Blog

Cannabis dispensaries operate under a hardware spec that does not look like a typical retail store. Most states require a vault or limited-access area with reinforced doors, perimeter doors with motion-detected alarms and reinforced strikes, a dedicated ID verification area where customers cross from the public space into the sales floor, and video coverage tied to every access event. The hardware that meets the requirements is mostly commercial-grade with a few cannabis-specific add-ons: high-security cylinders, reinforced strikes, anti-tamper hinges, and audit-trail electronic locks. Insurance carriers often require more than state minimums.

Why dispensary hardware spec differs from a typical retail store

A typical retail store has one set of locks at close-of-business and an alarm system. A dispensary has:

• A vault or limited-access storage area open only to specific authorized employees, with audit trail
• An ID and age verification door that separates the entry lobby from the sales floor
• Perimeter doors with both physical and electronic security
• Video coverage tied to every transaction and access event, retained 30-90 days depending on state
• Cash handling areas with their own access control
• After-hours product transport that may require armored escort

The hardware spec is shaped by state regulation, local AHJ overlay, and insurance underwriter requirements. The intersection is what gets built.

State-by-state baseline (the 5 largest markets)

State regulations change frequently. The summaries below are for orientation, not legal advice. Verify with state regulator and counsel before final spec.

California (BCC, Bureau of Cannabis Control)

• Limited-access areas required for product storage.
• Commercial-grade locks on every perimeter door.
• 24/7 video surveillance with 90-day retention.
• Alarm system with 24/7 monitoring.
• ID verification at the entry, customer area separated from limited access.

Colorado (MED, Marijuana Enforcement Division)

• Vault or secure storage room required for inventory above a threshold.
• Commercial locks, deadbolts, or electronic locks on perimeter.
• Video retention 40 days minimum, more on certain transactions.
• Visitor and employee badge system.

Massachusetts (CCC, Cannabis Control Commission)

• Limited-access areas with electronic access control preferred.
• Perimeter alarms, motion detection, glass-break detection.
• Video retention 90 days.
• Biometric access encouraged on vault openings.

New York (OCM, Office of Cannabis Management)

• Strict perimeter and vault hardware requirements.
• Audit trail on access to inventory storage required.
• Video retention 60-90 days depending on license type.
• Specific door specifications in some license categories.

Florida (OMMU, Office of Medical Marijuana Use)

• Secure storage required, commercial locks on perimeter.
• Video coverage of every transaction, 45-day retention minimum.
• Alarm with 24/7 monitoring.

The trend across all five: from generic "commercial locks" toward audit-trail electronic access control with video correlation.

Vault and limited-access area: door hardware

The vault or limited-access storage door carries the heaviest hardware spec in the building.

Door:

• Solid core or hollow metal, minimum 1-3/4" thickness.
• Fire-rated where the building code requires (most cases on interior doors).
• Some states require a dedicated vault door (B-rated or higher per UL 687/Mercantile Safe rating); most allow a heavy commercial door.

Hardware on the vault door:

• Mortise lock with deadbolt function (Sargent 8200 series, Schlage L9000 series, Corbin Russwin ML2000). Read Schlage L9000 vs Sargent 8200 vs Corbin ML2000 for the comparison.
• High-security cylinder (Medeco, Mul-T-Lock, ASSA, or Schlage Primus). See Medeco vs Mul-T-Lock vs ASSA.
• Electronic access control with audit trail (card, PIN, or biometric).
• Door position sensor (DPS) wired to the alarm panel.
• Reinforced strike plate, anchored to the wall framing.
• Anti-tamper or security hinges (or continuous hinge for full-length protection). Read continuous geared hinges sizing specs common mistakes.

The vault door is also the door state inspectors and insurance underwriters scrutinize most.

Perimeter doors: hardware and reinforcement

Every perimeter door (front, back, side, loading dock) carries:

• Commercial-grade lockset (Grade 1 BHMA A156.13 mortise or A156.2 cylindrical).
• Reinforced strike plate (4-inch minimum, anchored to wood frame with 3-inch screws or to metal frame welded).
• Door position sensor on each leaf.
• Motion sensor inside, covering the door.
• Glass-break sensor on any glazed door.
• Camera with view of the door, inside and outside.

For exit egress on the rear door, an exit device with alarm output is common: how to choose an exit door alarm. The Detex EAX series and similar devices alarm on unauthorized exit while allowing free egress in an emergency.

ID and age verification door

The ID verification door separates the lobby (where anyone can walk in) from the sales floor (where only verified customers are admitted).

Hardware:

• Electronic lock or electric strike, controlled by the front desk.
• Buzz-in operation: front desk verifies ID and electronically releases.
• Audit log of each release event, correlated with the customer ID scan.
• Often paired with a remote release button at the front desk and a fail-safe maglock or fail-secure strike.

For dispensaries with high traffic, a card-reader system at the door (employee badges only) plus front desk remote release for customers is standard. Mantrap configurations (two-door interlock) are used in some high-volume Massachusetts and New York stores.

Camera and access control event correlation

Most cannabis access control violations are not break-ins. They are insider misuse: an employee accessing the vault outside scheduled hours, or accessing inventory during an audit.

The hardware feature that catches this is event correlation:

• Access control records the credential, door, and timestamp.
• Video records the actual person at the door, same timestamp.
• The audit report shows both side-by-side.

This requires the access control platform to integrate with the camera platform. Most enterprise platforms (Brivo, Genetec, Lenel) do this natively. Cloud-only platforms with separate camera systems may not.

Cash handling area

Many dispensaries operate cash-heavy (limited banking access). Cash handling requires its own hardware spec:

• Dedicated room or area with limited access (electronic lock, audit trail).
• Door position sensor and panic button to silent alarm.
• Cash drawer or safe with separate access control.
• Camera coverage of every transaction.

The cash room is often the second-most-secured opening after the vault.

Insurance underwriter requirements

Cannabis insurance is hard to obtain and expensive. Underwriters often require security spec beyond state minimums:

• UL 687 burglary-rated vault door for inventory above a threshold.
• Two-factor access control (card + PIN or card + biometric) on the vault.
• Dual-custody key control on cash and inventory access.
• Annual security audit by a third party.
• Specific camera resolution and retention (1080p minimum, 60-90 day retention is common).

The premium-to-coverage math often justifies hardware upgrades that exceed state minimums. Discuss with your broker before final spec.

Common audit failures and hardware fixes

Three failures inspectors flag often:

1. No audit trail on the vault door. Mechanical lock with key access only, no electronic record of who entered when. Fix: install electronic access control (card or keypad with audit log).
2. Perimeter door without reinforced strike. Original residential-grade strike on a commercial perimeter. Fix: 4-inch reinforced strike, anchored. Costs $50-150 per door.
3. ID door buzz-in with no logging. Front desk releases door but no record of who was admitted. Fix: integrate the release into the access control platform with an audit entry per release.

FAQ

Do I need a UL 687 rated vault door? Depends on state and license type. Many states accept a heavy commercial door with high-security hardware and audit trail. Insurance underwriters may push for UL 687 above a certain inventory value. Confirm both before specifying.

Can I use a standalone keypad lock on the vault? Some standalone keypad locks (Alarm Lock DL2700 with audit, Kaba E-Plex with audit) carry an audit log on the lock and meet state requirements. The risk is no live monitoring and no remote credential management. Read Alarm Lock DL2700 vs Schlage FE595 vs Kaba Simplex for the trade-off.

What about mantrap requirements? Mantraps (two-door interlock) are not state-required in most jurisdictions but are common in larger stores in MA, NY, NJ, and CA. They cut tailgating to near-zero and improve insurance terms.

Do I need biometric on every door? No. Biometric is usually limited to the vault and limited-access storage. Card or PIN on other interior doors is standard.

Can I use the same hardware in a med vs adult-use store? Mostly yes. Adult-use stores often have higher traffic and stricter ID verification protocols, but the door hardware spec is similar. State regulator differences matter more than med-vs-adult-use.

Next step

If you are opening or retrofitting a dispensary, the vault and ID doors are the right place to start the hardware spec. Audit current hardware against the mortise locks and cylinders and cores categories for vault upgrades, and electric strikes for the ID verification door. For the front-desk buzz-in setup, our commercial desk can spec the integrated reader-and-release configuration against your floor plan and state regulator's checklist.