(410 ILCS 705/15-100)

Sec. 15-100. Security.

(a) A dispensing organization shall implement security measures to deter and prevent entry into and theft of cannabis or currency.

(b) A dispensing organization shall submit any changes to the floor plan or security plan to the Department for pre-approval. All cannabis shall be maintained and stored in a restricted access area during construction.

(c) The dispensing organization shall implement security measures to protect the premises, purchasers, and dispensing organization agents including, but not limited to the following:

(1) Establish a locked door or barrier between the facility's entrance and the limited access area;

(2) Prevent individuals from remaining on the premises if they are not engaging in activity permitted by this Act or rules;

(3) Develop a policy that addresses the maximum capacity and purchaser flow in the waiting rooms and limited access areas;

(4) Dispose of cannabis in accordance with this Act and rules;

(5) During hours of operation, store and dispense all cannabis from the restricted access area. During operational hours, cannabis shall be stored in an enclosed locked room or cabinet and accessible only to specifically authorized dispensing organization agents;

(6) When the dispensary is closed, store all cannabis and currency in a reinforced vault room in the restricted access area and in a manner as to prevent diversion, theft, or loss;

(7) Keep the reinforced vault room and any other equipment or cannabis storage areas securely locked and protected from unauthorized entry;

(8) Keep an electronic daily log of dispensing organization agents with access to the reinforced vault room and knowledge of the access code or combination;

(9) Keep all locks and security equipment in good working order;

(10) Maintain an operational security and alarm system at all times;

(11) Prohibit keys, if applicable, from being left in the locks, or stored or placed in a location accessible to persons other than specifically authorized personnel;

(12) Prohibit accessibility of security measures, including combination numbers, passwords, or electronic or biometric security systems to persons other than specifically authorized dispensing organization agents;

(13) Ensure that the dispensary interior and exterior premises are sufficiently lit to facilitate surveillance;

(14) Ensure that trees, bushes, and other foliage outside of the dispensary premises do not allow for a person or persons to conceal themselves from sight;

(15) Develop emergency policies and procedures for securing all product and currency following any instance of diversion, theft, or loss of cannabis, and conduct an assessment to determine whether additional safeguards are necessary; and

(16) Develop sufficient additional safeguards in response to any special security concerns, or as required by the Department.

(d) The Department may request or approve alternative security provisions that it determines are an adequate substitute for a security requirement specified in this Article. Any additional protections may be considered by the Department in evaluating overall security measures.

(e) A dispensing organization may share premises with a craft grower or an infuser organization, or both, provided each licensee stores currency and cannabis or cannabis-infused products in a separate secured vault to which the other licensee does not have access or all licensees sharing a vault share more than 50% of the same ownership.

(f) A dispensing organization shall provide additional security as needed and in a manner appropriate for the community where it operates.

(g) Restricted access areas.

(1) All restricted access areas must be identified by the posting of a sign that is a minimum of 12 inches by 12 inches and that states "Do Not Enter - Restricted Access Area - Authorized Personnel Only" in lettering no smaller than one inch in height.

(2) All restricted access areas shall be clearly described in the floor plan of the premises, in the form and manner determined by the Department, reflecting walls, partitions, counters, and all areas of entry and exit. The floor plan shall show all storage, disposal, and retail sales areas.

(3) All restricted access areas must be secure, with locking devices that prevent access from the limited access areas.

(h) Security and alarm.

(1) A dispensing organization shall have an adequate security plan and security system to prevent and detect diversion, theft, or loss of cannabis, currency, or unauthorized intrusion using commercial grade equipment installed by an Illinois licensed private alarm contractor or private alarm contractor agency that shall, at a minimum, include:

(i) A perimeter alarm on all entry points and glass break protection on perimeter windows;

(ii) Security shatterproof tinted film on exterior windows;

(iii) A failure notification system that provides an audible, text, or visual notification of any failure in the surveillance system, including, but not limited to, panic buttons, alarms, and video monitoring system. The failure notification system shall provide an alert to designated dispensing organization agents within 5 minutes after the failure, either by telephone or text message;

(iv) A duress alarm, panic button, and alarm, or holdup alarm and after-hours intrusion detection alarm that by design and purpose will directly or indirectly notify, by the most efficient means, the Public Safety Answering Point for the law enforcement agency having primary jurisdiction;

(v) Security equipment to deter and prevent unauthorized entrance into the dispensary, including electronic door locks on the limited and restricted access areas that include devices or a series of devices to detect unauthorized intrusion that may include a signal system interconnected with a radio frequency method, cellular, private radio signals or other mechanical or electronic device.

(2) All security system equipment and recordings shall be maintained in good working order, in a secure location so as to prevent theft, loss, destruction, or alterations.

(3) Access to surveillance monitoring recording equipment shall be limited to persons who are essential to surveillance operations, law enforcement authorities acting within their jurisdiction, security system service personnel, and the Department. A current list of authorized dispensing organization agents and service personnel that have access to the surveillance equipment must be available to the Department upon request.

(4) All security equipment shall be inspected and tested at regular intervals, not to exceed one month from the previous inspection, and tested to ensure the systems remain functional.

(5) The security system shall provide protection against theft and diversion that is facilitated or hidden by tampering with computers or electronic records.

(6) The dispensary shall ensure all access doors are not solely controlled by an electronic access panel to ensure that locks are not released during a power outage.

(i) To monitor the dispensary, the dispensing organization shall incorporate continuous electronic video monitoring including the following:

(1) All monitors must be 19 inches or greater;

(2) Unobstructed video surveillance of all enclosed dispensary areas, unless prohibited by law, including all points of entry and exit that shall be appropriate for the normal lighting conditions of the area under surveillance. The cameras shall be directed so all areas are captured, including, but not limited to, safes, vaults, sales areas, and areas where cannabis is stored, handled, dispensed, or destroyed. Cameras shall be angled to allow for facial recognition, the capture of clear and certain identification of any person entering or exiting the dispensary area and in lighting sufficient during all times of night or day;

(3) Unobstructed video surveillance of outside areas, the storefront, and the parking lot, that shall be appropriate for the normal lighting conditions of the area under surveillance. Cameras shall be angled so as to allow for the capture of facial recognition, clear and certain identification of any person entering or exiting the dispensary and the immediate surrounding area, and license plates of vehicles in the parking lot;

(4) 24-hour recordings from all video cameras available for immediate viewing by the Department upon request. Recordings shall not be destroyed or altered and shall be retained for at least 90 days. Recordings shall be retained as long as necessary if the dispensing organization is aware of the loss or theft of cannabis or a pending criminal, civil, or administrative investigation or legal proceeding for which the recording may contain relevant information;

(5) The ability to immediately produce a clear, color still photo from the surveillance video, either live or recorded;

(6) A date and time stamp embedded on all video surveillance recordings. The date and time shall be synchronized and set correctly and shall not significantly obscure the picture;

(7) The ability to remain operational during a power outage and ensure all access doors are not solely controlled by an electronic access panel to ensure that locks are not released during a power outage;

(8) All video surveillance equipment shall allow for the exporting of still images in an industry standard image format, including .jpg, .bmp, and .gif. Exported video shall have the ability to be archived in a proprietary format that ensures authentication of the video and guarantees that no alteration of the recorded image has taken place. Exported video shall also have the ability to be saved in an industry standard file format that can be played on a standard computer operating system. All recordings shall be erased or destroyed before disposal;

(9) The video surveillance system shall be operational during a power outage with a 4-hour minimum battery backup;

(10) A video camera or cameras recording at each point-of-sale location allowing for the identification of the dispensing organization agent distributing the cannabis and any purchaser. The camera or cameras shall capture the sale, the individuals and the computer monitors used for the sale;

(11) A failure notification system that provides an audible and visual notification of any failure in the electronic video monitoring system; and

(12) All electronic video surveillance monitoring must record at least the equivalent of 8 frames per second and be available as recordings to the Department and the Illinois State Police 24 hours a day via a secure web-based portal with reverse functionality.

(j) The requirements contained in this Act are minimum requirements for operating a dispensing organization. The Department may establish additional requirements by rule.

(Source: P.A. 101-27, eff. 6-25-19; 101-593, eff. 12-4-19; 102-538, eff. 8-20-21.)