Health Canada has identified four priority security areas that all applicants and licence holders will be expected to address through Standard Operating Proceedures. The number of SOPs required is at the discretion of the applicant, but all four priority areas below must be addressed.

Priority area 1: Security clearances and adverse information about employees

Risk areas and potential mitigation measures to consider:

• Detecting and responding to new adverse information received that could compromise an employee’s security clearance
• Detecting and responding to adverse information received regarding a non-security-cleared employee that could compromise the organization’s security

Priority area 2: Physical security

Risk areas and potential mitigation measures to consider:

• Staff arrival and entry to the facility (procedure for gate/door to open, etc.)
• Guest, vendor and contractor arrival and entry to the facility (including deliveries/pick-up)
• Response procedures for any arrival and entry breaches
• Staff access to areas where cannabis is present, including vault/storage areas (procedure for passing access controls/intrusion detection)
• Guest, vendor and contractor access to areas where cannabis is present, including vault/storage areas (including deliveries/pick-up)
• Response procedures for any access control or intrusion detection breaches to areas where cannabis is present, including vault/storage areas
• Storage and retrieval of video monitoring footage
• Testing of all physical security features and response procedures (frequency, method, etc.)
• Steps and other security measures that will be taken to ensure the safekeeping of cannabis when being shipped, delivered and or transported
• Destruction method and handling of cannabis waste

Priority area 3: Security awareness and training

Risk areas and potential mitigation measures to consider:

• Internal security training and awareness requirements (for management and for employees)
• How employees can report security concerns, incidents or breaches

Priority area 4: Record keeping, reporting and testing:

Risk areas and potential mitigation measures to consider:

• Contingency plan if record keeping system fails or goes down
• Detection of loss or theft
• Validation that cannabis entering the facility is from a legal source
• Protection of client information
• Response procedure should cannabis be found to enter or leave the facility in an unauthorized manner
• Testing of response procedures (frequency, method, etc.)

The Alberta Gaming, Liquor and Cannabis Commission also have regulations for employees including required training: