The Seven Layers of a Modern Cannabis Security Program

Security failures rarely come from a single missing device. More often, they appear where responsibilities, procedures, people, physical controls, technology, intelligence, and response plans fail to reinforce one another.

That is why modern cannabis security should be built as a layered program. Each layer has a different job. Together, they help deter preventable incidents, identify problems earlier, limit consequences, support an organized response, and restore operations with better information.

Oregon cannabis rules establish important requirements for security plans, alarms, access, surveillance, records, and incident reporting. Those requirements are foundational, but operators still have to decide how the controls will function as one system in a changing business.

The urgency is practical. In a March 2025 bulletin, the Oregon Liquor and Cannabis Commission reported increased burglaries and armed robberies affecting licensees and emphasized staff discussion, opening and closing awareness, panic-button familiarity, and testing of alarms and cameras. The message was clear: the presence of controls matters, and so does how people use them.

The VSG seven-layer model organizes that work:

1. Leadership

Security begins with ownership. Leadership sets risk tolerance, assigns authority, funds corrective action, and decides whether security is part of operations or something reviewed only after a loss. Without visible ownership, the remaining layers become inconsistent.

2. Policies and standard operating procedures

Policies turn leadership intent into repeatable expectations. Facility-specific SOPs should address access, visitors, contractors, opening and closing, alarm response, incident escalation, evidence preservation, and continuity. A procedure is useful only when it matches the actual facility and names the people responsible.

3. Training and awareness

Employees are the first people to notice many changes: an unfamiliar person, a propped door, unusual questions, a damaged control, or a procedure that no longer works. Training should be role-based, repeated, and supported by a reporting culture that treats concerns seriously without encouraging profiling or panic.

4. Physical security

The physical layer uses the site itself to deter, delay, and control access. Doors, locks, windows, barriers, lighting, secure storage, public-to-restricted transitions, and key or credential management should work together. The objective is not a fortress appearance; it is deliberate control of movement and time.

5. Technology

Cameras, alarms, access systems, communications, and monitoring tools multiply visibility and speed when they are configured correctly. They also introduce dependencies: power, networks, software, permissions, maintenance, and user behavior. Technology should be tested as part of the operating process, not assumed reliable because it is installed.

6. Intelligence

Intelligence gives context to the other layers. It includes incident trends, recurring exceptions, access patterns, local conditions, regulatory changes, employee reports, and lessons from other locations. Its purpose is to help leadership decide what matters now, not to collect information without a defined use.

7. Emergency response

Plans must translate into action. Employees need to know how to report an emergency, protect themselves, account for people, request help, preserve essential information, and transition into recovery. Training and exercises reveal gaps that a written plan cannot.

This layered approach is compatible with broader resilience models. The NIST Cybersecurity Framework 2.0 organizes cyber risk around Govern, Identify, Protect, Detect, Respond, and Recover. CISA physical-security guidance uses a similar lifecycle. The VSG seven layers are not a government standard, but they apply the same useful idea to cannabis operations: risk must be governed across the full cycle, not handled by a single product.