exterior doors, reinforced door frames, window bars or security film on ground-level glass, and electronic strikes on limited-access interior doors.

This is the section applicants rush through because it feels basic. It's the foundation DCC evaluates first. A $50,000 camera system behind a hollow-core door with a residential deadbolt doesn't make sense, and inspectors notice.

Camera System

Your camera system should match the DCC spec from day one. That means continuous 24/7 recording, not motion-triggered, at a minimum 1280x720 resolution and 15 FPS. Every frame needs an NIST-synced timestamp. You need a dedicated camera in the NVR room itself. POS cameras must capture faces clearly enough to identify people. And remote access via TCP/Internet is required so footage can be pulled up the moment DCC asks for it.

A cultivation facility we monitor in Sylmar had a masked intruder enter the property at 4:51 AM on a weeknight in March. Camera 1 picked him up immediately. The Intervention Specialist issued audio warnings, and the intruder left without police. Motion-triggered recording would have missed the approach entirely. Continuous recording caught it on the first frame.

Cultivation sites and remote grows carry additional DCC monitoring requirements beyond what applies to a storefront. If your build-out includes an outdoor grow or a licensed cultivation facility, see remote cannabis grow security for the coverage breakdown specific to those operations.

DCC doesn't set a minimum camera count. The number depends on your floor plan. Coverage must include every entry point, POS station, product storage area, vault room, receiving area, NVR room, and parking lot. A typical 1,200-square-foot storefront needs 10 to 14 cameras. Larger multi-room spaces may need 20 or more.

The form also asks about maintenance (5c) and how you'll know if the system fails (5d). Your answer needs to include scheduled service intervals and an automated alert system. "We'll check it now and then" won't satisfy an inspector.

For NVR storage, 90 days is the minimum. Best practice is 120 to 180 days. Calculate storage needs based on camera count, resolution, and frame rate before you buy hardware. Running out of storage at day 60 and losing older footage is a compliance failure that shows up during inspections.

Security Personnel

The DCC-LIC-018 asks whether your guards are employees or contracted, where they'll be posted, their hours, and whether they're armed or unarmed. If you use a contract guard company, you need their name, license numbers, contact person, phone number, and a copy of the contract on the form.

This section is also where you lay out your monitoring plan. Whatever you commit to on the form is what you're expected to keep up. Most new dispensary operators in LA go with a hybrid model: a guard during business hours and live remote video monitoring from close to open. That approach satisfies DCC and keeps ongoing costs manageable.

It's also what the incident data supports. A Sherman Oaks dispensary in our monitoring network had an intruder checking windows and doors at 1:32 AM on a Tuesday in February. No guard on site. The Intervention Specialist issued audio warnings, and the intruder didn't comply, so LAPD was dispatched. The guard who works the day shift would have never known it happened. That's the coverage gap a hybrid model closes.

The DCC-LIC-018 asks you to describe your monitoring plan. That answer sets your security budget for the life of the license. See the dispensary security guard vs. remote monitoring cost breakdown before you commit to a structure you'll be locked into.

Alarm System

Your alarm must be set up and monitored by a BSIS-licensed alarm company. The company's name, license number, address, phone, and contact person go right on the DCC-LIC-018, and DCC can verify every detail. If the license number is wrong or expired, your application stalls before anyone even reads it.

Beyond the basics, the form asks for maintenance frequency (7b), system features like motion detectors (7c), and how alarms get responded to, including whether police are called (7d). "The alarm company calls us" isn't enough. You need the full chain written out: who gets called first, expected response times, and when dispatch happens.

Access Control and Badges

Two form questions cover this area. Question 3 asks for a list of employees with access, their roles, how you limit entry to restricted areas, and how you track visitors. Question 4 zeroes in on badge compliance. It asks how you assign employee numbers, the badge specs (1" x 1.5" minimum photo, plastic-coated or laminated, worn visibly), and what happens when someone leaves.

The offboarding question is the one people miss. DCC wants a written plan for what happens to badge access when someone quits or gets fired. Same-day deactivation with a logged record is the expected answer. Leaving a former employee's badge active for even a week creates both a compliance gap and a real security risk. A Chatsworth cannabis operator in our network had a trespasser show up with multiple accomplices at 2 AM. The Intervention Specialist caught it on camera, issued warnings, and they left. They came back four more times that month. Access control logs told the story of how they knew the layout.

Budget, Timeline, and What to Expect

What It Costs

Think of your security system as a build-out line item alongside construction, inventory, and licensing fees. Budget for camera hardware and installation, NVR storage, access control readers and badges, alarm panel, cabling, and a monthly monitoring contract. Don't price shop on the install and then pay double to fix it when the inspector flags gaps.

Your security setup also affects your ability to get insurance. DCC requires $1 million per occurrence and $2 million aggregate general liability, product liability coverage, and a $5,000 surety bond to apply. AB 2568 opened the carrier market, so more insurers serve cannabis now, but they want to see monitored security before they'll write your policy. Getting remote video monitoring installed before you open means you're insurable from day one. Waiting until after an incident drives your premiums up.

Installation Timeline

Most new dispensary security setups take two to three weeks from site assessment to a working system. That assumes parts are in stock and the build-out schedule allows access for cable runs and mounting. A typical sequence:

• Site evaluation and floor plan review: 1 to 2 days
• System design and DCC-LIC-018 prep: 3 to 5 days
• Gear ordering (if parts aren't on the shelf): 1 to 2 weeks
• On-site install and cabling: 2 to 3 days
• Config and NIST sync: same day as install
• Testing and final documentation: 1 day

Start the security conversation early in the build-out. Cable runs cost far less when walls are still open, and your integrator needs access before the general contractor closes everything up.

Getting Your New Dispensary Security Setup Right the First Time

Every compliance problem, from cameras below spec to missing NVR room coverage to expired badges, starts with an installer who didn't know DCC rules during the build-out. Fixing it later always costs more. Running new cable through finished walls is pricier than doing it during construction. Swapping cameras mounted at the wrong angle means new hardware, new labor, and patching the ceiling. Replacing a consumer alarm panel with a BSIS-monitored commercial system means rewriting the alarm section of your DCC paperwork from scratch.

The integrator you choose for your new dispensary security setup should be able to fill out the DCC-LIC-018 with you, not just hang cameras. They need to know the camera specs, NIST sync rules, NVR room camera requirements, POS facial clarity standards, 90-day minimum footage retention, and BSIS alarm mandates. If your installer can't answer questions about Title 4, they're the wrong fit for a cannabis build-out.

Getting the system installed is step one. Keeping it compliant is ongoing. See the DCC security inspection checklist for exactly what inspectors check and where most operators get flagged on the first walk-through.

Getting your dispensary security right during build-out costs a fraction of fixing it after an inspection.

Frequently Asked Questions

Does DCC require a specific number of cameras?

No, there's no minimum camera count in the regulations. DCC requires coverage of specific zones: every entry and exit point, all POS stations, product storage areas, the vault room, the receiving area, the NVR room, and the parking lot. A 1,200-square-foot storefront typically needs 10 to 14 cameras. The form asks you to specify the count and placements, so your integrator needs to design the layout before you fill it out.

Can I use Ring or consumer-grade cameras to meet DCC requirements?

No. DCC requires cameras that record continuously at 1280x720 or better, with NIST-synced timestamps and TCP/Internet access for remote footage retrieval. Consumer cameras typically use motion-triggered recording, cloud storage that can't be accessed on DCC request, and don't support NIST sync. They'll fail inspection, and you'll be replacing them before you can open.

What happens if I change my security setup after I get licensed?

You'd need to update your Security Operating Procedures and notify DCC. Significant changes, like switching alarm companies or adding a monitoring plan, may require an amended DCC-LIC-018. This is why build-out decisions matter: what you put on the original form is what you're held to. Changes create paperwork and potential inspection scrutiny.

How long does footage need to be retained?

DCC requires a minimum of 90 days. Best practice is 120 to 180 days. If DCC requests footage from an incident that happened 95 days ago and your NVR only holds 90 days, you have a compliance problem regardless of whether your system was otherwise working correctly.

Does DCC require a guard, or can remote monitoring replace one?

For storefront dispensaries, DCC requires a licensed security guard during business hours. Remote video monitoring doesn't replace that requirement. What it does is cover the hours after close, when guards typically aren't on site, and when most LA dispensary break-ins have happened. A Venice dispensary in our network had a trespasser show up at 4:29 AM on a Thursday. Audio intervention deterred them without police. No guard would have been on site at that hour under a standard contract. Most operators in LA run a hybrid: guard during hours, live remote monitoring overnight.

What's the difference between a DCC-compliant alarm and a standard commercial alarm?

The monitoring company must be BSIS-licensed and you must be able to produce their license number on the DCC-LIC-018. Beyond that, DCC wants documentation of service frequency, the alarm's specific features, and a written response protocol that includes when police are called. A standard commercial alarm installed by an unlicensed provider, or one where you can't produce a BSIS license number, will fail the form review.

Related Articles

• →Cannabis Security Guide for California Operators
• →Cannabis Remote Video Monitoring for Dispensaries
• →Remote Cannabis Grow Security
• →Dispensary Robbery Prevention in LA
• →Security Guards vs. Remote Monitoring for Dispensaries
• →How to Pass a DCC Security Inspection
• →ValleyGuard Catches on Camera